Introduction

The Jordanian Parliament is currently discussing the draft Personal Data Protection Law (PDPL), in an attempt to finalise such draft and proceed with its ratification. The draft law consists of 24 articles and will be the first legislation of its kind to tackle the protection of personal data in the Hashemite Kingdom of Jordan.

Overview

In light of our increasing reliance on technology, and the mass collection and use of personal data (even more so with the arrival of artificial intelligence), the Jordanian government issued the draft PDPL, which aims to create a balanced framework that permits the collection of personal data by both public and private entities for the purpose of their activities, whilst protecting citizens' rights to privacy.

The current draft PDPL defines Personal Data as: "Any data or information related to a natural person, which would identify him/her, directly or indirectly, regardless of its source or form, including data related to his/her person, family status or whereabouts."

The draft PDPL further defines Sensitive Personal Data as: "Any data or information related to a natural person that directly or indirectly indicates his/her origin or race or indicates his/her opinions, political affiliations, religious beliefs, or any data related to his/her financial status, health, physical, mental or genetic status, or his/her biometric fingerprint or his/her criminal record, or any information or any data that the [Council] decides to consider sensitive, if its disclosure or misuse causes harm to the person concerned."

The draft PDPL regulates the processing of personal data and provides clear guidelines for the collection, processing and use of such data.

Article (4) provides that an individual's prior approval must be obtained for the processing of their data, whilst Article (5) details the conditions that must be satisfied for such pre-approval.

Article (7) provides the conditions for processing personal data including, but not limited to, that the processing should be completed for a clear and legitimate purpose, should be carried out via legal and legitimate means, and should be based on valid, accurate and relevant data.

Article (12) provides the conditions to which data processors are required to adhere, including: conducting and implementing the processing in accordance with the requirements and conditions stipulated in the PDPL and the regulations and instructions issued pursuant thereto; conducting the processing within the limits of the specific purpose and duration of the processing; erasing the data at the end of the processing period or handing it over to the person in charge; and refraining from performing any action that would make data or processing results available, except in cases authorised by law.

Articles (16) and (17) provide for the formation of a Personal Data Protection Council, which will be responsible for, among other matters: approving policies, strategies, plans and programmes related to data protection and monitoring their implementation; adopting standards and measures for data protection, including codes of conduct for the proper performance of the administrator and processor for their work; and issuing licences and permits for storing, processing, diagnosing and transferring data.

Article (19) provides for the measures to be taken in the event of a breach of data security and integrity which would cause serious harm to an individual.

Finally, Articles (20) and (21) provide for the penalties that apply in case of breach of the PDPL and the regulations and instructions issued pursuant thereto. Such penalties include the revocation of the licence or permit for data processing, or a monetary fine.

Current status (as of 30 August 2023)

Despite the fact that the first draft of the PDPL was issued in 2014, the legislation has yet to be ratified by the Jordanian Parliament. Recently, the draft was revised by the Jordanian government and handed to the Jordanian Parliament for discussion.

At the moment, we will be unable to predict when the PDPL will come into force.