GLOBAL LEGALUPDATESThis document provides a global overview with a regional
angle of privacy laws that have been adopted or proposed in
the past two years. Originally prepared for ESOMAR’s Legal
Affairs Committee as part of their monitoring activities, it’s
now been released for the wider ESOMAR community.
We hope that you will find this document useful and wewould very much welcome any feedback you may have.

22 October 2019

Table of ContentUSA............................................................................................................................................................. 6California........................................................................................................................................................................................................................................... 6
COPPA ............................................................................................................................................................................................................................................ 6
Federal privacy bill........................................................................................................................................................................................................................ 6
Other state laws............................................................................................................................................................................................................................. 6Africa............................................................................................................................................................. 7Tunisia ............................................................................................................................................................................................................................................ 7
Algeria ............................................................................................................................................................................................................................................ 7
Egypt............................................................................................................................................................................................................................................ 7Kenya............................................................................................................................................................................................................................................ 7

Zambia.......................................................................................................................................................................................................................................... 7

Zimbabwe ...................................................................................................................................................................................................................................... 8

Asia Pacific .................................................................................................................................................... 8
Bhutan.......................................................................................................................................................................................................................................... 8India............................................................................................................................................................................................................................................ 8

Indonesia ........................................................................................................................................................................................................................................ 8
Kazakhstan .................................................................................................................................................................................................................................... 8
New-Zealand .................................................................................................................................................................................................................................. 9South Korea ................................................................................................................................................................................................................................... 9
Kyrgyzstan ....................................................................................................................................................................................................................................... 9Thailand ............................................................................................................................................................................................................................................ 9Pakistan ............................................................................................................................................................................................................................................ 9

LATAM .........................................................................................................................................................10
Cayman Islands .......................................................................................................................................................................................................................... 10
Brazil.......................................................................................................................................................................................................................................... 10

Panama ....................................................................................................................................................................................................................................... 10
St Kitts & Nevis ............................................................................................................................................................................................................................ 10
Uruguay ......................................................................................................................................................................................................................................... 10

Middle East ................................................................................................................................................. 11
IranBahrain......................................................................................................................................................................................................................................... 11..................................................................................................................................................................................................................................... 11

Lebanon ...................................................................................................................................................................................................................................... 11
IsraelPage 4......................................................................................................................................................................................................................................... 11

22 October 2019

Page 5

USACalifornia
While the California Consumer Privacy Act(CCPA) will enter into force on 1 January
2020, there is already a new ballot initiative toadapt the law. The project is led by the same
advocacy group which was the driving force
behind CCPA. If it obtains sufficient signatures,
the California Privacy Rights and Enforcement
Act of 2020 (CPREA), will appear on theNovember 2020 California ballot.
It aims to significantly amend the CCPA,
introducing several new consumer rights andCPREA would implement the principles ofdata minimisation, data accuracy, and thesafeguarding of personal information. Itwould further introduce the right to correct
personal information, requiring business totake “commercially reasonable efforts” tocorrect the inaccurate PI.
Where currently the enforcement sits with
the Californian Attorney-General, CPREA
would introduce a new agency, the California
Privacy Protection Agency, to administer andenforce the new law.

obligations for business.
New notice requirements: the existing
disclosure requirements are beingexpanded, with companies also having to
inform consumers about retention periods,
the types of sensitive data collected, andthe specific purposes. Furthermore, it
requires disclosure of the “logic” behindautomated profiling practices that may havea significant adverse impact on consumers.

COPPA
The FTC has started the process to update
its guidelines that implement the Children’s
Online Privacy Protection Act. In particular,
the FTC is looking for feedback on definitions,notice and parental consent requirements, andexceptions to verifiable parental consent.

Federal privacy bill
While there is still a push to adopt a Federal

Expanded consent requirements: while

Privacy Bill, the progress seems to haveunder CCPA consumers have a right to opt-slowed down. Congress organised a series ofout from having their personal information

hearings with experts from both industry andsold, CPREA would introduce heightened

advocacy groups, however this has not yet

protections for “sensitive” personal

resulted in a proposal that can obtain sufficient

information (PI), prohibiting businesses

support in both Chambers. Nevertheless, thefrom selling sensitive PI unless a consumer

general consensus seems to be that a federal

has provided opt-in consent. It furthermore

law will be adopted in the near future.

would introduce a right to opt-out fromthe use of PI for marketing or advertising
purposes.

Other state laws
Awaiting a federal law, several states have

Page 6

Service providers: The CPREA would

introduced their own privacy bills, adding tomandate that businesses include specificthe complexity. At the moment, no less thandata protection obligations in contracts with15 states have introduced legislation, of which(i) third parties to whom businesses sell PI

California, Nevada and Maine have beenand (ii) service providers or contractors tosigned to law. A full overview of these laws canwhom businesses disclose PI.

be found at the IAPP website.

22 October 2019

AFRICA
Tunisia

Egypt

In March 2018, a Bill was introduced to amend

A brand-new Data Protection law was passed

the 2004 Law on the Protection of Personalin June 2019. It will protect personal data for

Data. The goal of the draft is to become

Egyptians and EU citizens based in Egypt.

more in line with the GDPR, so as to create

It applies to all firms dealing with personal

more business opportunities with Europe. It

data. The law includes a consent clause, asprovides more independence to the Nationalwith most Data Protection laws, both for thePersonal Data Authority and gives it morecollection, processing and disclosure of one’spower, namely: being able to issue financial

data but also for the transfer, storage andand judiciary sanctions, being able to issuepreservation of said data. It also provides arecommendations regarding the protection

definition for sensitive data: data relating toof personal data, and a consultative power

physical/mental health, financial, political,

in this domain. The draft also limits custodial

and religious data. Any transfer or sharingsentences to dangerous crimes threateningof personal data to a foreign country must

public security and national defence. Under

first obtain a license from the newly created

the Bill, the transfer of personal data to a third

Personal Data Protection Centre.

party cannot be done without the consent of
the data subject.

Algeria

Kenya
There are currently two separate draft Data
Protection Bills currently under consideration

The 2018 Algerian law on the Protection ofin Kenya; one submitted to the Kenyan

Individuals in the Processing of PersonalParliament, and another to the Senate. Not

Data contains provisions which cover mostmuch is known about the status of these bills

topics expected to be found in a data privacy

at this moment in time. The voting on the Billlaw: data subject’s consent requirements

presented to the Senate was delayed as ofregarding data processing, the right toJuly 2019. The two Bills seem to be clashingmodification and erasure, and children’s

on clauses that have remained unnamed. Duedata protection. Furthermore, the new Law

to the lack of information on this topic, therequires that all personal data processing

main element to take out of Kenya’s currentoperations first be subject to a declaration

legislation state regarding Data Privacy isto the national authority. This same authoritythat it is on its way to develop regulations(Autorité National de Protection des Données

regarding the topic, and on its way to adoptingà Caractère Personnel) is allowed to deliverinternational standards.

administrative sanctions in case of a breach.
The sanctions regarding processing one’s
sensible data are very strict: it can involve not
only a monetary fine, but also two to five years
imprisonment. Finally, it may be interesting
to know that researchers can contact a data
subject without consent through automateddialling, e-mail or similar technology.

ZambiaIn June 2018, the Zambian Cabinet approved
the introduction of a Data Protection Bill toParliament. It applies to both private andpublic bodies, and has an extraterritorial
scope, meaning that this Bill would apply toa personal data controller using processingmeans located in Zambia (except if the data isPage 7

merely in transit through Zambia). It provides

written consent. Information as to when thisfor the establishment of an independent

Bill is expected to pass is unclear.

Administrative Authority, which will haveoversight and control of the law. It will not beable to sanction on breaches themselves, butwill have the power to conduct inquiries, andsubmit complaints to the courts regarding
any breach of the Act. The Bill also contains
provisions on requirements regarding thequality of data, the adequacy of the data,accuracy, and anonymization. Interestingly, theprocessing of non-sensitive personal data ispermitted without consent of the data subject,
whereas processing sensitive data requires

Zimbabwe
Laws on Data Protection and on Freedom toAccess Information are expected to come in
the near future, as the Minister of Information,
Publicity, and Broadcasting Services hasannounced in February of this year that thecurrent Access to Information and Protectionof Privacy Act would be repealed to welcome
new laws on the topic. The information
regarding these laws is, currently, quite scarce.

ASIA PACIFIC
BhutanBhutan’s “Information, Communications andMedia Act” came into force in 2018. The Act
gives Bhutan a minimal data privacy law, butits coverage regarding privacy does remain

stored on servers located within the country
and provide clarifications on the topic of data
ownership. Considering the size of the Indian
market research industry, this is an importantbill to look out for.

extremely limited. The law covers almost alluses of electronic information and enables
for the creation of an Infocomm and Media
Authority, a partly independent body withlimited authority. Under the Act, it is able toinvestigate and resolve complaints. The Act
also covers offences and compensation insuch cases.

Indonesia
The Indonesian Personal Data Protection Billdraws a lot of its features from the GDPR. It
widens the scope of sensitive information toinclude location data from phones and politicalviews and introduces obligations for data
controllers and processors. The Bill does notprovide for a general data protection authority,

India
The Indian Personal Data Bill was introduced
following a landmark ruling on privacy by thebut rather each ministry would remain in
charge of data protection matters for its own
sector.

Indian Supreme Court, which declared thatprivacy is an intrinsic part of Article 21 of theConstitution, which protects life and personal
liberty. Among other things, the Indian Billwould allow for the creation of an independent
regulatory body and heavy penalties in casesof violation. Furthermore, it would apply
to both private and government entities inIndia. Finally, it introduces a data localization
requirement, where data will have to be

Page 8

Kazakhstan
The Kazakh law was updated to add alocalization requirement: data operators now
have to store personal data on the territory of
the Kazakh Republic, although it is not clear
to whom this rule applies. Regardless, nofurther restrictions on cross-border transfer of
personal data are introduced.

22 October 2019

New-ZealandIn New-Zealand, a bill amending the 1993
Privacy Act was introduced in March 2018
and as this is being written, it is undergoing asecond reading in Parliament. It is predicted
to be passed in 2019/2020. One of the mainchanges is to give the Act an extraterritorial
scope. The bill will provide for the Act toprotection of data stored electronically.
Furthermore, data holders will now have toaccount for third-party transfers and register
these transfers with the relevant stateauthorities. The bill also includes the creationof a supervisory authority, although not muchinformation has been given as to when andhow this authority is expected to emerge.

apply to overseas agencies doing businessin New Zealand, and also to an individual“not ordinarily resident in New Zealand, who
is present in New Zealand, in relation to any
action they take, and information they collect,
while in New Zealand, regardless of where
the information is held or where the relevant
individual is located”.

ThailandThe Thai Personal Data Protection Act
was just approved earlier this year by theGovernment and was passed into law. It has
been given one transitional year for companies
and organizations processing personal data
to take the necessary measures to becomecompliant. The law has extraterritorial

South Korea
As for South Korea, a bill was introduced in2018 and is currently under review to amend
the 2011 Personal Information Protection
Act (PIPA), the original goal of which was toexpand on other Acts related to the topic. Thisbill was part of a series of reforms amending
not only the PIPA but also the Network Act,applicability, covers all personal data andallows both for penalties and for lawsuits incase of a personal data breach. It also gives
the right for people to request access to theirpersonal information, and in the case where
the data-controller is not complying to theAct, for their data to be deleted, destroyed oranonymized.

the Location Information Act and the Credit
Information Act thus creating a single law
covering data protection and privacy. The bill
introduces the concept of “pseudonymizeddata”, expands on the permissible purposes
for personal data processing, and permits forthe combination of data sets. Furthermore, it
provides more enforcement powers for the
Personal Information Protection Committee.

Pakistan
The Pakistan Data Protection Bill has beendrafted to provide individuals with rights
similar to those in the GDPR, i.e. consent
giving, security requirements, right of access,correction and erasure of one’s personaldata, etc. It provides for the creation of anenforcement body, the National Commission
for Personal Data Protection, which will be

Kyrgyzstan
Kyrgyzstan’s 2017 amendment to the Law
on Personal Information provided a needed

able to receive and decide complaints fromindividuals, as well as support data processors
and controllers in complying with the Act.

and important legislation related to electroniccommerce and was drafted with a view toa better protection for data subjects andenhances security measures related to thePage 9LATAM
Cayman Islands
In 2017, a new comprehensive data protection
law was adopted which will come into force
by September 2019. The new law takes many
aspects from internationally recognised
principles, such as requiring data minimisation

responsible for its enforcement, which canhand out sanctions between US$1,000 and
US$10,000. It provides for similar rights toindividuals as most modern privacy laws, i.e.
access, rectification, cancellation, objection
and portability.

and purpose limitation. It grants individuals therights to access the data that an organisation
is processing, and to request that any
inaccurate data is corrected or deleted.
The Office of the Ombudsman will be maderesponsible to enforce the law.

St Kitts & Nevis
The Data Protection Act 2018 was enacted onMay 4, 2018. The Act is largely derived fromthe Organization of Eastern Caribbean States(OECS) model, drawing upon EU sources aswell as the OECD. It covers both the publicBrazil
One of the major new data protection laws
is Brazil’s General Data Protection Law. The
law draws heavily on the EU’s GDPR, withsimilar requirements for data exports limited
by adequacy requirements of the destination,
data protection impact assessments, dataprotection officers, data breach notifications
to the DPA and the data subject, and limits on

sector and the private sector in respect tocommercial transactions and goes beyond
minimal principles by including requirements
in relation to sensitive data, and limits on dataretention. The Information Commissioner isempowered to issue enforcement notices.
Data subjects can take civil actions to seek
compensation for breaches of the Act, andthere are a range of criminal penalties.

automated processing.
It also includes well-known rights, including
the right to access, rectify and delete data; theright to be informed about data processing;and the right to data portability. The law will
be enforced by a the newly established Data
Protection Authority and administrative fines
can be given of up to 2% of a company’s
previous year’s revenue in Brazil.

Uruguay
Uruguay was one of the first countries in
LATAM to adopt a comprehensive dataprotection law. In order to ensure its legal
framework remains compatible with the newGDPR, so it can continue to enjoy the EU’s
adequacy decision, it has updated its privacy
law. The updated legislation strengthens theextra-territorial scope, data breach notification,accountability (requiring controllers toPanama
In October 2018, the Panamanian Parliament

implement other GDPR elements), and dataprotection officers.

passed the Data Protection Law, and will takeeffect in 2021, i.e. two years after publicationin the Official Gazette. With this law, Panama
follows the regional trend of adopting
comprehensive data protection legislation.
The law makes the National Authority forTransparency and Access to Information

Page 1022 October 2019

MIDDLE EAST
IranA Draft Act on Personal Data Protection andSafeguarding was introduced to the IranianParliament in September 2018 and is currently
awaiting review. The Draft Act is intended

requirements as listed in the DPL, such as(among other things) the receiving countries
having equivalent data protection laws or
receiving a transfer authorization from thePersonal Data Protection Authority.

to apply to “Iranian citizens (individuals andcorporations), public or private, whether theirprivate data is being processed inside oroutside Iran, and to foreign citizens (individualsand corporations), public or private, only iftheir data is processed by Iranian processors
and controllers”. Furthermore, it proposes thecreation of a Data Protection Commission in
charge of enforcing the Act. However, there
remains in the Draft Act a number of unclear
points, such as its territorial scope, which is
not covered in any provisions. Hopefully, moreclarifications on the Draft Act will be providedin the future.

LebanonLaw No. 81 Relating to Electronic Transactions
and Personal Data was introduced in October
2018, adding Lebanon to the ever-growing
group of countries with a general dataprotection law. The Act took a big step in the
direction of stronger personal data protection
by regulating all collection, processing, or useof personal data, both through digital meansand otherwise (as opposed to data protection
being regulated only for certain industries andonly to a certain extent). The Law provides aset of conditions that need to be met before
one is able to collect, process and use

Bahrain
In Bahrain, the Data Protection Law (DPL)

personal data, as well as a list of exceptions tothese conditions.

was implemented on April 1st 2019, whichapplies to the private sector. The law has an
extraterritorial scope, meaning that it applies
to persons processing personal data usingmeans available in Bahrain (such as appointed
local representatives), and provides for a
Personal Data Protection Authority, which
has the power to investigate breaches of theDPL. A feature of the law worth noting is thatit provides for criminal penalties for violationsof certain provisions of the legislation,such as processing sensitive personal data

IsraelIn February 2018, the Israeli government
approved an amendment to its 1981 Privacy
Protection Law. However, it is currently
gridlocked and pending a decision by theIsraeli Parliament. The amendment focuses
on giving more enforcement powers to theProtection of Privacy Authority, such as thepower to impose higher fines in case of abreach.

or transferring personal data outside of
Bahrain without complying with the relevant

Page 11

This legal review report is a demonstration report ofESOMAR as part of its ESOMAR Plus consultancy
services. Further issues and updates may be produced
in 2020. Contact us if you’d like to know about future
publications and access conditions.
For more information visit esomar.org/esomar-plus or
message us on: plus@esomar.org

Page 1222 October 2019