metadata: authors: 0: author: Daza Jaller,Lillyana Sophia
1: author: Molinuevo,Martin
count: Middle East and North Africa
docna: 0: docna: Digital Trade in MENA : Regulatory Readiness Assessment
docty: Policy Research Working Paper
subtopic: International Trade and Trade Rules,Finance and Development,Information Security & Privacy,ICT Applications,Settlement of Investment Disputes
teratopic: International Economics and Trade,Finance and Financial Sector Development,Information and Communication Technologies,Law and Development
abstracts: cdata!: A strong regulatory framework can
            provide essential tools for remote transactions and improve
            trust in digital trade. Yet, regulations can also introduce
            restrictions that hamper the conditions for digital markets.
            Based on a database of 20 Middle East and North Africa
            countries and 20 comparator countries around the world, this
            paper shows that the Middle East and North Africa region is
            falling behind in establishing a modern governance framework
            for the digital economy. The analysis focuses on a set of
            regulatory areas, including electronic documentation and
            signature, online consumer protection, data governance,
            cybersecurity, and intermediary liability regulations. It
            assesses each country's domestic regulatory framework
            in light of recent international trends and regulatory
            models. The study shows that regulation of digital markets
            in countries in the region is still in its infancy, being
            mostly governed by general laws that were not originally
            intended for the digital era. Some countries have tried to
            support an export-oriented information technology sector by
            keeping an updated regulatory framework. However, regulation
            in most countries in the region, regardless of their level
            of development, still features some major loopholes that can
            limit consumer trust in digital markets or reduce certainty
            -- and increase costs -- for digital businesses.
repnme: repnme: Digital Trade in MENA : Regulatory
            Readiness Assessment
display_title: Digital Trade in MENA : Regulatory
            Readiness Assessment
listing_relative_url: /research/2020/03/31909983/digital-trade-mena-regulatory-readiness-assessment
topicv3: ICT Security m1326856 670,Trade m1326924 698,Data Privacy m1327097 2369,Consumer Protection m1327226 364,Dispute Resolution m1327498 843
publishtoextweb_dt: 2020-03-30T00:00:00Z
historic_topic: International Economics and Trade,Finance and Financial Sector Development,Information and Communication Technologies,Law and Development
origu: Office of the Chief Economist (MNACE)
no_of_pages: 45
author_keys: 0: author_key: 1442463
1: author_key: 886230
model_extractions: Policy Research Working Paper 9199 Digital Trade in MENA Regulatory Readiness Assessment _Lillyana Daza Jaller Martín Molinuevo_ Middle East and North Africa Region Office of the Chief Economist & Macroeconomics, Trade and Investment Global Practice March 2020
Policy Research Working Paper 9199

# **Abstract**

A strong regulatory framework can provide essential tools for remote transactions and improve trust in digital trade. Yet, regulations can also introduce restrictions that hamper the conditions for digital markets. Based on a database of 20 Middle East and North Africa countries and 20 comparator countries around the world, this paper shows that the Middle East and North Africa region is falling behind in establishing a modern governance framework for the digital economy. The analysis focuses on a set of regulatory areas, including electronic documentation and signature, online consumer protection, data governance, cybersecurity, and intermediary liability regulations. It assesses each country’s domestic regulatory framework in light of recent international trends and regulatory models. The study shows that regulation of digital markets in countries in the region is still in its infancy, being mostly governed by general laws that were not originally intended for the digital era. Some countries have tried to support an export-oriented information technology sector by keeping an updated regulatory framework. However, regulation in most countries in the region, regardless of their level of development, still features some major loopholes that can limit consumer trust in digital markets or reduce certainty—and increase costs—for digital businesses.

This paper is a product of the Office of the Chief Economist, Middle East and North Africa Region and the Macroeconomics, Trade and Investment Global Practice. . It is part of a larger effort by the World Bank to provide open access to its research and make a contribution to development policy discussions around the world. Policy Research Working Papers are also posted on the Web at http://www.worldbank.org/prwp. The authors may be contacted at mmolinuevo@worldbank.org.

_The Policy Research Working Paper Series disseminates the findings of work in progress to encourage the exchange of ideas about development issues. An objective of the series is to get the findings out quickly, even if the presentations are less than fully polished. The papers carry the names of the authors and should be cited accordingly. The findings, interpretations, and conclusions expressed in this paper are entirely those of the authors. They do not necessarily represent the views of the International Bank for Reconstruction and Development/World Bank and its affiliated organizations, or those of the Executive Directors of the World Bank or the governments they represent._ Produced by the Research Support Team
Di ital Trade in MENA <u>g</u> Regulatory Readiness Assessment Lillyana Daza Jaller Martín Molinuevo

**JEL Codes:** F13, K24, L86, O38 **Keywords:** e-commerce, digital markets, regulatory framework, data policy
This note was prepared by Lillyana Daza Jaller (Consultant), and Martín Molinuevo (Senior Counsel, ETIRI), as a background paper for a World Bank study on “ _New Economy Agenda for MENA_ ”, under the guidance of Antonio Nucifora (Manager). The authors are grateful to Daniel Lederman, Martha Licetti, Ana Paula Cusolito, Christina Wood, Francois De Soyres, Jerome Bezzina, and the participants to the author’s workshop of July 2019 for valuable comments and suggestions.

This note was partially funded by the Umbrella Facility for Trade Trust Fund (UFT), established with contributions from DFID, Sida, SECO, the Netherlands Ministry of Foreign Affairs, and the Norwegian Ministry of Foreign Affairs.
<!-- Start of picture text --> sooO Enabling regulatory\ policies Restrictive) measures<br>v | (<br>dataPrivacy protectionand<br>Cybersecurity<br>Intellectual° ie tec PropertleFiability Domainrestrictionsname<br>° fair use<br>Conaaeyr<br>protection Ban of online<br>sales<br>e-payments<br>e-signature localizDat a tion<br>electronic<br>documentation<br>regulation<br><!-- End of picture text -->
Regulation of digital markets in Middle East and North Africa (MENA) countries is underdeveloped, being mostly covered by general laws not originally intended for the digital era. Regulations on long-standing digital policies, such as e-documents and e-signatures, are found throughout the region, but even those frameworks are largely outdated and incomplete. Only a handful of countries have advanced in most key regulations for digital markets, but comprehensive and up-to-date regulatory solutions are only found in a few countries in the region, notably Qatar, Bahrain, and Morocco, while others, like Lebanon and Tunisia, also provide comprehensive regulations, albeit with small gaps. Digital regulation is virtually inexistent in a few countries like Iraq, Jordan, UAE, and Kuwait, whose frameworks are severely outdated (in areas like electronic transactions) or stemming from broader frameworks not designed for current digital markets (on data governance and intermediary liability). For a quick attempt to catch up on digital regulations, these countries could adopt the approach of Lebanon, which recently introduced a law on e-commerce tackling multiple regulatory policies at once, from e-signature to intermediary liability. Most countries in the region, including Lebanon, as well as Oman, Jordan, the Islamic Republic of Iran, and UAE would benefit from detailed, specific regulations to expand the broad frameworks already in place, as well as new frameworks to address current gaps.

# A. Approach and methodology

In what follows, this study reviews the main policy areas that build the regulatory framework for digital markets for countries in the MENA region. The study considers a set of regulatory areas of central importance to digital markets and assesses the domestic regulatory frameworks in light of recent international trends and regulatory models. In particular, the study addresses electronic documentation and signature; online consumer protection; data governance; cybersecurity; and intermediary liability regulations.

To guide the analysis, the study draws on a pilot database for regulation on digital trade in 40 countries.<sup>1</sup> The data are based on the review of laws and regulations relating to electronic documentation and signature; online consumer protection; data governance; cybersecurity; and intermediary liability regulations in MENA countries as well as over 20 comparator countries. This provides information on the regulatory stances of the different countries on a selected set of key provisions relevant to trade policy. At the same time, the codification of the regulatory frameworks allows to translate that regulatory information into dummy variables or into a Digital Trade Regulatory Readiness Index to be used in economic analysis.

The study offers an overall assessment of how comprehensive and up to date the regulatory framework for digital trade is. The different regulatory areas under review have in common that, taken together, they offer a set of basic rules that create tools for remote transactions (edocument and e-signature) or clarify conditions of digital transactions that enhance consumers’ (online consumer protection; data governance and cybersecurity) and business’ (intermediary liability) trust. Importantly, however, there are a number of additional policies relevant to digital trade that are not covered in the current study: regulations related to competition policy, taxation, e-payments, as well as the conditions for business licenses, which can also make or break a conducive framework for digital businesses.

> 1 See Annex 1 for details.

2
In assessing these regulatory fields, the analysis focuses on selected regulatory options within each of these fields, so as to assess the regulations in the region in a comprehensive manner. For example, when assessing e-signature regulation, the study discusses the scope of the signature and legal validity given to the e-signature. While an in-depth assessment of the regulation of e- signature in a specific country would require discussing several other aspects that are referenced only in passing in this analysis (e.g. the nature of the certifying provider), the assessment of these key regulatory options provides a picture of the level of sophistication of the regulation and its timeliness in keeping with the policy challenges introduced by digital transactions.

The different sections of the study are focused on the different regulatory fields under consideration, and a concluding section summarizes the main findings and offers policy recommendations. Each section first presents the key features of the regulation and highlights international regulatory practices and models and then describes the regulatory practices by MENA countries in that particular area, assesses strengths and weaknesses of the regulations, and provides recommendations.

# II. Regulation on electronic transactions

The legal recognition of electronic documents and signatures as adequate tools for remote businesses is a key step in building a thriving digital market. As communication technologies connect people and businesses around the world with increasing ease and convenience, businesses engaged in digital trade also expand their network of clients and suppliers across borders. A conducive regulatory framework for digital trade should hence guarantee that contracts concluded remotely through electronic channels are valid and legally enforceable just as those concluded in person. Ensuring that electronic documents and signatures are fully recognized and can be enforced is therefore an essential regulatory step to allow for remote electronic contracts and transactions.

Being a key enabler for cross-border businesses, the regulation of electronic transactions is one of the few areas of digital regulation with dedicated international guidance and substantive regulatory experience around the world. In fact, regulation on electronic information and signatures can be traced back to the use of the telegraph in the 19th century.

All countries in MENA have advanced on regulating electronic transactions, typically following the United Nations Commission on International Trade Law (UNCITRAL) guidelines for e- documents and e-signatures. Nonetheless, most regulatory frameworks remain incomplete or outdated, providing partial solutions (e-documents) or unnecessarily burdensome requirements that limit the use of electronic transactions (e-signatures). In the case of e-signatures, it also remains unclear whether MENA countries have established the institutional setting necessary to support e-signature regulation, which undermines the regulation itself.

## A. Electronic documentation

A strong and reliable framework for e-documents is particularly important for business-tobusiness (B2B) transactions. Transactions by final consumers, such as those on e-commerce platforms like Souq.com and app-based services like Airbnb, do not typically entail major documentation exchanges and can be concluded even without a specific regulatory framework for electronic transactions. However, for business relations that require a degree of customization of the products and services and that are provided over time, such as those that allow suppliers to 3
connect to global value chains and/or services that require peripatetic delivery over extended contract periods, the ability to conclude a contract or amend its terms remotely in a secure and reliable manner is a key step towards engaging in business-to-business digital trade.

# International guidelines and practice

UNCITRAL Model Law on Electronic Commerce (MLEC) of 1996 is the international standard on regulation of electronic documents. The main objective of the MLEC is to facilitate remote transactions by establishing rules to allow the electronic equivalent of paper-based documents to be legally recognized, thereby removing obstacles to remote transactions. The MLEC promotes the principles of non-discrimination, technological neutrality, and functional equivalence in the treatment of electronic documentation. The principle of non-discrimination is the cornerstone of the regulation, as it ensures that a document would not be denied legal effect, validity, or enforceability solely on the grounds that it is in electronic form.

Regulation can recognize the validity of electronic documents in general terms or provide specific provisions on key regulatory issues. All regulations inspired in the MLEC at very least ensure the legal validity of documents can be recognized and enforced, even when found in electronic form. Specific regulations on electronic documents further elaborate and provide answers on specific uses of e-documents, such as evidential weight and technological neutrality. Specific rules on electronic documents that tackle issues like evidential weight and technological neutrality, and most often both such elements, are clearly the preferred type of regulation in the selected comparator countries (Table 1). While most of these countries have technologically neutral provisions in their e-document regulation, several – mainly those located in Central and South Asia—lack provisions recognizing the evidential weight of e- documents.

Specific rules on e-documents address the issue of the evidential weight of electronic documents when presented as evidence in legal proceedings. The MLEC provides that e-documents should not be denied admissibility as evidence in legal proceedings solely based on their electronic nature. The probative value of an e-document should be assessed based on several factors, including the reliability of the methods used for creation, storage, and transmission.

|**Table 1. Adopti**|**on of do**<br>**None**|**mestic reg**<br>**General**|**ulation on e-documents**<br>**E-Docs regulation**<br>**Specific**<br> <br>|
|---|---|---|---|
||||Evidential<br>weight<br>Technological<br>neutrality|
|**Albania**|||●|
|**Armenia**|||●|
|**Bangladesh**|||●|
|**Burkina Faso**|||●<br>●|
|**Canada**|||●<br>●|
|**Colombia**|||●<br>●|
|**France**|||●<br>●|
|**Honduras**|||●<br>●|
|**Indonesia**|||●<br>●|
|**Kazakhstan**||●||
|**Kenya**|||●|
|**Korea, Rep.**|||●|
|**Kyrgyzstan**||●||
|**Malaysia**|||●|
|**Mexico**|||●<br>●|
|**Moldova**|||●<br>●|
|**Pakistan**|||●|
|**Senegal**|||●<br>●|
|**Tanzania**|||●<br>●|
|**Vietnam**|||●<br>●|

Technologically neutral regulation grants parties to an online transaction the freedom to choose the adequate technology based on their needs. Additionally, certain laws include requirements regarding the way e-documents are stored, such as requiring encryption, which can be unduly 4
restrictive. In that sense, it is worth recalling that any type of electronic communication, including through casual means like text messages, emails, or electronic chat, can be considered an electronic document with probative value, even when such communications are not encrypted or are relative weak in cybersecurity terms. According to the MLEC, a requirement to store an e- document unaltered is inappropriate, as data messages tend to be decoded, compressed, or converted in the storage process. The MLEC provides the following conditions for the storage of e-documents:

- The information must be accessible for subsequent reference;

- The information must be stored in the manner in which it was created or transmitted, or in a manner which can be demonstrated to accurately represent it; and

- Any existing information that enables the identification of the origin and destination of the data message and the data and time of transmission must be stored.

# MENA

All MENA countries, except for Djibouti and the Republic of Yemen, have adopted regulations that recognize electronic documents as equivalent to paper-based documents (Table 2). Israel has done so by including provisions recognizing the general principal of non-discrimination of e-documentation in its legislation on electronic signature. The rest of the countries in the region have instead adopted a more developed framework on e-documents, reflecting in greater detail the principles of the UNCITRAL MLEC. While a more detailed regulation offers advantages in terms of clarity of the regulation, both approaches do give legal recognition to electronic documents.

Lebanon was the last MENA country to recognize electronic documents, with a broad e-transaction law entering into force in October 2018. While it is recognized that new law comes to fill an important vacuum, the law has received substantial criticism.2 With regard to electronic

**Table 2. Adoption of regulation on e-documents in MENA**

||||**E-Docs regu**<br>|**lation**<br>|
|---|---|---|---|---|
||**None**|**General**|**Sp**|**ecific**|
||||Evidential<br>weight|Technological<br>neutrality|
|**Algeria**|||●|●|
|**Bahrain**|||●|●|
|**Djibouti**|●||||
|**Egypt, Arab**<br>**Rep.**|||●||
|**Iran, Islamic**<br>**Rep.**|||●||
|**Iraq**||||●|
|**Israel**||●|||
|**Jordan**|||●|●|
|**Kuwait**|||●||
|**Lebanon**|||●||
|**Morocco**|||●|●|
|**Oman**|||●|●|
|**Qatar**|||●|●|
|**Saudi Arabia**|||●|●|
|**Tunisia**|||●|●|
|**United Arab**<br>**Emirates**|||●|●|
|**Yemen, Rep. **|●||||

documents, the new legislation follows the standard of giving full legal effect to electronic documents, but it does so “ _provided that [...] they are organized and stored in a way that preserves their safety_ ” and clarifies that “ _[a]ny electronic writing that does not meet the criteria above shall be considered as introduction of written evidence_ ” (Article 4). While this condition, applied by many other countries in the region, appears to promote cybersecurity measures, it

> 2 _See_ (Dentons 2019)

5
unnecessarily limits the scope of the electronic documents. Under a strict reading, it would seem to suggest that documents such as email or non-encrypted documents may not be fully recognized as electronic documents equivalent to paper documents.

# B. Electronic signature

The ability to conclude legally binding contracts remotely, without the face-to-face interaction of the parties, is a central feature of global business. Digital technologies reduce distances by facilitating interaction and collaboration across borders; electronic signature complements that digital proximity by providing a mechanism which grants full legal recognition to any agreement that may be concluded, even at a distance.

Digital activity involves engaging in remote—often international—contracts on a routine basis, to the point where users are not often aware of its international nature. For instance, accepting the terms of use of a website or a mobile app (often without even reading the content) by clicking a box entails, in legal terms, the acceptance of a contract through an electronic signature. For the developer of the app or the supplier of the online service, it is hence essential that the legal framework provide that such signature is indeed a recognized form of signature –in other terms, of accepting the terms of the contract.

Electronic signatures are particularly important to transactions between firms, especially in the context of a global or regional value chain. While e-commerce transactions by final consumers are typically individual purchases of discrete goods or services that can be satisfied with a simple click on a box, cross-border deals between firms often involve a business relationship that extends in time and entails the production and delivery of customized goods or services, whose terms and specifications need to be clearly agreed to in advance. This type of B2B interaction must be reflected on a distinct, specific, contract between the client and supplier, sanctioned with the signature of the parties to accept that those are the agreed terms. For these engagements, the parties may wish to back those digital documents with an electronic signature that provides certain guarantees against tampering or prying by third parties.

## International guidelines and practice

At a minimum, a regulatory framework should recognize that electronic signatures are a legally valid form of accepting an obligation or terms of a document. Further, the framework should also ensure that, when an electronic signature meets certain requirements, it has full recognition of validity and enforceability, just like a handwritten signature.3 The UN Convention on the Use of Electronic Communications in International Contracts provides that e-signatures should satisfy a legal requirement for a signature so long as the e- signature meets certain requirements. The method used to identify the party’s intention in respect of the information attached must be either as reliable as appropriate for the purpose of the electronic communication or proven to have fulfilled the requirements. The Convention’s scope is limited to contracts between parties whose places of business are in different countries, and it

> 3 Handwritten signatures, in addition to being legally valid, are also enforceable as they create the presumption that they were indeed inserted by the designated person (a _rebuttable_ presumption, that allows the interested person to show proof, for instance, that the signature had been forged). Electronic signatures can be recognized as legally valid but may or may not be given full enforceability depending on the technology and procedures in use. Typically, only “digital signatures” that use some type of encryption technology are given full enforceability – _see_ Box 1 for further details. An electronic signature that is not fully enforceable would require that the person claiming its validity also provide evidence that such electronic signature was indeed inserted by the designated person.

6
<!-- Start of picture text --> a)<br><!-- End of picture text -->
<mark>typically involves, in addition the use of a PKI : i) a certificate service provider (CSP)—typically an IT firm</mark> who offers electronic signature technologies, such as DocuSign or Adobe, and has been vetted to issue such certificate— who generates, stores, issues, renews, revokes, and verifies the digital certificates, and ii) a registration authority who verifies the identity of entities before their digital certificates are stored at the CSP, which could be a public entity or a private one, depending on the regulation.

With the growth of e-commerce around the world, governments have enacted legal instruments to give recognition and legal validity to electronic and digital signatures. While the objective of all these regulations is recognizing some kind of electronic representation as a legally valid signature, three different regulatory models are currently in place ( (Frederick Fischer 2001); (Blythe 2011)).

- On one end of the spectrum, the **prescriptive approach** only recognizes one type of e- signature as legally valid –typically, digital signatures that have adopted specific encryption mechanism and have been issued following prescribed procedures. While secure digital signatures have the advantage of offering the maximum degree of security, the prescribed technology and procedures is unnecessarily costly and burdensome for most activities, as the parties may be forced to resort to certification authorities and pay a fee thereto.  This approach was pioneered in the state of Utah, and later replicated in other states in the United States and countries around the world, including Bangladesh, Brazil, and Peru  ( (Blythe 2011); (Adobe 2019)).

- A “minimalist” or **“permissive” approach** , on the contrary, allows parties to choose the technology they prefer, giving any selected technology equal legal validity. The United States, Canada, Australia, and New Zealand have adopted this approached (AssureSign 2019). This approach affords the greatest liberty to the parties in adopting any type of technologies, thus reducing costs. However, the approach fails to acknowledge that certain technologies are indeed more secure than others and the greater security may be warranted in certain conditions.

- A hybrid or **“two-tiered” approach** is a mix between these two, recognizing all technologies as legally valid while giving certain presumptions (authenticity, integrity, etc.) only to digital signatures. Like the prescriptive approach, it describes the requirements of a digital signature, and includes rules of conduct regarding the rights and responsibilities of the parties, including the signatory, the certification service provider (CSP), and the relying party.  A few countries have further developed this approach to offer greater liberty to private parties in adopting digital signatures through technologies of their own preference or allowing certification by non-accredited CSPs.

Singapore has further elaborated the two-tiered model creating a third category of signature. With a view to increasing security while reducing costs of adoption, Singapore’s Electronic Transactions Act allows private parties to adopt any _commercially reasonable security_ available that, to the extent that it could provide equivalent security as the prescribed mechanism for digital signatures, they would also be granted the same treatment as handwritten signatures. This model essentially extends flexibility to the parties in selecting a technology and a certification provider of their choosing. Other countries, like Mexico and Colombia, have followed this model in their more recent regulations. The EU Electronic Identification and Authentication Services Regulation (eIDAS) of 2016 also opened the door for EU Members to recognize an 8
“advanced digital signature” that has greater flexibility in the type of encryption technology and selection of CSP.

The hybrid approach has become the preferred method of regulating electronic signatures around the world. In 1998, Singapore introduced the first law of this type, later amending it in 2010 to bring it in line with the UN Convention, and it has become the trend in modern electronic signature regulation, having been adopted by the European Union; China; Hong Kong SAR, China; Japan; and the Republic of Korea, among many others (Blythe 2011). This approach is preferable as it sets out the use of a specific technology (PKI) and procedures (certification services providers) to ensure that secure digital signatures can indeed guarantee the identity of the signatory and integrity of the content. These specific procedures are required, for instance, for submitting documents to the government.

Most countries in the sample have adopted the hybrid approach, recognizing all e- signatures as legally valid while giving greater evidential weight to digital signatures (Table 3). While some of these regulations grant specific legal presumptions to secure digital signatures, such as integrity or intent, others are broader, granting them the presumption of reliability. Some countries followed Singapore’s example, extending the legal presumptions to all digital signatures meeting certain criteria, regardless of the certification service provider or technology used. Countries in Central Asia –such as Armenia, Kazakhstan, and Moldova— maintain the prescriptive model, which is unduly

|**Table 3: Regul**|**ations on elect**<br>**Model**<br>**adopted**|**ronic signature**<br>**Flexibility**<br>**in CSP or**<br>**technology**<br>**used**|**around the world**<br>**Certification authorities**|
|---|---|---|---|
|**Albania**|Two-tiered|Yes|National Authority for Electronic<br>Certification|
|**Armenia**|Prescriptive|Yes|“Authorized Body”|
|**Bangladesh**|Prescriptive|Yes|Controller of Certifying Authority|
|**Burkina**|Ttid|N|Regulatory Authority of Electronic|
|**Faso**|wo-ere|o|Communications|
|**Canada**|Permissive|Yes|Treasury Board|
|**Colombia**|Two-tiered|Yes|Superintendence of Industry and<br>Commerce|
|**France**|Two-tiered|No|National Agency for Information<br>Systems Security|
|**Honduras**|Two-tiered|Yes|Directorate General of Intellectual<br>Property|
|**Indonesia**|Prescriptive|Yes|Minister of Communications and<br>Informatics|
|**Kazakhstan**|Two-tiered|No|National Certification Authority|
|**Kenya**|Prescriptive|Yes|Communications Commission|
|**Korea, Rep.**|Two-tiered|No|Korea Information Certificate<br>Authority|
|**Kyrgyzstan**|Two-tiered|No|State Committee of Information<br>Technologies and Communications|
|**Malaysia**|Two-tiered|No|Controller of Certification<br>Authorities|
|**Mexico**|Two-tiered|Yes|Secretariat of Economy|
|**Moldova**|Two-tiered|No|Information and Security Service|
|**Pakistan**|Two-tiered|Yes|Electronic Certification<br>Accreditation Council|
|**Senegal**|Two-tiered|Yes|State Information Technology<br>Agency|
|**Tanzania**|Two-tiered|No|Communications Regulatory<br>Authority|
|**Vietnam**|Two-tiered|No|Root Certification Authority|

9
restrictive as it requires the use of specific technologies, such as encryption, to recognize the validity of the e-signature. All countries in the review allow commercial firms to provide legally recognized certifications, and some, such as Armenia and Kyrgyzstan, allow for certification by non-authorized CSPs. Providing these options reduces the costs of adoption as parties to a transaction have alternatives to choose from when seeking certification.

# MENA

Most of the countries in the MENA region have adopted regulation that recognizes electronic signatures as legally valid, adopting a twotiered model (Table 4). In the majority of the countries, parties to a contract may choose any method of signing that they deem appropriate given the circumstances. However, in most cases, the use of a digital signature with a certificate issued by a certification service provider licensed by the authority is given evidentiary presumptions, including the presumption of validity and authenticity. Other countries in the region have implemented the prescriptive approach, only viewing digital signatures as legally valid, regardless of the circumstances. This can be restrictive, as it does not allow the parties to a contract to select the technology that best suits their needs.

Some MENA countries still feature burdensome models, and implementation is

|**Table 4: Reg**|**ulations on ele**<br>**Model**<br>**adopted**|**ctronic signatu**<br>**Flexibility**<br>**in CSP or**<br>**technology**<br>**used**|**re in MENA**<br>**Certification authorities**|
|---|---|---|---|
|**Algeria**|Two-tiered|No|Economic Authority of<br>Electronic Certification|
|**Bahrain**|Two-tiered|No|No accredited CSPs to date|
|**Djibouti**|None|N/A|N/A|
|**Egypt,**<br>**Arab Rep.**|Prescriptive|N/A|ITIDA operates the Egyptian<br>Root Certificate Authority and<br>issues licenses for CSPs.|
|**Iran,**||||
|**Islamic**|Two-tiered|Yes|N/A|
|**Rep.**||||
|**Iraq**|Two-tiered|No|N/A|
|**Israel**|Two-tiered|Yes|Registrar of Certification<br>Authorities|
|**Jordan**|Two-tiered|Yes|N/A|
|**Kuwait**|Two-tiered|No|N/A|
|**Lebanon**|Two-tiered|No|Lebanese Accreditation Council<br>(COLIBAC).|
|**Morocco**|Two-tiered|No|Directorate General of<br>Information Systems Security|
|**Oman**|Two-tiered|Yes|Information Technology<br>Authority|
|**Qatar**|Two-tiered|No|National Center for<br>Information Security|
|**Saudi**<br>**Arabia**|Two-tiered|Yes|National Center for Digital<br>Certification|
|**Tunisia**|Prescriptive|N/A|National Agency for Digital<br>Certification|
|**United**||||
|**Arab**|Two-tiered|Yes|Controller|
|**Emirates**||||
|**Yemen,**<br>**Rep. **|None|N/A|N/A|

uncertain across the region. The Arab Republic of Egypt and Tunisia maintain prescriptive models that unnecessarily limit the options of private parties to choose a type of e-signature appropriate for their circumstances.

While other countries have adopted seemingly more liberal regulation, implementation remains uncertain across the region. For instance, Bahrain has to date accredited no certification services 10
providers.4 This means that no firm or individual can adopt a secure digital signature, thus severely crippling the framework for e-signatures. Information regarding the certification authorities of other countries in the region, including Jordan and Kuwait, is also not available online, reducing the effectiveness of the system in the best-case scenario. All other countries have appointed public entities as certification authorities, which often leads to poor implementation when the agencies are not adequately trained and equipped. However, all MENA countries allow for certification by private certification providers, which can help mainstream the use of digital signatures.

# III. Trust-building regulation

Regulation plays an essential role in bolstering digital markets by promoting trust. As digital markets are still in their infancy, the top reason for not engaging in online purchases, at least in developed markets, remains the lack of trust in remote electronic transactions (Figure 2). Consumers typically have no face-to-face contact with vendors, which leads to few “visual cues”, such as location, facilities, and personalized interaction, which helps consumers gauge the retailer or suppliers’ professionalism. In this environment, consumers are asked to disclose sensitive information and personal data either to a retailer, online intermediary, or digital platform. As a result, one important limiting factor in both developed and developing economies ‐ is the perception that cross border online transactions and delivery are less secure, and remedies do not exist for when something goes wrong (World Economic Forum 2019).

Three sets of regulations are particularly relevant to promoting consumers’ trust in digital markets:

- An effective framework for _online consumer protection_ helps consumers be better informed about the characteristics of the good or services at hand as well as the terms of the transaction, promoting a greater understanding of the conditions of the transaction;

- As consumers are required to provide sensitive personal and financial details, a strong _data governance_ regime is essential to give individuals control over their own information;

- Similarly, a _cybersecurity_ framework further improves trust by ensuring that firms meet certain minimum technical standards in the protection of their digital information and that illegal access to such data is duly prosecuted and, if needed, penalized.

## **Figure 2. Lack of trust is the top reason for not purchasing goods and services online**

> 4 (International Trade Administration 2019)

11
|donot trust shopping online EE 49% | have heard bad things about online... EN 25% It is too expensive to shop online EEN 23% lam not able to make online payments = 21% It is too difficult to shop online E— 19% | donot find what! look for = 17% Services do not deliverto my location ME 8% No Internet availability when | need it MM 8% Other EE 14%

<!-- Start of picture text --> Pre-Purchase Purchase Post-Purchase<br>* Information disclosure * Contract terms * Right of withdrawal<br>* Product features * Resolution and redress<br><!-- End of picture text -->
laws have existed long before the emergence of the internet, and the protections can also extend, at least partially, to online transactions. However, shopping on the internet brings new legal challenges, and while some have introduced new legislation or updated consumer codes to include specific provisions for electronic transactions, most countries still lack a comprehensive regime for online consumer protection.

One particular consideration is whether to establish specific regimes tailored to transactions through e-commerce platforms. Solutions on this area differ widely. For instance, China places ‐ extensive responsibilities on e commerce platforms to the extent that platforms will be held liable if they fail to provide information on offending vendors, whereas the United States and the European Union place more responsibility on users (World Economic Forum 2019).

The key principles for online consumer protection are recognized in two main international softlaw instruments. In 2016, the Organization for Economic Co-operation and Development (OECD) revised its Recommendation on Consumer Protection for E-commerce of 1998, modernizing its approach to fair business practices, information disclosures, payment protections, unsafe products, dispute resolution, enforcement and education. Similarly, the UNCTAD Guidelines on Consumer Protection of 1985 (revised in 1999) were updated in 2015 to include recommendations directed to protecting online consumers and improving transparency in online transactions. The Guidelines also recommend cooperation among countries, including in terms of information exchange and enforcement activities.

# **<mark>Box 2: General Principles for Consumer Protection for E-commerce from OECD Recommendation</mark> Pre - Purchase**

1. Transparent and effective protection: consumers who participate in e-commerce should be afforded transparent and effective consumer protection that is not less than the level of protection afforded in other forms of commerce.

2. Fair business, advertising and marketing practices: businesses engaged in e-commerce should pay due regard to the interests of consumers and act in accordance with fair business, advertising and marketing practices as well as the general principle of good faith.

3. Online disclosures: online disclosures should be clear, accurate, easily accessible and conspicuous so that consumers have sufficient information to make an informed decision regarding a transaction. Online disclosures comprise the following areas of recommendations:

- a. Information about the business: businesses engaged in e-commerce with consumers should make readily available information about themselves that is sufficient to allow, at a minimum: i) identification of the business; ii) prompt, easy and effective consumer communication with the business; iii) appropriate and effective resolution of any disputes that may arise; iv) service of legal process in domestic and cross-border disputes; and v) location of the business.

- b. Information about the goods and services: businesses engaged in e-commerce with consumers should provide information describing the goods or services offered that is sufficient to enable consumers to make informed decisions regarding a transaction.

- c. Information about transaction: businesses engaged in e-commerce should provide information about the terms, conditions, and costs associated with a transaction that is sufficient to enable consumers to make an informed decision regarding a transaction. Consumers should be able to easily access this information at any stage of the transaction.

**Purchase**

13
4. Confirmation process: businesses should ensure that the point at which consumers are asked to confirm a transaction, after which time payment is due or they are otherwise contractually bound, is clear and unambiguous, as should the steps needed to complete the transaction, especially for new payment mechanisms.

# **Post - Purchase**

5. Dispute resolution and redress: consumers should be provided with meaningful access to fair, easy-touse, transparent and effective mechanisms to resolve domestic and cross-border e-commerce disputes in a timely manner and obtain redress, as appropriate, without incurring unnecessary cost or burden. These should include out of court mechanisms, such as internal complaints handling and alternative dispute resolution. Subject to applicable laws, the use of such out-of-court mechanisms should not prevent consumers from pursuing other forms of dispute resolution and redress. (See below sub-section on online dispute resolution and redress.) 6. Privacy and security: businesses should protect consumer privacy by ensuring that their practices relating to the collection and use of consumer data are lawful, transparent and fair, enable consumer participation and choice, and provide reasonable security safeguards (see section on data privacy).

# **Other**

7. Education, awareness, and digital competence: governments and stakeholders should work together to educate consumers, government officials, and businesses about e-commerce to foster informed decision making. They should work towards increasing business and consumer awareness of the consumer protection framework that applies to their online activities, including their respective rights and obligations, at domestic and cross-border levels.

Source: **(OECD, Guidelines for Consumer Protection in the Context of Electronic Commerce 2000)**

**Table 5. Regulation on online consumer** **<u>protection around the world</u>**

|**protection arou**|**nd the wo**<br>**Online**|**rld**<br>**consumer p**<br>**regulation**|**rotection**|
|---|---|---|---|
||None|General|Specific|
|**Albania**||●||
|**Armenia**|●|||
|**Bangladesh**|●|||
|**Burkina Faso**|||●|
|**Canada***|||●|
|**Colombia**||●||
|**France**|||●|
|**Honduras**||●||
|**Indonesia**||●||
|**Kazakhstan**||●||
|**Kenya**||●||
|**Korea, Rep.**|||●|
|**Kyrgyzstan**||●||
|**Malaysia**|||●|
|**Mexico**||●||
|**Moldova**|||●|
|**Pakistan***||●||
|**Senegal**|||●|
|**Tanzania**|||●|

14
Of the domestic regulations analyzed, most have introduced online consumer protection provisions. Some of these protections can be found in e-commerce specific laws or in provisions under a general consumer protection law (Table 5). Laws specific to e-commerce

**Vietnam** ● (*) Template approved by federal, provincial and territorial ministers responsible for consumer affairs (**) Consumer protection is a provincial subject, regulated in Karachi through the Sindh Consumer Protection Act

offer the opportunity to fine tune the regulation to online transactions, and hence provide for a more comprehensive and tailored regulation that is not guaranteed by the mere enacting of a consumer protection law.

All the countries found to have online consumer protection regulations require that online sellers disclose certain information before the terms of the contract are accepted (Table 6). Some countries, such as Honduras and Kazakhstan, take this a step further, requiring the online disclosures be provided in the country’s official language. While Kenya requires the disclosure of “prescribed information”, the government has not specified what this information is.

Most of these countries follow OECD recommendation to provide online consumers a period of time to cancel a contract after purchasing a product or service online. The EU Directive on Consumer Rights grants online consumers the right to withdraw from distance contracts within fourteen days (Article 9). Consumers may withdraw from a contract if they do not like the product or they changed their mind. The consumer bears the direct cost of returning the goods, unless the trader agreed to bear it or failed to inform the consumer of the responsibility (Article 14, para. 1). On the other hand, Kenya’s Consumer Protection Act gives online consumers seven days to cancel a contract, provided that (1) the seller did not provide certain online disclosures, or (2) the seller did not allow the consumer to accept or decline the contract or to correct mistakes prior to concluding the transaction (Article 33). Canada’s Internet Sales Contract Harmonization Template has similar conditions for the cancellation of an online transaction.

<mark>France and Mexico stand out with regard to dispute resolution, providing online mechanisms to</mark> resolve disputes <mark>for e-commerce transactions. The European Commission’s Online Dispute Resolution platform allows online consumers to l</mark> odge complaints <mark>in any EU language, in addition to Icelandic, and Norwegian. Consumers may use the platform to communicate directly with the seller regarding their claim, or they may choose to go through a mediator on the platform. The European Commission posts a</mark> n <mark>online list of approved mediators for the consumers’ convenience. Mexico has followed a similar approach, providing an option to resolve disputes online. According to Mexico’s Consumer Protection Law, dispute resolution may be carried out via telephone or any appropriate means. The Office for the Federal Prosecutor for the Consumer allows online consumers to s</mark> ubmit <mark>complaints via Concilianet, an online dispute resolution platform. Following the online conciliation hearing, users are able to may review the service provided by the platform.</mark> On the other hand, while their regulatory frameworks do not provide for online dispute resolution, Canada, Colombia, Korea, and Vietnam are members of e- consumer.gov,5 a partnership of 36 consumer protection agencies worldwide that provides, among other services, an international platform to address cases of cross-border claims.

> 5e-consumer.gov is a web-based service developed by the International Consumer Protection and Enforcement Network (ICPEN). ICPEN is a network of governmental organizations in the enforcement of fair-trade practice laws and other consumer protection activities.  E-consumer.gov is one of the first examples of an international ODR

15
|**Table 6. Domestic**|**regulati**|**ons on**<br>**Pre-P**|**online**<br>**urchas**|**consume**<br>**e**|**rprotection**||**Post-Purchase**|||
|---|---|---|---|---|---|---|---|---|---|
||**In**|**formatio**<br>**require**|**n disclo**<br>**ments (**|**sure**<br>***)**|**With**|**drawal**|**Dispute**<br>**Resolution**|**Options f**|**or redress**|
||a.|b.|c.|d.|Existence<br>of right|Absence<br>of Reason|Online<br>mechanism|Refund|Other<br>options|
|**Albania**|**●**|**●**|**●**|**●**|**●**|**●**||**●**|**●**|
|**Armenia**||||||||||
|**Bangladesh**||||||||||
|**Burkina Faso**|**●**|**●**|**●**|**●**|**●**|**●**||**●**||
|**Canada**|**●**|**●**|**●**|||||**●**||
|**Colombia**|**●**|**●**|**●**|**●**|**●**|**●**||**●**|**●**|
|**France**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Honduras**|**●**|**●**|**●**||**●**|**●**||**●**|**●**|
|**Indonesia**|**●**|**●**|**●**|||||**●**|**●**|
|**Kazakhstan**|**●**||**●**||**●**|**●**||**●**|**●**|
|**Kenya**|||||**●**|||**●**||
|**Korea, Rep.**|**●**|**●**|**●**|**●**|**●**|||**●**||
|**Kyrgyzstan**|**●**|**●**|**●**||**●**|**●**||**●**|**●**|
|**Malaysia**|**●**|**●**|**●**|||||**●**|**●**|
|**Mexico**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Moldova**|**●**|**●**|**●**||**●**|||**●**|**●**|
|**Pakistan**|**●**||**●**|||||**●**|**●**|
|**Senegal**|**●**|**●**|**●**|**●**|**●**|**●**||**●**|**●**|
|**Tanzania**|**●**|**●**|**●**||**●**|**●**||||
|**Vietnam**|**●**|**●**|**●**|**●**||||**●**|**●**|

(*) Information on a. merchant’s address; b. payment process and/or delivery conditions; c. product specifications; d. complaint handling <mark>Most regulations allow online consumers to obtain redress for harm suffered as a consequence of goods or services that are defective or do not meet advertised quality criteria. This usually takes the form of a monetary remedy (e.g. refund or price reduction) or a conduct remedy with a restorative element (e.g. exchange or repair). While Burkina Faso, Canada, Kenya, and Korea only offer refund as an option for redress, the rest of the countries provide alternatives to refunds.</mark>

# MENA

**Table 7. Adoption of regulation on online consumer protection in MENA**

||**Online consu**<br>**protection regu**<br> <br>|**mer**<br>**lation**<br>|
|---|---|---|
||None<br>General|Specific|
|**Algeria**||●|
|**Bahrain**|●||
|**Djibouti**|●||
|**Egypt, Arab**|●||
|**Rep.**|||
|**Iran, Islamic**||●|
|**Rep.**|||

platform, meant to help consumers and agencies to combat international scams. It allows consumers to make crossborder fraud complaints in several languages (English, French, German, Korean Japanese, Polish, Spanish, and Turkish) and across many industries (e-commerce, banking, tourism, lottery, etc.). It is also a secured platform hosted by the U.S. Federal Trade Commission for law enforcement to share and access consumer complaints.

16
Online consumer protections are scarce in the MENA region. Only about a handful of MENA countries have introduced legislation to address consumer protection for online transactions, most of these found in regulations specific to e-commerce (Table 7).6 In the case of the regulations enacted in Bahrain, Qatar, and Saudi Arabia, while they are a step in recognizing the specific features of digital transactions, they fall short from offering a comprehensive regime and leave much room for further development.

Regulations on pre-purchase information are the most common in MENA online consumer protection

|**Iraq**|●|||
|---|---|---|---|
|**Israel**|●|||
|**Jordan**|●|||
|**Kuwait**|●|||
|**Lebanon**||●||
|**Morocco**||●||
|**Oman**|●|||
|**Qatar**|||●|
|**Saudi Arabia**|||●|
|**Tunisia**|||●|
|**United Arab**|●|||
|**Emirates**||||
|**Yemen, Rep. **|●|||

regimes. All MENA countries with online consumer protection regulation require the essential information disclosures on product specific and transaction conditions. Regulations on postpurchase, even for countries that have enacted specific laws for e-commerce, remain limited. Of the countries that provide for the right of withdrawal, none requires a reason to exercise this right, and they allow a cooling-off period of between three and ten days. Options for consumer redress in the case of defective or inadequate products purchased online vary throughout the region, with refund being the most common tool provided to online consumers (Table 8).

Lebanon stands out in the region, addressing pre-purchase as well as post-purchase issues in its consumer protection law, which covers electronic transactions. Lebanon is the only country in the region that has set out a procedure for dispute settlement for e-commerce, providing that disputes up to 3 million Lebanese pounds (about US$2,000) for online transactions are subject to mediation.

**<mark>Table 8. Regulations on online consumer protection in MENA</mark>**

||**Info**<br>**r**<br>a.|**Pre-Pu**<br>**rmatio**<br>**equire**<br>b.|**rchase**<br>**n disclosure**<br>**ments (*)**<br>c.<br>d.|**Withdr**<br>Existence<br>of right|**P**<br>**awal**<br>Absence<br>of Reason|**ost-Purchase**<br>**Dispute**<br>**Resolution**<br>Online<br>mechanism|**Options f**<br>Refund|**or redress**<br>Other<br>options|
|---|---|---|---|---|---|---|---|---|
|**Algeria**|**●**|**●**|**●**<br>**●**||||**●**|**●**|
|**Bahrain**|**●**||**●**||||**●**|**●**|
|**Egypt, Arab Rep.**|**●**|**●**|**●**|**●**|**●**||**●**|**●**|
|**Iran, Islamic Rep.**|**●**|**●**|**●**|**●**|**●**||**●**||
|**Lebanon**|**●**|**●**|**●**<br>**●**|**●**|**●**||**●**|**●**|
|**Morocco**|**●**|**●**|**●**|**●**|**●**||**●**|**●**|
|**Qatar**|**●**|**●**|**●**||||**●**|**●**|
|**Saudi Arabia**|**●**|**●**|**●**|**●**|**●**||||
|**Tunisia**<br>(*) Information on a. m|**●**<br>erchant’s|**●**<br>address|**●**<br>; b. payment pr|**●**<br>ocess and/or d|**●**<br>elivery condit|ions; c. product|**●**<br>specification|s; d.|

(*) Information on a. merchant’s address; b. payment process and/or delivery conditions; c. product specifications; d. complaint handling Although none of the MENA regulations provides for an online dispute resolution mechanism, Egypt, Israel, Qatar, Saudi Arabia, and UAE are e-consumer.gov members. This solution,

> 6 Secondary sources refer to online consumer provisions present in Israel’s consumer protection regulations, but these regulations have not been found online

17
together with a consumer protection laws present in Egypt, Qatar, and Saudi Arabia that explicitly apply to digital transactions and expand consumers rights, creates some of the stronger frameworks for online consumer protections in the region.

# B. Data governance

Consumers are increasingly aware of the value of their personal data. Lack of trust in the way personal data is managed drives consumers away from electronic transactions, limiting the growth of digital markets. At the same time, burdensome regulations on the use and transfer of individual data can build substantial costs for businesses, especially small and medium enterprises. The goal is hence to allow data transfers in a manner that supports the expansion of digital markets, while increasing consumer trust that their private information remains secure and under their control.

Data governance legal frameworks consist of entitling rights for all or certain types of individuals (also called data subjects) regarding the collection, usage, storage, and disposal of their personal data. They also create obligations for controllers and processors while enacting derogations in certain circumstances (state security, public safety, etc.). Security processes for data controllers (either public or private) ensure the appropriate processing of personal data.

## International guidelines and practice

Countries have unequally embraced data governance legal frameworks. The 1970s and 1980s saw a surge in personal data protection regulation, with several European countries enacting laws and several international organizations, such as the OECD, enacting instruments addressing the issue. But at the time, regulation arose for large government-owned data sets. Since the 1990s, digital communications led to the collection of massive data from private companies, which led to a new generation of legal frameworks to strengthen personal data protection and consumers’ trust. However, while some countries have strived to modernize their privacy frameworks to reflect the challenges of the new digital technologies, many countries lag and still rely on broad privacy principles set out in the constitution or elaborated in older privacy laws.

Europe has been at the forefront of the most comprehensive (and costly) legislation on data protection. It had a significant impact on other countries’ legislation (see below). The United States developed a less stringent and comprehensive framework which mostly relies on industryrelated best practices. Canada and Latin American countries developed privacy frameworks in the 1990s and 2000s partly in the form of habeas data. Asia and Oceania have seen their most developed countries adopting data governance laws (Australia; New Zealand; Hong Kong SAR, China; Korea) while others remain lagging. The Middle East and Africa have the least developed data governance legal frameworks.

Several international instruments have been focused on setting out the key principles of data governance regulation. Most recently, the Digital Economy Partnership Agreement (DEPA) between Singapore, Chile, and New Zealand recognized the need for international collaboration on matters relating to the digital economy, including data governance. The Asia-Pacific Economic Cooperation (APEC) Privacy Framework of 2015 promotes a flexible approach to privacy protection, with a focus on avoiding the creation of unnecessary barriers to information flows. The Convention “108+” by the Council of Europe is an international human rights treaty focused on data protection, setting out principles that are compatible with the requirements of the European regulation. In 2013, OECD members updated their Guidelines on the Protection of 18
Privacy adopted in 1980 to account for the new reality of digital data flows. The OECD Guidelines declare digital risk an economic risk and they aim to protect privacy and individual liberties with respect to personal data process in the public or private sector. They include eight basic principles for data protection:

- **Collection limitation principle** : limits the collection of personal data and suggests lawful and fair means for collection, as well as consent of the data subject where appropriate

- **Data quality principle** : calls for relevancy of the personal data to the purposes for which they are to be used. Additionally, it calls for data accuracy, completion, and maintenance

- **Purpose specification principle** : data controllers should specify the purpose for which the data are collected no later than at the time of data collection. Subsequent use of the data should be limited to those purposes and the data subject should be notified of any change of purpose

- **Use limitation principle** : limits the use of the data for purposes other than those specified, with the consent of the data subject or by the authority of law

- **Security safeguards principle** : calls for reasonable protection of the data from risks such as loss or unauthorized access, destruction, use, modification, or disclosure of the data

- **Openness principle** : suggests a general policy of openness regarding developments, practices, and policies with respect to personal data

- **Individual participation principle** : the data subject should have the right to request data from a data controller or a confirmation of whether the data controller has personal data relating to the individual. If the data controller has such data, it should be provided to the data subject within a reasonable time, in a reasonable manner and in a form that is readily intelligible to the data subject

- **Accountability principle** : the data controller should be held accountable for abiding with principles of the Guidelines.

Most countries in the sample have introduced a substantial regulatory framework for data governance (Table 9). <mark>Some of the governments that do not currently have a regulatory framework in place are discussing draft regulations to address this.</mark> 7 <mark>On the other hand, Honduras has implemented an interim protection, inserting a provision in its e-commerce law that subjects data messages to constitutional and legal provisions which guarantee the right to communication privacy and access to personal information.</mark> Misuse or breach of sensitive data usually leads to greater consequences for the data subject. Sensitive data may include special categories of information, such as a person’s political views, sexual orientation, or medical history. Most countries studied address this, providing special rules for the treatment of sensitive personal data during processing (Table 10). Canada, Indonesia, Kazakhstan, and Vietnam stand out in that they feature a general framework on data governance, but do not provide special rules for the treatment of sensitive data.

> 7 _See_ Kenya—The Data Protection Bill, 2018.

19
Common principles for processing of personal data include the need to have a legitimate reason for any processing activity, usually obtained through consent of the data subject. Alternatives to consent address contractual or legal obligations the firm may be subject to as well as the interests of the data subject or the public. The majority of the regulations analyzed feature elaborate frameworks in this regard. An array of legal bases for data collection and processing gives processors more freedom under certain circumstances. Additionally, all the regulations reviewed required that personal data be stored in a manner that allows for the data subject’s exercise of the right to access the information and to request its correction or deletion if

**<mark>Table 9. Adoption of domestic regulation on data governance</mark>**

||**None**|**Partial**|**Full***|**Comments**|
|---|---|---|---|---|
|**Albania**|||●||
|**Armenia**|||●||
|**Bangladesh**|●||||
|**Burkina Faso**|||●||
|**Canada**|||●||
|**Colombia**|||●||
|**France**|||●||
|**Honduras**||●||The Constitution grants right to<br>access and deletion|
|**Indonesia**|||●||
|**Kazakhstan**|||●||
|**Kenya**||●||Access to Information Act grants<br>right to access and deletion|
|**Korea, Rep.**|||●||
|**Kyrgyzstan**|||●||
|**Malaysia**|||●||
|**Mexico**|||●||
|**Moldova**|||●||
|**Pakistan**|●||||
|**Senegal**|||●||
|**Tanzania**|●||||
|**Vietnam**|||●||

(*) Refers to a general framework on privacy and data protection. Despite the lack of a general framework, specific rules may be often found in sectoral regulations, in particular on financial, telecommunications and health sectors necessary. While most of these requirements are included in the general frameworks for data governance, Honduras and Kenya grant these rights through the Constitution, and the Access to Information Act, respectively.

Providing clear rules on cross-border data transfers increases transparency and the ease of compliance. Here too, Vietnam’s legislation stands out as the only one failing to provide such rules. Additionally, where data is required to be stored domestically, such requirement should not prevent processors from transferring a copy of the data abroad. This grants governments greater ease of accessing the data of their citizens during legal disputes, while ensuring global data flows. Although data localization requirements may be present in other regulations, such as those addressing financial or health matters, none of the general data governance frameworks analyzed feature this type of restriction.

**<mark>Table 10:  Domestic regulation on data governance around the world</mark>**

||**Sensitive**<br>**data**<br>Special<br>treatment|**Legal ba**<br>Consent|**ses for data co**<br>Performance<br>of a contract|**llection and**<br>Legal<br>obligation|**processing**<br>Legitimate<br>interests|**Data**<br>**subject’s**<br>**rights**<br>Access/<br>deletion|**Cross-b**<br>**tra**<br>Rules on<br>transfers|**order data**<br>**nsfers**<br>No data<br>localization|
|---|---|---|---|---|---|---|---|---|
|**Albania**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Armenia**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Burkina Faso**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Canada**||**●**|**●**|**●**|**●**|**●**|**●**|**●**|

20
|**Colombia**|**●**|**●**||**●**||**●**|**●**|**●**|
|---|---|---|---|---|---|---|---|---|
|**France**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Honduras**||||||**●**|||
|**Indonesia**||**●**||**●**||**●**|**●**|**●**|
|**Kazakhstan**||**●**||**●**||**●**|**●**|**●**|
|**Kenya**|||||||||
|**Korea, Rep.**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Kyrgyzstan**|**●**|**●**|||**●**|**●**|**●**|**●**|
|**Malaysia**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Mexico**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Moldova**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Senegal**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Vietnam**||**●**|**●**|**●**||**●**||**●**|

# MENA

Few countries in the MENA region have introduced a comprehensive legislation to protect data privacy (Table 11). Algeria, Bahrain, and Morocco, appear to have established the strongest frameworks for data protection, taking elements from the EU Data Protection Directive of 1995 and, in the case of Bahrain’s new law, from EU GDPR. Israel’s main legislation on privacy protection dates back to 1981, but it has been complemented with additional regulations, resulting in a modern and strong framework. In 2003 Israel become the first and the only country to date in the region to have been officially recognized by the European Union as providing an “adequate level of protection” for personal data (CipherCloud 2017).

While some countries have set out strong regulatory frameworks, most regulations remain patchy, weak, or outdated. Some countries have included basic principles of data privacy in the context of broader regulations on e-commerce, such as

|**Table 11. A**|**doption**<br>None|**of regulati**<br>Partial|**on on dat**<br>Full*|**agovernance in MENA**<br>Comments|
|---|---|---|---|---|
|**Algeria**|||●||
|**Bahrain**|||●||
|**Djibouti**|●||||
|**Egypt,**|||||
|**Arab**|●||||
|**Rep.**|||||
|**Iran,**|||||
|**Islamic**|||●||
|**Rep.**|||||
|**Iraq**|●||||
|**Israel**|||●||
|**Jordan**|●||||
|**Kuwait**||●||Basic rules on privacy in<br>Electronic Transactions Law|
|**Lebanon**||●||Basic rules on privacy in<br>Electronic Transactions Law|
|**Morocco**|||●||
|**Oman**||●||Basic rules on privacy in<br>Electronic Transactions Law|
|**Qatar**|||●||
|**Saudi**||●||Basic privacy rules in e-|
|**Arabia**||||commerce law|
|**Tunisia**|||●||
|**United**|||||
|**Arab**||●||Data protection regime<br>applies to Dubai|
|**Emirates**|||||
|**Yemen,**|●||||
|**Rep. **<br>(*) Refers to|<br>a general|framework|on privacy|and data protection.|

(*) Refers to a general framework on privacy and data protection. Despite the lack of a general framework, specific rules may be often found in sectoral regulations, in particular on financial, telecommunications and health sectors Lebanon and Oman, providing hence an embryonic framework for data governance. Saudi Arabia features specific provisions on data privacy in its e-commerce law of 2019. These partial 21
regimes typically only focus on the legal basis for data collection and some rights of data subjects but fail to offer a comprehensive framework that differentiates personal from nonpersonal data, provides rules on transfer of data, or sets out conditions for conservation or destruction of personal data. UAE does not have a framework for privacy protection, but Dubai has adopted a full-fletched framework under the context of the Dubai International Financial Centre (DIFC) Authority that applies to business conducted in the special economic zone -thus having a geographical limitation to the scope of the regulation. Despite not having a comprehensive framework on data governance, provisions on personal privacy can be found in other countries in the region dispersed in sectoral or other specific regulations. For instance, in Egypt, the criminal code imposes a punishment for the unlawful collection of images or recordings of individuals in private places, and the Banking Law requires confidentiality for information regarding clients and accounts (CipherCloud 2017). These discrete provisions can be essential in their own context but should ideally be integrated in a broader framework that balances the different priorities of data privacy protection.

|**Table 12: Reg**|**ulation on da**<br>**Sensitive**<br>**data**|**tagoverna**<br>**Legal bas**|**nce in MENA**<br>**es for data col**|**lection and**|**processing**|**Data**<br>**subject’s**<br>**rights**<br>|**Cross-b**<br>**tra**|**order data**<br>**nsfers**|
|---|---|---|---|---|---|---|---|---|
||Special<br>treatment|Consent|Performance<br>of a contract|Legal<br>obligation|Legitimate<br>interests|Access/<br>deletion|Rules on<br>transfers|No data<br>localization|
|**Algeria**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Bahrain**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Iran, Islamic**<br>**Rep.**|**●**|**●**||||**●**||**●**|
|**Israel**|**●**|**●**||||**●**|**●**|**●**|
|**Kuwait**||**●**||||**●**||**●**|
|**Lebanon**|**●**|||||**●**||**●**|
|**Morocco**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Oman**||**●**||**●**||**●**|**●**|**●**|
|**Qatar**|**●**|**●**||**●**|**●**|**●**||**●**|
|**Saudi Arabia**||**●**||**●**||||**●**|
|**Tunisia**|**●**|**●**|**●**|||**●**|**●**|**●**|
|**United Arab**<br>**Emirates**||**●**|||||**●**|**●**|

All the existing comprehensive regulatory frameworks for data governance in MENA feature most of the crucial provisions, including special treatment of sensitive data and data subjects’ rights with regard to their personal data (Table 12). The Islamic Republic of Iran and Israel failed to introduce alternatives to consent as legal bases for data collection and processing. All these regulations, except for those introduced by the Islamic Republic of Iran and Qatar, feature clear rules on cross-border data transfers. As seen in the other countries studied, none of these regulations include data localization requirements but this does not mean that such requirements are absent from sector-specific regulations.

# C. Cybersecurity

While less visible to the individual consumers, cybersecurity regulation is an essential component for promoting trust in digital markets. Cybersecurity refers to the measures that can be implemented to protect personal data from unauthorized access and corruption. Major data breaches, like that which Yahoo witnessed in 2013—affecting 3 billion user accounts— not only 22
compromise people’s privacy but can have a chilling effect for digital markets as consumers realize how vulnerable their information is.

In 2015, the OECD declared digital risk an economic risk (OECD, Recommendation of the Council on Digital Security Risk Management for Economic and Social Prosperity 2015). If personal data is not securely processed it is more prone to breaches. Data breaches can occur in different ways, including unintended disclosure, hacking, and malware (Privacy Rights Clearinghouse n.d.).

Adequate cybersecurity regulations render data controllers and data processors liable for data processing. A data controller makes decisions over the purposes and means of the data processing, while a data processor processes data on behalf of controllers. <mark>For example, if an e- commerce platform hires a firm to track consumer activity on the platform, the e-commerce platform is the controller with regard to the information collected, while the firm is the processor.</mark> International guidelines and practice Security requirements consist of organizational and technical measures as well human resources. These may include mandatory encryption of personal data, implementation of rigorous internal policies, or the appointment of a data manager. Assessment of the risk to a data subject’s privacy helps determine the adequate safeguards that need to be implemented (OECD, Privacy Guidelines 2013). Countries without adequate data protection regulations risk being avoided by companies due to the lack of certainty about compliance and data handling (Trade 2015). Additionally, these countries are missing out on the benefits of the Internet, such as innovation and economic growth (Forum 2016).

Following two significant U.S. government hacks that affected over 22 million people (Washington Post n.d.), the Executive Office of the President’s Office of Management and Budget (OMB) issued new cybersecurity requirements for federal agencies (OMB 2017). These include:

- Breach response team designation

- Risk assessment, risk mitigation, and breach notification

- Periodic internal data protection policy review

- Annual reporting of satisfaction of cybersecurity requirements; data breaches reported; breach response plan; identification of breach response team; and confirmation of breach response team’s preparation exercises.

<mark>The EU General Data Protection Regulation (GDPR), which went into effect in 2018, also introduced updated provisions to protect the personal data and privacy of EU citizens, including cybersecurity requirements (Table 13).</mark>

**<mark>Table 13: EU GDPR cybersecurity requirements</mark>**

|**Security of**<br>**processing **|Controllers and processors must ensure a level of security appropriate to the risk<br>through measures such as datapseudonymization and encryption|
|---|---|
|**Breach notification**|In case of a personal data breach, controllers must notify the supervisory authority<br>within 72 hours of becoming aware of the breach. In cases where the breach is likely<br>to result in a high risk to the individual rights, the controller must notify the data<br>subject of the breach without undue delay|

23
|**Impact assessment**|Where data processing is likely to result in high risk to individual rights, the controller<br>must conduct an impact assessment prior to processing, including the foreseen<br>measures to address the risks|
|---|---|
|**Designation of data**<br>**protection officer**|Controllers and processors must designate a data protection officer under certain<br>circumstances, including if the bulk of the processing activities require regular and<br>systematic monitoring of data subjects on a large scale, or if it consists of processing of<br>sensitive data on a large scale|

A key aspect of data protection is who monitors and enforces the implementation of the regulation. The establishment of a capable and effective implementing agency is central to ensuring adequate implementation of the regulation and to providing individuals with a policing entity to which resort in case of violations. When it comes to the enforcement of cybersecurity measures, a single central regulator tends to be the most adequate solution, providing oversight and complaints management (UNCTAD 2016). They can inform <mark>data subjects about their rights, supervise and assist data controllers with regard to compliance, and ensure the enforcement of data regulations. Data protection requirements also include registration with the authority and notification of data processing activities (UNCTAD 2016). Depending on the ease, cost, and recurrence of these requirements, they may impose a burden for businesses trying to enter a foreign market (UNCTAD 2016). The OECD revised its privacy guidelines in 2013, highlighting the importance of establishing privacy enforcement authorities (OECD 2013).</mark> Most countries that have adopted a comprehensive framework on data protection have buttressed it with a data protection agency (DPA). Certain countries, such as France, have had a DPA since the 1970s, when large state-owned datasets were the main concern of the public. While most DPAs are independent agencies, some countries have embodied them with ministries or policymaking bodies (Makulilo 2016).

|**Table 14: Cybe**|**rsecurity meas**<br>**Encryption**|**ures around t**<br>**Internal**<br>**policy**|**he word**<br>**Data manager**|**Risk**<br>**assessment**|**Breach**<br>**notifications**|**Supervisory**<br>**authority**|
|---|---|---|---|---|---|---|
|**Albania**||**●**||||**●**|
|**Armenia**|**●**|**●**|||**●**|**●**|
|**Bangladesh**|||||||
|**Burkina Faso**||**●**||||**●**|
|**Canada**||**●**|**●**||**●**|**●**|
|**Colombia**||**●**||**●**|**●**|**●**|
|**France**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Honduras**|||||||
|**Indonesia**|**●**|**●**|||**●**||
|**Kazakhstan**||**●**||||**●**|
|**Kenya**||**●**|||||
|**Korea, Rep.**|**●**||**●**|**●**|**●**|**●**|
|**Kyrgyzstan**||**●**|**●**||**●**|**●**|
|**Malaysia**||**●**||||**●**|
|**Mexico**||**●**||**●**|**●**|**●**|
|**Moldova**||**●**||||**●**|
|**Pakistan**|||||||
|**Senegal**||**●**||||**●**|
|**Tanzania**|||||||
|**Vietnam**||**●**||**●**|**●**|**●**|

24
All of the countries found to have a comprehensive framework for data governance have included cybersecurity requirements in these regulations (Table 14). These include administrative and technical controls to protect against accidental loss or destruction or unauthorized access of the data. <mark>While most countries only require the adoption of an internal policy or the performance of internal controls, some countries have additional requirements. France and Korea feature the most inclusive requirements, calling for data encryption under certain circumstances to prevent unauthorized access to the data; appointment of a data manager; procedures to assess the threats and risks to personal information; and notification of the data subject and/or the authorities in case of a data breach.</mark> <mark>Also, most countries that regulate data privacy governance have a supervisory authority that monitors data processing activities. Although Kyrgyzstan’s Law on Personal Data makes reference to the “authorized body”, such body is not currently identified. About half of the countries that have a supervisory body require certain administrative procedures to lawfully process personal data. Data processors in Colombia and Kyrgyzstan must register with the supervisory authority. In Moldova, Senegal, and Tunisia, controllers must notify the authority of their intent to process personal data. In Armenia, notification requirements only apply to sensitive data or by request of the authorized body.</mark>

# MENA

The framework for cybersecurity in the region follows the same pattern of limited development as data governance (Table 15). Even for those countries that have adopted broader privacy regulations, provisions on cybersecurity tend to be vague, requiring data processors to implement measures to protect the data from unauthorized access or damage, without any clear specifications on the nature of the measures. Israel and Qatar are the only countries featuring a comprehensive framework on cybersecurity, imposing obligations on data processors to adopt internal data protection policies, conduct risks assessments,, notify data subjects and/or authorities of any data breaches, maintain sensitive data protected encrypted (Israel), and appoint a Data Manager responsible for data security in the firm (Qatar) (Table 14).

|**Table 15: Cybe**|**rsecurity measur**<br>**Encryption**|**es in MENA**<br>**Internal**<br>**policy**|**Data**<br>**manager**|**Risk**<br>**assessment**|**Breach**<br>**notifications**|**Supervisory**<br>**authority**|
|---|---|---|---|---|---|---|
|**Algeria**||**●**||||**●**|
|**Bahrain**||**●**|**●**|||**●**|
|**Iran, Islamic**|||||||
|**Rep.**|||||||
|**Israel**|**●**|**●**||**●**|**●**|**●**|
|**Kuwait**||**●**|||||
|**Lebanon**||**●**|||||
|**Morocco**||**●**||||**●**|
|**Oman**|||||||
|**Qatar**||**●**|**●**|**●**|**●**|**●**|
|**Saudi Arabia**|||||||
|**Tunisia**||**●**||||**●**|
|**United Arab**|||||||
|**Emirates**|||||||

Of the MENA countries found to have general data governance framework, the Islamic Republic of Iran stands out as the only one with no cybersecurity requirements and no supervisory 25
authority in charge of enforcing data protection policies. MENA countries should consider adopting a framework for cybersecurity (ideally, in parallel to, and complementary of, a data governance framework) including specific regulations, such as data encryption requirements and risk assessment procedures.

# D. Intermediary liability

The internet’s unparalleled ability to connect billions of individuals worldwide has boosted business models based on intermediation between vendors and consumers. E-commerce platforms like Alibaba, eBay, and Mercado Libre are based on offering consumers products from thousands of different providers rather than their own stock. “Gig economy” apps offer services such as rides, lodging, or delivery of food or groceries from firms and individuals. Other services rely on content such as video (YouTube, Vimeo), opinions and reviews of products or services (Yelp, Google), or information (blogs) developed by thousands of users, most of whom remain relatively unknown to the final consumer. The relationship between the intermediary (websites and apps) and the firms or individuals offering their own products or services is hence essential to the functioning of those digital transactions.

Intermediary liability rules are the set of provisions that distribute the liability between intermediaries (website and apps) and actual vendors or content developers when things go wrong. In other terms, intermediary liability is the responsibility that falls upon online intermediaries, such as search engines, application platforms, social networks, and broadband companies, for third-party content featured in, or products and services offered through, their website or apps. Just like intermediation is not a novel business model, intermediary liability rules are not new a legal concept –most such rules can be traced back to Roman law. Intermediary liability rules can in fact be broader rules that apply to online intermediaries (Gasser and Schulz 2015). However, specific rules of digital intermediaries are more likely to adapt to the particular conditions of digital markets.

Rules on intermediary liability need to strike a balance between protecting consumer rights and supporting the expansion of digital markets, including through intermediary platforms. While the good, service, or content may be offered or developed by third parties, intermediary platforms benefit from it by building their businesses around it. Digital intermediaries manage the relationship with the costumer, and they are often the largest, more sophisticated actor involved in the transaction. As such, regulations can impose on intermediaries (jointly with the third party) liability for fake or faulty products or services, or for offensive or illegal content, transacted through or featured in their services. On the other hand, intermediaries often do not have full knowledge of everything that is being offered by producers and content developers, who have greater control over it.

For digital intermediaries, responsibility may arise mainly from two types of conduct: the offering for sale of counterfeited products or the publication of unlawful content, such as images or text, by their users. The offering of fake products would normally entail a violation of intellectual property rules (typically trademark protection). Unlawful content can instead run against intellectual property rules when the content is unduly featuring other people’s work (a violation of copyright protection) by for instance reproducing music or video without the authors’ permission, or it may violate criminal law provisions such as rules against libel, hate speech, or child pornography, the protection of individual privacy or classified information, or amount to lèse-majesté crimes.

26
Rules on intermediary liability in MENA are generally at odds with a conducive framework for digital markets. Most countries in the region lack a specific framework for _online_ intermediary liability, which results in overly stringent requirements that add risks and costs for digital platforms. Those who do provide for such a framework usually do not cover infringements related to intellectual property –a key aspect for providers for content platforms (YouTube) or social media (Facebook) or smaller local social platforms, who depend on content uploaded by third parties and may find themselves liable for violations incurred by their users. Intermediary liability rules appear as the most underdeveloped segment of digital regulations in MENA, possibly adding high risks and costs for online platforms for e-commerce and content.

# International guidelines and practice

Typically, rules on online intermediary liability have two components: one attributing responsibility to the intermediary and another reducing its liability by removing the violation (“safe harbor”). For example, an intermediary would be held liable if it had knowledge that the product being offered was fake but could be exonerated from responsibility if it took steps to remove the product from its listings upon obtaining knowledge of the violation. Rules on responsibility pivot between no responsibility, actual knowledge of the infringement (the intermediary knew the content was unlawful), duty of knowledge (the intermediary should have known that the content was unlawful), or absolute responsibility (the intermediary is responsible in all conditions). Safe harbor provisions typically involve notice and take down procedures, which require that upon receipt of a notice regarding infringing content, the intermediary search and remove all copies of the infringing content.

Rules on liability for digital intermediaries are nascent and still evolving, and a global trend on the topic remains elusive. Even within countries, views on the extent of liability that should be imposed on intermediaries varies greatly between the content industry and the internet industry. Much of this tension is seen in the Unites States, home to some of the largest internet firms as well as content developers, which has traditionally resulted in strong protections of digital intermediaries, as well as far-reaching disciplines on intellectual property (Holland, et al. 2014). Content industry representatives claim that the lack of intermediary responsibility leads to an increase in online piracy and decreased revenue for content industries, which has led the American Association of Publishers (AAP) to advocate for sanctions imposed on intermediaries for failing to ensure the protection of copyrighted material (USITC 2017). On the other hand, internet industry representatives argue that an increase in intermediary liability is likely to increase costs and limit intermediaries’ ability to combat piracy (USITC 2017). The U.S. Digital Millennium Copyright Act (DMCA) creates a safe harbor for intermediaries under certain circumstances, including if they unknowingly display, transmit, or store infringing content. Section 230(c) of the Communications Decency Act shields intermediaries from liability for most third-party content. However, when it comes to copyright infringement, they must meet certain conditions, including a notice and takedown requirement.

The notice and take down model has been replicated around the world. In June 2017, Germany passed a law imposing fines of up to €50 million upon online intermediaries who do not remove illegal content within twenty-four hours of notice. The Russian Federation’s Federal Law No. 187 provides intermediaries with safe harbor protections based on a legal test which determines whether they knew or should have known about infringing content. Content owners are not required to notify intermediaries about infringing content, and instead may go directly to the courts to request an injunction to block the content. Taking it a step further, the notice and stay 27
down model featured in the EU Directive on Copyright of 2019 compels intermediaries to prevent any future transmission of the infringing content. Notice and stay-down requirements seek to ensure that infringing content will not be posted again.

Seeking to protect online freedom of expression, an international coalition released the Manila Principles for Intermediary Liability (Box 3). The Principles provide governments with standards for censorship and takedown laws which respect the users’ rights while promoting innovation.

# **Box 3. Intermediary liability** **<u>guidelines</u>**

The Manila Principles for Intermediary Liability were developed to protect online freedom of expression and to provide governments with standards for censorship and takedown laws that respect the users’ rights. The effort involved civil society groups from around the world, led by the Electronic Frontier Foundation (EFF, USA), the Centre for Internet and Society (CIS, India), Article 19 (UK), KICTANET (Kenya), Derechos Digitales (Chile), Asociación por los Derechos Civiles (ADC, Argentina) and Open Net (Republic of Korea).

The proposed principles are: _1. Intermediaries should not be liable for third party content: intermediaries should be exempt from liability for third party content where they did not modify the content; they must not be required to routinely monitor content on their network or platform;_ _2. An order by a judicial authority must be required for content restriction: an order from an independent and impartial judicial authority must be required for content restriction;_ _3. Requests for restrictions of content must be clear, be unambiguous, and follow due process: where an intermediary receives a restriction request before a court order is issued, they need not evaluate the legality of the content; the request must include its legal basis; sanctions should be imposed for bad faith restriction requests;_ _4. Laws and content restrictions orders and practices must comply with necessity and proportionality tests: restrictions should be specific to the content at issue, if applicable, limited in geographical scope; and not extend beyond its duration;_ _5. Laws and content restriction policies and practices must respect due process: parties must be provided the right to be heard and to appeal against restriction orders;_ 6. _Transparency and accountability must be built into laws and content restriction policies and practices: applicable rules and transparency reports must be published online in a timely manner._

- Source: (EFF 2015)

At the international level, some principles on intermediary liability were included in recent trade agreements. The recent Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) and the United States, Mexico, and Canada Agreement (USMCA) set limits to intermediary liability in their intellectual property and digital trade chapters, respectively. Intermediaries are not liable for copyright infringements “that they do not control, initiate, direct, and that take place through systems or networks controlled or operated by them or on their behalf”. However, they must remove or disable access to copyright infringing content on their networks upon obtaining knowledge of its existence.

Intermediary liability rules relating to criminal or civil infringement laws are being modernized for the digital environment. The proliferation of fake news in recent years has led countries to seek to reduce the amount of misinformation that citizens can find online. However, this raises concerns about content filtering, freedom of speech, and media manipulation. Singapore, who has been often criticized for its heavy control of the media (Leung 2019), recently introduced the Protection from Online Falsehoods and Manipulation to hold social media sites liable for thirdparty content published on their platforms. Noncompliant platforms are subject to fines and imprisonment if they do not remove the “misinformation” or publish “corrections” next to it. Industry groups fear that this new type of law allows governments to decide what is true or false, 28
endangering the freedom of expression and speech. Following a terrorist attack in a mosque in New Zealand, which was streamed live on Facebook, Australia passed a bill requiring social media platforms to promptly remove abhorrent violent user content shared on their sites. The acts covered by the new law include murder, torture, rape, and kidnapping. Other countries around the world, including France and Germany, are also tackling these issues through legislation.

|**Table 16: Regu**|**lation on in**<br>**Liability**<br>**Status**|**termediary liability around the world**<br>**Safe harbor provisions**|**IPR infringements**<br>**covered**|**Notice and take down**<br>**requirements**|
|---|---|---|---|---|
|**Albania**|Partial|Lack of knowledge; content removal||**●**|
|**Armenia**|N/A||||
|**Bangladesh**|Partial|Lack of knowledge; content removal|||
|**Burkina Faso**|Partial|Lack of knowledge; content removal||**●**|
|**Canada**|Partial|Lack of knowledge|**●**||
|**Colombia**|N/A||||
|**France**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Honduras**|N/A||||
|**Indonesia**|N/A||||
|**Kazakhstan**|N/A||||
|**Kenya**|Partial|Lack of knowledge|||
|**Korea, Rep.**|Partial|Content removal|**●**|**●**|
|**Kyrgyzstan**|N/A||||
|**Malaysia**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Mexico**|N/A||||
|**Moldova**|Partial|Lack of knowledge; content removal||**●**|
|**Pakistan**|Partial|Lack of knowledge|||
|**Senegal**|Partial|Lack of knowledge; content removal||**●**|
|**Tanzania**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Vietnam**|Strict|||**●**|

Most of the countries studied address intermediary liability and provide online platforms with safe harbor provisions where infringing content is posted by third parties (Table 16). The most common conditions to avoid liability are lack of knowledge of the infringing content and removing or disabling access to the infringing content expeditiously upon obtaining knowledge or becoming aware of a likelihood of liability. Intermediaries are usually deemed to become aware upon being notified of the infringement. No countries studied in Latin America have introduced legislation on the issue.

Notice of infringement can take different forms depending on the domestic regulation. In some countries, anyone may request the removal of infringing content. Tanzania’s Cybercrimes Act allows anyone to notify the intermediary of content infringing their rights as well as the rights of others (Article 45). Other countries only give this right to copyright holders. In Korea, copyright holders may request the removal of infringing content after providing evidence of the infringement. (Copyright Act Article 103). Intermediaries are required to remove the content immediately and to notify the third party as well as the copyright holder. If the third party proves that the content is posted based on legitimate rights, the intermediary must notify the copyright holder of the request and of the scheduled date of resumption. The intermediary is required to designate an agent responsible for processing removal requests. Malaysia intermediaries must remove infringing content within forty-eight hours of obtaining notice from copyright holders 29
(Copyright Act Article 43H). Upon receipt of a counter notification from the third party, the intermediary must provide the copyright holder with a copy of the counternotification and with notice that access to the content will be restored in ten business days. The copyright holder may seek a court order to restrain the third party from engaging in any infringing activity relating to the content on the intermediaries’ platform. Finally, Canada has implemented a “notice and notice” regime. There, if a copyright holder notifies the intermediary of infringement, the intermediary must forward the notice to the third party.

In other cases, the removal of infringing content may be enforced through a judicial order or notification by relevant entities. While Albania’s Law on e-commerce explicitly excludes IPR infringements from its scope (Article 2), it provides that the court or competent authorities may compel the removal of unlawful activity by intermediaries (Article 19). In France, an administrative authority may notify the intermediary of content infringing laws against terrorism and child pornography, giving the intermediary twenty-four hours to remove the content. Senegal’s law on electronic transactions also took steps to prevent infringement related to terrorism or child pornography: platforms must provide a method for anyone to notify them of infringing content, and the platforms must inform the relevant authority of this content (Article 3).

# MENA

Legislation throughout the MENA region focuses on content posted online, holding intermediaries liable for third-party content. Some countries have introduced safe harbor provisions, shielding intermediaries from liability if they lack knowledge of the infringing content or act expeditiously to remove it upon becoming aware of it (Table 17). All those regulations include notice and take down requirements, ensuring that the infringing content is not posted again.

|**Table 17: Regu**|**lation on in**<br>**Liability**<br>**Status**|**termediary liability in MENA**<br>**Safe harbor provisions**|**IPR infringements**<br>**covered**|**Notice and take down**<br>**requirements**|
|---|---|---|---|---|
|**Algeria**|N/A||||
|**Bahrain**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Djibouti**|N/A||||
|**Egypt, Arab**<br>**Rep.**|Strict|N/A||**●**|
|**Iran, Islamic**<br>**Rep.**|Strict|N/A|||
|**Iraq**|N/A||||
|**Israel**|N/A||||
|**Jordan**|N/A||||
|**Kuwait**|N/A||||
|**Lebanon**|Partial|Lack of knowledge; content removal||**●**|
|**Morocco**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Oman**|Partial|Lack of knowledge; content removal||**●**|
|**Qatar**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Saudi Arabia**|Partial|Lack of knowledge; content removal|**●**|**●**|
|**Tunisia**|Strict|N/A|**●**|**●**|
|**United Arab**<br>**Emirates**|Strict|N/A|||
|**Yemen, Rep. **|N/A||||
—@— MENA Electronic == World (minus MENA) ¢°ocuments <!-- Start of picture text --> ee<br>Intermediary i S. aoaSe Electronic<br>liability ~~ \» | signature<br>Cybersecurity. \y Online consumer.<br>protection<br>Data privacy<br><!-- End of picture text -->
<!-- Start of picture text --> —e— MENA - HIC Electronic<br>documents<br>=®=HIC (minus MENA) ef,<br>Intermediary <— Electronic<br>liability ¥ ¢ » | signature<br>'<br>1<br>VOa 1<br>iawss<br>: Online consumer<br>Cybersecurity ry ~*~ .<br>s, \7 protection<br>Se 7<br>S. ,Z<br>Data privacy<br><!-- End of picture text -->

<!-- Start of picture text --> —e— MENA - MIC Electronic<br>-©=MIC(minus MENA) 20cuments<br>Intermediary wR.SiSic Electronic<br>liability s? signature<br>. Online consumer<br>Cybersecurity .<br>protection<br>Data privacy<br><!-- End of picture text -->
<!-- Start of picture text --> @ ] e @ ) O<br>@eO@O@<br>O O O O O O<br> ] O @ O O )<br>* e @ * O C)<br>*]*]O)OO<br>O @ O @ @ O<br>@ @ O ) O O<br> ] ] O ] O O<br>*]*]@*]O*]<br>@ ] @ @ ) @<br>@@O@O*]<br>@ e O @ @ @<br>@@OOO@<br>@ O e @ ) ]<br>@ @ O @ O O<br>O O O O O O<br>O<br><!-- End of picture text -->
= barebones framework or dispersed individual regulations; = comprehensive regulatory framework, but major additions or amendments needed; = comprehensive regulation in place, but small additions or updates recommended; = comprehensive and modern regulation in place; (*) No available data for Libya, Palestine, and Syria. (**) Dubai provides a comprehensive data governance framework for companies under the DIFC regime.

Only a few countries have made strong efforts to keep abreast with digital regulations. Bahrain, Qatar, and Morocco feature the most comprehensive regulatory frameworks for digital markets in the region, but updates and further developments remain necessary, particularly on consumer protection and cybersecurity. On the other hand, Iraq, Jordan, and UAE have made little or no progress on digital regulation, with most regulatory solutions being severely outdated or stemming from broader frameworks not designed for current digital markets.

Some countries, like Lebanon, have recently introduced broad “e-commerce” regulations which address multiple aspects of digital markets regulations at once, from e-signature to intermediary liability matters. This kind of solution is a welcome attempt to catch up on digital regulation, which can be followed by other countries in the region with underdeveloped regulatory frameworks. These broad efforts, however, must be viewed as a first step which needs to be later complemented with individual fine-tuned regulations, ideally developed by specialized agencies in each of these fields.

MENA countries have a long way ahead in providing for a strong and comprehensive regulatory framework for digital trade. Some countries, like Qatar, Israel, and Morocco, have tried to support an export-oriented IT sector by keeping an updated regulatory framework, especially in key areas like data governance and cybersecurity. Other countries, like Lebanon, have recently jump-started a framework for digital trade by covering a range of different issues under one single legislation. Yet, regulation in most countries in the region, regardless of their level of development, still features some major loopholes that can limit consumer trust in digital markets or reduce certainty -and increase costs- for digital businesses.

The greater challenge for MENA countries remains recognizing the potential for economic growth and social development that digital trade can bring and integrating it in its economic and trade policy. From this starting point, MENA countries would benefit from introducing a standing policy for a comprehensive regulatory framework for digital trade, and a monitoring mechanism to consult with stakeholders as technologies evolve and new regulatory solutions may be needed.

34