The improper use of the data of millions of Facebook users by Cambridge Analytica demonstrated that all countries around the world must reconsider their privacy and data protection laws to ensure that these laws are effective at protecting the interests of users.
The Cambridge Analytica incident did not involve a data breach or the unauthorised collection of data, but instead it involved the improper use of data that was voluntarily shared by members of the public on Facebook. Some users were also rewarded with small payments for participating in surveys designed by a company hired by Cambridge Analytica.
However, even though all the data available on Facebook is voluntarily shared, that does not mean that those who share this data do not have the right to have their privacy respected or that they do not have the right to stop a company from using their data in ways that they did not agree to.
Many countries around the world have data protection laws that regulate this very specific issue. Such laws impose obligations on any person who collects private data of members of the public, and prohibit such data controllers from processing or using the data without the permission of the subject of the data. Such laws can also grant members of the public the right to access any information about them held by corporations as well as the right to demand that their data is deleted from these records.
For example, the European Union has issued a General Data Protection Regulation that enters into force in May 2018 setting new stringent rules on how private data of members of the public may be used by data controllers and the standard of notice and consent that needs to be satisfied for a corporation to be able to collect and process such data. The implications of this new regulation are far-reaching since it will be binding on any company that collects data concerning customers in the EU, and therefore may include companies here in Oman such as Oman Air.
Here in Oman, we still do not have any general privacy or data protection laws. In fact, even our constitution does not recognise the right to privacy (as a general concept outside the confidentiality of communications) as a fundamental right. Outside the narrow scope of protection granted by the Electronic Transactions Law, there are no obligations on Internet companies to seek the permission of Omani Internet users before they acquire their data and use them in any way they please.
The recent Facebook scandal shows the extent to which private data can be abused by companies and the way this can influence major political campaigns impacting the selection of presidents and major national decisions.
The Government of Oman has been working for a very long time on a project to pass a data protection law. This project is supposed to be at very advanced stages, but it is not clear when exactly this law will come out. It is now more important than ever for this law to become a priority.