On 13 September 2023, the Communication Space & Technology Commission of Saudi Arabia (CST) proposed a draft law on Global Digital Content Safe Harbor (please find the draft law here). The proposed law is aimed at providing a legal framework for intermediary service providers hosting and transiting global digital content in the Kingdom of Saudi Arabia (KSA) in a way that ensures no objection, deletion or modification of content hosted in and accessible within the Kingdom.
If adopted, the effect of the draft law may be significant as it seeks to create a more favourable environment for investment in the Kingdom’s digital economy, and it would align the local legal framework with the international best practices. By providing intermediary service providers with greater legal certainty, the draft law will aim to attract new businesses and encourage existing businesses to expand their operations in the Kingdom.
In the context of the draft law, “Digital Content” is defined as “any digital content located, stored or distributed in the telecommunications network or IT infrastructure, in any form or manner, and which can be created, handled or accessed through the same.” Furthermore, “Intermediate Services” are themselves defined as “hosting, processing, storing, transferring, or transiting global digital content outside the Kingdom, or enabling access thereto through the telecommunications network or IT infrastructure.”
Key takeaways
The provisions of the draft law essentially introduce the following principles:
- Exemption from any civil or penal liability as a result of providing an intermediary service that includes global digital content that violates the Kingdom’s laws;
- This exemption is subject to conditions: it is only granted to intermediary service providers who have a valid CST certificate proving that they have passed a pre-qualification process (the conditions of which are still to be detailed by the CST);
- Exemption will expire upon the expiration of the pre-qualification certificate, its non-renewal, suspension or cancellation; and
- Intermediary service providers are not obligated to monitor the global digital content hosted in the Kingdom, and it is clarified that the privacy of hosted data will not be prejudiced.
Under Article 6 of the draft law, CST will have the power to forward take-down requests (e.g. removal, restriction of access and transit of the content) to the intermediary service providers if it has reasonable grounds to suspect the existence of a violation of laws applicable in the Kingdom or of any of the pre-qualification conditions. Failure to comply with CST notices or requests of information would be considered a violation of the draft law’s provisions, as well as a violation of the qualification requirements set by the Board and any other action that violates the provisions of the draft laws and the relevant regulatory decisions issued by the Board.
Potential sanctions
The intermediary service provider who commits any of the violations described above shall be subject to the following penalties (potentially cumulative) in proportion to the violation’s nature, effect and reiteration:
- a fine not exceeding SAR 25,000,000 (i.e., approximately USD 6,600,000);
- to be deprived – for a certain period – of obtaining a pre-qualification certificate;
- cancellation of the pre-qualification certificate.
The extent of the obligations and effects under the draft law remain to be detailed either in further iterations of the same or within implementing regulations (that are foreseen in the current drafting of the law), including criteria for eligibility to be certified by the CST, platforms that will be able to apply, etc.
