Data Brokerage Legislation Challenges in Saudi Arabia: Comparative Considerations of the EU and US Approaches to fill Saudi Gaps

Abstract

Users constantly enter into blind transactions on the internet and give personal data to unfamiliar companies without knowing the fate of the data. Consequently, a growing data market has arisen where companies invest in user data generated by new technologies based on a notice and choice regime. These unfair transactions are based on a ‘take it or leave it’ strategy. Given the challenges in understanding privacy policies, users generally accept the terms without reading them and are not give the opportunity to negotiate. Each month, more than three billion new records are generated and distributed to third parties for commercial purposes. By combining this data with additional offline data, algorithms are able to draw detailed profiles of a huge pool of users. This raises concerns about privacy violations. Saudi legislation allows data brokers to operate with impunity and this project seeks to suggest improvements to the SA system. Given that US laws do not adequately protect personal data against commodification, this project argues that the comprehensive and strict provisions of the GDPR from the EU build better barriers against data brokers. Although there are some doubts about the effectiveness of the consent mechanism of the GDPR, it has demonstrated greater attention toward all phases of data commodification. This project is organized into five sections. Part I illustrates how current technologies have given companies the unprecedented capacity to gather and sell personal data and how it is harmful to users. Part II shows how the SA legal landscape is fertile ground for data broker growth. Part III evaluates the US sectoral approach and Part IV elaborates on the GDPR method from the EU. Part V will arrive at some suggested reforms to Saudi legislation as a result of comparing the EU and the US approaches.