Guest articles

Provided the enforcement of the law is not delayed, there are a number of issues that businesses need to contend with.

The new law

Federal Law No. 15 of 2020 on Consumer Protection (the “New Law”) was issued on 10 November 2020 and replaces the existing consumer protection framework dating from 2006. The New Law represents a major update to consumer protection legislation in the UAE and aims to modernise the legal framework around consumer transactions. The New Law applies in freezones as well as “onshore”.

The New Law specifies that implementing regulations will be published within 6 months from the date that the law is published in the Official Gazette (i.e. by 11 May 2021), however this did not happen and the regulations are still awaited. Businesses were provided with a grace period until 11 November 2021 to make any changes to comply with the requirements of the New Law, though the New Law states that this period may be extended by a Cabinet decision.

Logically, given that the implementing regulations have not been published and businesses were due to be afforded at least a six-month window post-publication of the regulations, we hope that a Cabinet decision to provide further clarity and extend the enforcement date will be issued.

However, until that happens the New Law remains enforceable from 11 November this year and, in any case, a six month implementation window will quickly pass if the timings are extended, so businesses would still be well advised to familiarise themselves with the key requirements under the New Law.

Business issues at a glance

The key issues to be aware of under the New Law are:

• strengthened enforcement regime: the New Law provides for criminal penalties for certain infringements. There are provisions for a maximum jail sentence of up to two years and a maximum fine of AED 2,000,000. Under the previous regime there was no criminal liability or risk of imprisonment and the maximum fine was AED 1,000,000.

• E-Commerce: the New Law expressly covers e-commerce, which was not clearly dealt with under the previous regime

• use of Arabic language: there are Arabic-language requirements for e-commerce businesses;

• data protection: there is an increased focus on the protection of consumer personal data;

The detail (at this stage…)

• Penalties

The new Consumer Protection Law substantially increases the penalties that may be imposed for non-compliance and, very significantly, creates criminal liability with the prospect of imprisonment. Breaches of a wide range of Articles of the law can potentially attract a prison sentence of up to two years and a fine of up to AED 2,000,000. Relevant provisions include those concerning information requirements in relation to goods, implementation of warranties and satisfying replace/repair obligations, providing misleading descriptions or advertising and including conditions in consumer contracts which are “harmful” to the consumer.

The inclusion of criminal liability for these matters in broad terms is, at first glance, quite alarming. In practice, it is impossible to predict how the New Law will be enforced but we would hope that criminal liability is reserved for only the most egregious breaches of the New Law. The implementing regulations should provide more detail and guidance around what is expected of businesses in practice.

• Application to e-commerce

The scope of the new Consumer Protection Law has been expanded so as to expressly cover e-commerce. Accordingly, any business registered in the UAE that sells goods or services to consumers online will have to comply with the provisions of the new legislation.

E-commerce businesses must provide consumers and competent authorities with certain information relating to their business, including their name, legal status, address and licensing authorities as well as adequate information on the products or the services they provide (for example any relevant specifications as well as contract and warranty terms). Significantly, this information must be provided in Arabic (in addition to any other language, such as English). The practical intention therefore seems to be to ensure that all e-commerce sites will need to be available in an Arabic language version; potentially good news for the local translation market!

• Data protection as a consumer right

One of the most significant changes introduced by the Consumer Protection Law is the clear recognition of the need to protect consumer data. Consumers now have the right to have the privacy and security of their data protected. The New Law also includes a statement which seems to ban the use of consumer personal data for direct marketing purposes.

It is important to note that these sections of the law are extremely high-level and the implementing regulations will be needed to make practical sense of them. We cannot believe the intent of the New Law is to completely outlaw direct marketing, so we expect that the regulations will clarify that there are preconditions for the use of data in direct marketing, such as the need to obtain consent.

If an approach is taken which follows general data protection law trends then businesses would need to be able to demonstrate compliance with the law which means being able to manage marketing opt-outs, being able to demonstrate collection of consents, being able to describe the security measures taken to protect personal data, having a training programme for staff, and so on.

• Language requirements

Finally, the new Consumer Protection Law mandates that invoices, contracts, advertising be in Arabic, although these may also be provided in other languages if the business wishes to do so. Failure to comply with this requirement carries a prison sentence of up to six months and/or fine starting at AED 3000 up to a maximum of AED 200,000. The penalty issued against a business can be doubled for repeat offences.

Summary and points to think about

Although the New Law remains high-level and difficult to implement with certainty whilst the implementing regulations remain unavailable, the direction of travel that the authorities wish to pursue on some issues is clear and businesses should start to bear these matters in mind.

If you have been considering implementing changes to your processes or procuring new solutions or suppliers, there are things you should consider to avoid being locked-in to non-compliant solutions; for example:

• Are you considering switching web-platform? Does your provider offer dual-language capability and the ability to display meaningful product information?
• Does your POS system / payment system offer Arabic-language invoice information?
• Can your CRM system or customer database identify marketing consents / opt-outs? Do you currently have a process for obtaining marketing consents?

Other questions to consider, which may require time to address and implement include:

• Do you keep personal information secure (a draw stuffed with papers in a home office is not secure!)? Do you know how your third-party suppliers, if applicable, look after your customer information? Do you have any documented privacy practices or policies?
• Are your staff aware of their own legal obligations and those of the business? Do you have access to any training resources for staff?
• Is your product / service and pricing information clear?
• Are your post-sale support / return terms and sale of goods terms clear and consistent with the law?
• Are you sufficiently resourced to deliver on your warranty and support commitments? Are you reliant on third parties to assist with this and do you have satisfactory service commitments from them?

For more information, please email ben.gibson@cms-cmno.com or call +971 4 374 2832
Authors: 

Ben Gibson – Legal Director, Technology, Media & Telecoms, CMS Dubai


Victoria Noto, Associate, Technology, Media & Telecoms, CMS Dubai


Kate Corcoran, Associate, Technology, Media & Telecoms, CMS Dubai