Digital regulations: Key to unlocking digital growth in the Middle East

Regulation is a key tool that governments use to shape market functions, significantly influencing desired economic outcomes. In the Middle East, bold policies and substantial government investments are transforming cities into high-tech hubs where innovation is prized. This technology-driven outlook has brought about a significant change in our lives by changing the way we communicate, work, and do business, creating new opportunities for growth and innovation. It has led to the development of new products and services, such as digital marketplaces, Buy Now Pay Later (BNPL) financing, social commerce, open banking, e-payments and smart contracts. However, it also raises questions about the role of regulation in a digital economy and how digital technologies are disrupting the regulatory landscape.

Historical and modern perspectives on regulation

The Oxford Dictionary defines regulation as “an official rule made by a government or some other authority”[1]. Throughout history, regulations have been formulated and have shaped the evolution of our society and economy. The oldest recorded regulations date back to the Code of Hammurabi, named after the king who ruled Babylon from 1792 to 1758 BCE.

An example of a modern regulatory body is the Interstate Commerce Commission established in the US in 1887¹. Its main goal was to establish rules and interventions to prohibit rate discrimination by the railroads. More recent regulations include the European Union’s Digital Services Act and Digital Markets Act² which aim to create a safer digital space that protects the fundamental rights of users and ensures a level playing field for businesses. These regulations protect small businesses and startups from possible monopolies created by large technology companies, while establishing fair competition for all organisations.

Governments across the world have established agencies to regulate markets for funding, water, power, communications, commodities and many others. Popular regulatory tools include controlling market access, competition, pricing, product standardisation,intellectual property, workers’ and consumers’ rights. Regulation is typically used to counter a market that without it would not function as desired, resulting in market failure.

In line with this regulatory approach, the European Parliament adopted the Artificial Intelligence Act in March 2024, which establishes obligations for AI based on its potential risks and level of impact. This Act puts safeguards on general-purpose AI use cases, bans social scoring and AI used to manipulate user vulnerabilities, and limits the use of biometric data³.

Digital regulations in the Middle East

In the first of our multi-part thought leadership on digital regulations in the Middle East, we closely examine the relevance of regulations and the increasingly important role that they will play in a world accelerating at a never-before seen pace. Let us begin by looking at a few relevant examples from the region:

Since 2017, the United Arab Emirates (UAE) and Kingdom of Saudi Arabia (KSA) have imposed excise tariffs² on certain goods to discourage their consumption due to their negative impact on human health. The tariffs are 100% on tobacco products, electronic smoking tools, and energy drinks, and 50% on sugary drinks. This is in line with the 2016 common excise tax agreement of the Gulf Cooperation Council States (GCC). With such tariffs, regulators aim to promote healthy lifestyles, reduce burden of healthcare costs, while generating additional revenues for the countries.
In 2019, Saudi Arabia issued a comprehensive e-commerce law-Royal Decree No. M/126, aimed at regulating electronic commerce activities and providing a legal framework for online transactions. The law addresses various aspects of e-commerce, including electronic contracts, consumer rights, online payments, and dispute resolution. Similarly, UAE recently launched an e-commerce law “Federal Decree by Law No. (14)⁴ of 2023 Concerning the Modern Technology-Based Trade” to enhance regulations of the rapidly growing digital commerce sector. The legislation encompasses digital commerce, e-commerce, and social commerce, covering various platforms such as websites, apps, social media, virtual stores, and blockchain-based systems and plays an important role in bolstering UAE's economy. It also supplements existing UAE laws pertaining to consumer protection, intellectual property, payments, data privacy, cybersecurity, and electronic transactions, all of which are pertinent to digital commerce. Key provisions of the law mandate secure online trading environments, adherence to cybersecurity protocols, safeguarding consumer privacy, truthful advertising practices, compliance with competition laws, and implementation of business continuity plans.
The Communications, Space, and Technology Commission (CST), KSA has recently released "Space Data Regulations Platform related to Space Data Platform Services" for public consultation. This instrument aims to establish the regulatory environment of the Space sector, and attract investments to contribute to GDP growth, as well as increase the effectiveness of space data governance.
In early 2023, the Saudi Authority for Data and Artificial Intelligence (SDAIA), launched the region’s first and only Data Privacy and Regulatory Sandbox to serve as a time-bound, secure testing environment that brings together innovators and regulators. It provides KSA based local micro, small, and medium enterprises (MSMEs) with a unique opportunity to fast-track the testing of their products, solutions, or business models in a controlled regulatory environment. It also allows the regulators to collect important insights to identify areas of improvement in regulatory instruments and boost innovation by allowing MSMEs to explore new solutions under its supervision. During the pilot phase, the initiative witnessed remarkable traction, with over 19 applications operating across different advanced technology areas, such as big data, analytics, Artificial Intelligence (AI) and Machine Learning (ML), biometrics, IoT, and cloud computing.

These examples demonstrate the interdependence of regulation and the digital economy. Over time, both regulation and technology have evolved, but not necessarily in sync with each other. Technology has been advancing at an unprecedented pace, while regulations have struggled to keep up. This means that the way forward for governments, regulators, federal agencies, and other stakeholders will have to be a combination of the following two factors:

In today’s world, emerging technologies, such as AI are creating new ways for consumers to interact and disrupting traditional business models. It’s an era in which machines teach themselves to learn; autonomous vehicles communicate with one another; and smart devices respond to and anticipate consumer needs. This necessitates the need for digital regulations to govern these new-age technologies. We are yet to witness the establishment of global or even pan-regional agencies or organisations that would govern digital regulations for the globe or a group of countries (we will explore this in the second part of our series on digital regulations).

That said, there have been some successes at both global and regional levels. Sharing of data is quintessential for today’s technology, which has rightly resulted in consumers globally being concerned about the privacy and security of their data. In the UK, for example, the Competition and Markets Authority (CMA) and the Information Commissioner’s Office (ICO) are cross-sectoral competition and data protection agencies that set standards across the entire economy, and are redefining markets and market power. The EU's General Data Protection Regulation (GDPR) requires companies to ask for some permissions to share data and gives individuals rights to access, delete, or control the use of that data. It emerged as one of the first multi-national regulations that has emerged as a global success, even when put to test during the pandemic.

In the Middle East, Qatar was the first GCC member nation to issue a law in accordance with the GDPR adoption in Europe in 2016. KSA has recently enforced its first-ever comprehensive data protection law. The Personal Data Protection Law (PDPL) provides comprehensive requirements related to processing principles, data subjects' rights, organisations' obligations while processing the personal data of individuals, and cross-border data transfer mechanisms and lays out penalties for organisations in case of non-compliance with the PDPL.

Another application of digital regulations is for AI, wherein the EU has recently launched AI Regulatory Framework and its AI act⁵ has been approved by the EU parliament in March 2024. This framework classifies potential risks due to the AI systems and states that all AI systems need to be analysed and classified according to potential risks. The AI systems which possess unacceptable risk needs to be banned (e.g. - cognitive behavioural manipulation or social scoring). Similarly, high risk AI systems (for example, critical infrastructure management) needs to be assessed before launching them in the market, as well as throughout their lifecycle.

Companies must adopt new processes and tools to comply with the increasingly rigorous regulations governing the use of emerging technologies. Failure to comply can result in severe financial penalties and significant damage to an organisation's reputation. Article 83(4) of the GDPR⁶ specifies that violations can lead to fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover from the preceding financial year, whichever is higher. These stringent penalties underscore the importance of adhering to GDPR requirements to avoid substantial economic and reputational repercussions.

Advancements in technology make it easier to comply with regulations by automating and streamlining labour-intensive compliance processes and offering a proactive, data-driven approach to identifying and mitigating compliance risks in real-time. AI can be used to automate monitoring, issue fines and penalties in real-time, and adjust variables in response to changes in ongoing laws.

RegTech solutions, such as AI chatbots, can be used to provide automated responses to regulatory inquiries, while SupTech solutions⁷, such as machine learning algorithms, can predict potential non-compliance risks for decision-makers. Automated regulation can be beneficial for organisations that process sensitive information or adhere to strict rules and standards for protecting customer data, such as hospitals and banks. New solutions are being built to ensure compliance in highly regulated use cases such as for automated identity verification. For example, Berlin based bank Solaris used a regtech solution from IDNow⁸ to ensure compliance with various cross-geographic regulations about automatic identity verification and to enhance its customer onboarding process.

The potential of using digital for regulation is limitless. For example, there can be a system in place for ‘Regulations as a Platform’ (more details in our upcoming publication) which would enable entities to release regulations in a machine readable format (such as, JSON/XML). A potential use case of such a solution is to enable modification of tax rates or tariffs in real-time for all merchants across a country or even region, and avoid the hassle of merchants adjusting their respective systems and ensure compliance according to the latest regulations.

Looking ahead

We are living in exciting times and the need for regulations for a digital economy has never been greater. Governments, regulators, and all other stakeholders will have to act, and now, keeping basic principles in mind. They must actively promote innovation, achieving forward looking and coherent outcomes, and exploiting opportunities and challenges globally. “Old school” regulations will have to make room for much more iterative, agile, and anticipatory regulations. Leveraging technology to regulate is the way forward for an AI-enabled world where governments, businesses, and populations are on the cloud. In a nutshell, regulation will have to keep pace with technology advancements, and possibly be able to adapt by predicting them.

In the next part of our digital regulations series, we will delve into key topics discussed in this document, including the need for converging and collaborative regulations, the regulatory framework for digital regulations, regulatory sandboxes, and regtech as a platform.

_References:

_{1) https://www.civicsandcitizenship.edu.au/cce/pl_early_laws,9534.html#:~:text=The%20oldest%20written%20set%20of,Shamash%2C%20the%20God%20of%20Justice

2) https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package

3) https://www.europarl.europa.eu/news/en/press-room/20240308IPR19015/artificial-intelligence-act-meps-adopt-landmark-law

4) “Federal Decree by Law Concerning the Modern Technology-Based Trade.” United Arab Emirates Legislations | Federal Decree by Law Concerning the Modern Technology-Based Trade, 2023, https://uaelegislation.gov.ae/en/legislations/2150. Accessed 14 May 2024

5) https://www.europarl.europa.eu/news/en/press-room/20240308IPR19015/artificial-intelligence-act-meps-adopt-landmark-law

6) https://gdpr-info.eu/issues/fines-penalties/

7) https://www.eiopa.europa.eu/browse/digitalisation-and-financial-innovation/supervisory-technology

8) https://www.prnewswire.com/news-releases/idnow-introduces-automated-identity-verification-for-highly-regulated-use-cases-301353223.html}