In September of this year, the QFC Data Protection Office (“DPO”) announced that a QFC-licensed firm (“Firm”) was reprimanded and fined USD 150,000 for multiple breaches of the QFC Data Protection Regulations and Rules, issued in 2021. The breaches were various, including delayed notification of a data breach, inadequate security measures, and failure to maintain data integrity and confidentiality – and the heavy penalty imposed sends a clear message to QFC licensed firms to reinforce adherence to the QFC’s data protection standards and requirements.

One of the key violations involved the Firm’s failure to notify the DPO of a personal data breach within the required 72-hour period, notwithstanding that the Firm’s Data Processor had knowledge of the breach 13 days prior. However, the notification to the DPO was delayed by at least 10 days, and this was a clear violation of the DPO’s mandate for timely reporting of breaches. The DPO emphasized that the procedural failures within the Firm did not absolve it from its obligation as the Data Controller to report breaches within allotted regulatory timeframe. It should be noted that Data Processors are required to notify Data Controllers without undue delay, however, the principal responsibility for timely reporting to the DPO remains solely with the Data Controller.

Moreover, the Firm also failed to implement sufficient and adequate security measures to protect collected personal data, jeopardising the confidentiality, integrity, and resilience of its systems, with noticeable deficiencies including the absence of effective monitoring mechanisms, comprehensive system logs, and regular security reviews. These failures left the Firm vulnerable to unauthorized access and potential data loss, alongside the Firm’s lack of proper oversight or enforcement of appropriate security policies.

As a result of the occurrence of such breaches, the DPO issued a formal reprimand and imposed the financial penalty to address the Firm’s inadequacies and deter future breaches. However, the DPO refrained from issuing a public censure, considering that the violating Firm was in full cooperation with the DPO, and took the appropriate steps to enhance and fortify its data protection policies.

This case should serve as a reminder of the critical importance of adhering to data protection regulations and implementing proper security and incident response measures.

GLA has advised a number of local, regional and international clients on data protection legislation under the State of Qatar, the QFC and across the MENA region. This expertise is delivered through its fully operational QFC office and a dedicated data protection team, supported by an established practice in this specialized area.

Authors: Partner, Dean Jaloudi, Legal Director, Asad Ahmad and Trainee Lawyer Liana Rashid.