•  
  •  
 

Corresponding Author

M. El-Khoury

Article Type

Journal Article

Keywords English

Middle East, Legitimate interests, Personal data, AI development and lawful processing, Data processing and AI deployment

Abstract English

This article addresses the legal basis of legitimate interests for the processing of personal data in the region of the Middle East. Three categories of countries emerge after the survey of selected data protection laws in the region: jurisdictions that explicitly enacted the legitimate interests as a lawful ground for the processing of personal data, those that established a variant of ‘legitimate rights’, and those that omitted the concept of legitimate interests entirely. This article argues that the absence of a lawful ground of processing based on legitimate interests makes the privacy landscape very rigid in some jurisdictions in the Middle East and deprives economic actors of the flexibility such a legal basis oers when processing personal data. Consequently, legislative reforms of recently promulgated privacy laws are needed in Middle Eastern jurisdictions that did not recognise legitimate interests as a lawful ground of processing. Some of the Middle Eastern jurisdictions that did not enact legitimate interests into their onshore privacy legislation did enact oshore privacy regulations which established the legitimate interests as a lawful ground for processing personal data within their financial free zones. This legal disparity between a rigid onshore privacy landscape and a flexible oshore privacy legal regime leads to an oshore concentration of digital and technological innovation at the detriment of the onshore national economies. While much needed, the legal basis of legitimate interests should not be perceived as a soft option for data protection compliance. The introduction of legitimate interests should always rest on a balancing test, which would require the delicate weighing of dierent interests and conflicting rights. Advocating for legislative reform of the privacy landscape in the Middle East does not practically imply the ‘deregulation’ of data protection, but rather a structural and responsible alignment with the need for AI development and operation.

Publication Date

12-31-2025

Download

Share

COinS