In the context of the draft law, "Digital Content" is defined under the draft law as "any digital content located, stored or distributed in the telecommunications network or IT infrastructure, in any form or manner, and which can be created, handled or accessed through the same". Furthermore, "Intermediate Services" are themselves defined as "Hosting, processing, storing, transferring, or transiting global digital content outside the Kingdom, or enabling access thereto through the telecommunications network or IT infrastructure".

Key takeaways

The provisions of the draft law essentially introduce the following principles:

• Exemption from any civil or penal liability as a result of providing an intermediary service that includes global digital content that violates the Kingdom's laws
• This exemption is subject to conditions: it is only granted to intermediary service providers who have a valid CST certificate proving that they have passed a prequalification process (the conditions of which are still to be detailed by the CST)
• Exemption will expire upon the expiration of the pre-qualification certificate, its nonrenewal, suspension or cancellation
• Intermediary service providers are not obligated to monitor the global digital content hosted in the Kingdom, and it is clarified that the privacy of hosted data will not be prejudiced

Under Article 6 of the draft law, CST will have the power to forward take-down requests (e.g. removal, restriction of access and transit of the content) to the intermediary service providers if it has reasonable grounds to suspect the existence of a violation of laws applicable in the Kingdom or of any of the pre-qualification condition. Failure to comply with CST notices or requests of information would be considered a violation of the draft law's provisions, as well as violating the qualification requirements set by the Board and any other action that violates the provisions of the draft laws and the relevant regulatory decisions issued by the Board.

Potential sanctions

The intermediary service provider who commits any of the violations described above shall be subject to the following penalties (potentially cumulative) in proportion to the violation's nature, effect and reiteration:

• A fine not exceeding SAR 25,000,000 (i.e., approximately USD 6,600,000)
• To be deprived - for a certain period - of obtaining a pre-qualification certificate
• Cancellation of the pre-qualification certificate

The extent of the obligations and effects under the draft law remain to be detailed either in further iterations of the same or within implementing regulations (that are foreseen in the current drafting of the law), including criteria for eligibility to be certified by the CST, platforms that will be able to apply, etc.

* * * * *

If you would like any assistance in any data and technology-related matters or issues generally, please feel free to contact our lawyers.

* Content prepared by Legal Advisors in association with Baker & McKenzie Limited.