Personal Data Protection and Safeguarding Draft Act June 2019 informed consent of the person concerned, or some other legitimate basis laid down by law. The approach adopted by the Draft Act requires a back and forth reading of the law which creates the risk of the law being inconsistently applied. This is inconsistent with how nearly every data protection law in the world has been drafted and with international standards. In comparison, the Turkish Law on the Protection of Personal Data states in Article 4 that personal data will be processed in compliance with the principles of lawfulness and fairness, accuracy, purpose specification, storage limitation, and data minimisation.54 The latter is a principle established under the General Data Privacy Regulation (GDPR) according to which personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.55 Similarly, data protection laws in Lebanon56 and Algeria57 have included the principles of purpose limitation, data minimisation, and accuracy.58 Recommendation ● The Draft Act should be redrafted to reorganise and streamline, fully incorporating the principles set out in international law in the text of the law and in a specific section placed after Section 2 that presents the “Definitions”. B. Unclear Application of the Draft Act 1. Absence of a Provision Establishing the Material and Territorial Scope of Application Another significant omission in the Draft Act is the absence of any clear provision setting out the material and territorial scope of application. According to Article 1(b), the Draft Act will regulate “the processing of personal data”. This provision outlines the aim of the law but the Draft Act presents no provision with regard its material scope. The material scope usually defines what types of processing of personal data the Draft Act applies to and which ones, conversely, are excluded. Data protection laws usually define its territorial scope of application in order to establish where persons as well as organisations have to be located in order to be obliged to comply with the law. The Draft Act does not present any such provisions. This distinction has been put in place by the General Data Privacy Regulation (GDPR). As for the material scope, the Regulation is applicable to the processing completely or partly by automated means, such as, for instance, carried out with the use of computers containing digital databases. In addition, the processing of personal data by any other means is also regulated by the GDPR when these data are included in a filing system or are intended to be used in such a filing system, as stated in Article 2(1) of the GDPR. This can be the case when personal data are manually processed and are contained or are to be contained in a filing system with structured sets of personal data that are accessible in accordance with certain criteria, such as manual files printed on paper. As for the territorial scope, According to Article 3(1) of the GDPR, it is applicable to the processing of personal data by controllers and processors with an establishment in the European Union. In this regard, it does not matter whether the actual processing is carried out in the Union or outside. Importantly, Article 3(2) of the GDPR states that when controllers and processors are not established in the European Union but process personal data of individuals who are in the Union, the Regulation is applicable. Such processing activities must relate to the offering of goods or services for a payment or for free to these individuals or to the monitoring of the behaviour of these persons as long as this behaviour takes place in the European Union, as indicated in Article 3(2)(a) and (b) of the GDPR. Finally, the GDPR regulates the processing of personal data by controllers that are not established in the Union but somewhere 54 Turkey, Law on the Protection of Personal Data, Art. 4. 55 GDPR, Art. 5. 56 Lebanon, Law n. 81 relating to Electronic Transactions and Personal Data, Art. 87. 57 Algeria Law on the Protection of physical persons for the processing of personal data, 10 June 2018, Art. 9. Bahrain Law No. (30) for the year 2018 Issuing the Personal Data Protection Act, Art. 3. 58 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 18 of 58