The main political and economic factors underlying growing cloud
investments in the GCC include the rapid growth of the data center infrastructure
market, the projected increase in data consumption, as well as the GCC states’
diversification away from an oil-dependent economy to digital infrastructure
through the establishment of Economic Free Zones. To attract investors, states
adopt modernizing “ national visions” and “digital transformation programs” through
regulations that offer companies massive financial benefits. Aiming for digital
transformation across various sectors of society (i.e., health, housing, industry, etc.)
through digitizing government services, GCC states obtain unimpeded access and
control over massive amounts of data. At the same time, investment companies
create most of the digital infrastructure of government entities.
For several reasons, the large-scale construction of data centers in GCC states,
mainly Saudi Arabia and the UAE, is alarming from a human rights perspective. First,
these states have been criticized for systematically violating a number of
fundamental human rights principles, including the UNDHR’s Articles 12 (right to
privacy) and Article 19 (freedom of opinion and expression). They have also used
surveillance systems and spyware (i.e., Pegasus) to discourage dissent and track and
punish critics. The recently adopted personal data protection laws in Saudi Arabia
and the UAE contain vague decrees and various legal loopholes. These laws favor
government control, allowing authorities to oversee data stored within their borders.
While it is common for governments to have control over data stored within their
borders, the real concern lies in the track record of human rights violations in these
countries. Given their history of infringing on rights like freedom of expression, this
control raises significant red flags regarding protecting personal data.
Tech corporations must also be held accountable. They implicitly support these
states by providing them with the essential infrastructure to enable these regimes
to gain control over the region's localized data. Without giving any public evidence
of their human rights impact assessments, there is no guarantee that these
corporations will abide by their business and human rights obligations. Due
diligence before initiating a project and transparency regarding the process’
findings are necessary for respecting and promoting human rights.
While this research primarily focuses on US-based companies, it is essential to
acknowledge the implications of investments by Chinese companies in the Gulf
region. There are concerns regarding the potential for technologies developed by
these companies to be utilized in ways that could enhance surveillance capabilities
within GCC states. Given that the digital infrastructure is built within their
jurisdiction, there are some ambiguities about the extent of data access and the
potential for sensitive information to be exposed to external entities.