The Issue of Privacy in the Cloud: An Examination of the Law in Qatar

Cloud computing is one of the emerging technologies that is set to revolutionize how people interact, do business, and perform various activities online. One of the often-neglected facets of the cloud computing discussions include the legality of the operations and processes that a cloud computing firm has to undertake in order to provide cloud computing services to their respective customers. In 2016, Qatar enacted its own Data Privacy Law. This decision puts the country on par with other developed nations that have their own DPL, such as the European Union and its GDPR. Using cloud-computing as a case study, this LLM thesis examines the privacy and regulatory landscape in the State of Qatar, specifically in the subsector of the information communication technology industry. With the implementation of the Qatari DPL, companies still continue to adopt the EU's GDPR as an additional legislation to apply to their privacy policies. Thus, the central research question in this dissertation is: to what extent does Qatar’s Data Privacy Law provide the necessary protections for cloud-based services in Qatar? This LLM thesis argues that the Qatari Data Privacy Law is a substantial and significant preliminary step towards protecting the privacy and data of individuals—citizens and residents alike within the state of Qatar. However, given the virtual and binary nature of data existing within the cloud, and the various interdependencies that companies have across different legal jurisdictions, the Qatari Data Privacy Law is limited, and functions rather territorially. The EU’s GDPR offers more protections to individual users against privacy concerns emerging within the boundary-less cyberspace that individuals are dependent on today. Hence, this thesis will show how the complex changes demanded by Qatar and the cloud-computing industry not only necessitate the application of the Qatari DPL, but necessitates the reliance on the provisionary measures introduces by EU’s GDPR.