Navigating the privacy landscape of healthcare-driven AI in the Middle East: Case studies from Oman, Qatar, and Saudi Arabia

The survey of data protection legislations in Oman, Qatar, and Saudi Arabia shows a heightened protection of healthcare data. Additional legal requirements apply for the lawful processing of healthcare data. The processing of healthcare data in Qatar and Oman necessitates, for instance, prior administrative authorization. When strong burdens are imposed on data controllers, a significant risk resides in the circumvention of the legal requirements altogether. In practice, the strong legal compliance regime imposed on the processing of healthcare data in Oman, Qatar, and Saudi Arabia might lead to further investments in new data-sharing methods that would seek the anonymity of healthcare data. Contrary to the policy of some countries that opted for strict data localization rules, Oman, Qatar, and Saudi Arabia established a principle of free international data transfer, which is constrained by some legal conditions and exceptions. While robust privacy frameworks exist in the surveyed jurisdictions, the role of the Omani, Qatari, and Saudi supervisory authorities will be crucial to ensure effective safeguarding of healthcare data. The effective enforcement of personal data protection laws is also contingent upon careful management of public-private partnerships that involve the sharing of sensitive data with both national and foreign private technology companies. • The survey of data protection legislations in Oman, Qatar, and Saudi Arabia shows a heightened protection of healthcare data. Additional legal requirements apply for the lawful processing of healthcare data, such as the need in Qatar and Oman for prior administrative authorizations. • The strong legal compliance regime imposed on the processing of healthcare data in Oman, Qatar, and Saudi Arabia might lead to further investments in new data-sharing methods that would ensure the anonymity of healthcare data. • Oman, Qatar, and Saudi Arabia established a principle of free international data transfer, which is constrained by some legal conditions and exceptions. In contrast with Saudi Arabia and Oman, which imposed relatively strong constraints on cross-border data transfers, Qatar took a very liberal stance where the principle of the international transfer is only limited by a lenient exception based on the potentially “significant damage” that might affect the transferred data or the privacy of the data subject.