Legitimate Interests as a Lawful Ground for the Processing of Data and AI Development in the Middle East

This article addresses the legal basis of legitimate interests for the processing of personal data in the region of the Middle East. Three categories of countries emerge after the survey of selected data protection laws in the region: jurisdictions that explicitly enacted the legitimate interests as a lawful ground for the processing of personal data, those that established a variant of ‘legitimate rights’, and those that omitted the concept of legitimate interests entirely. This article argues that the absence of a lawful ground of processing based on legitimate interests makes the privacy landscape very rigid in some jurisdictions in the Middle East and deprives economic actors of the flexibility such a legal basis offers when processing personal data. Consequently, legislative reforms of recently promulgated privacy laws are needed in Middle Eastern jurisdictions that did not recognise legitimate interests as a lawful ground of processing. Some of the Middle Eastern jurisdictions that did not enact legitimate interests into their onshore privacy legislation did enact offshore privacy regulations which established the legitimate interests as a lawful ground for processing personal data within their financial free zones. This legal disparity between a rigid onshore privacy landscape and a flexible offshore privacy legal regime leads to an offshore concentration of digital and technological innovation at the detriment of the onshore national economies. While much needed, the legal basis of legitimate interests should not be perceived as a soft option for data protection compliance. The introduction of legitimate interests should always rest on a balancing test, which would require the delicate weighing of different interests and conflicting rights. Advocating for legislative reform of the privacy landscape in the Middle East does not practically imply the ‘deregulation’ of data protection, but rather a structural and responsible alignment with the need for AI development and operation.