As many of you are no doubt aware, media outlets in the UAE and beyond have been reporting various viewpoints on the apparent new state of the law regarding Virtual Private Network (VPN) use in the United Arab Emirates - reportedly pursuant to new Federal Law No.12 of 2016 Amending Federal Law 5 No. of 2012 ("2016 Amending Law").

Some of these articles are stating or suggesting that the use of VPNs in the UAE is now strictly prohibited. However, we do not believe this to be the overall effect or intent of the reported legislative amends. We discuss our views on this matter in further detail below.

What is Reportedly Changing?

The UAE Federal Law No. 5 of 2012 On Combatting Cybercrimes ("Cybercrimes Law") is the law that is being amended by the 2016 Amending Law, in particular Article 9 – the original version of which provides as follows:*

Article 9: Punishment of Circumvention on the Protocol Address of the Internet for the Purpose of Committing a Crime or Preventing its Discovery

Any person that circumvents the protocol address of the internet by using a delusive address or an address belonging to third party or by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by imprisonment and a fine of not less than (AED 150,000) and not exceeding (AED 500,000) or by any of these punishments.

The 2016 Amending Law replaces the operative section of Article 9 with the following:*

Whoever uses a fraudulent computer network protocol address (IP address) by using a false address or a third-party address or by any other means for the purpose of committing a crime or preventing its discovery, shall be punished by temporary imprisonment and a fine of not less than AED 500,000 and not exceeding AED 2,000,000, or either of these two penalties.

*Emphasis added for illustrative purposes. Please also note that all English language translations of UAE law are by definition unofficial, and only the original Arabic text as published in the UAE Official Gazette constitutes the legally recognised version.

What Does this Mean?

On the basis of an assessment of the provisions set out above, the overall legal status of VPNs in the UAE under the Cybercrimes Law generally has not changed. That is to say, in both of the above iterations of Article 9, it is not the strict use of a VPN alone that attracts potential liability – but rather its use "for the purpose of committing a crime or preventing its discovery". However, this does of course in turn trigger a further necessary question – namely, what exactly might constitute criminal behaviour (or the concealment of it) in this context under various UAE laws and regulations? Unfortunately, this is not a particularly simple or straightforward line of inquiry – and in many cases would be very fact-driven and specific. This is because many restrictions or prohibitions under UAE legal frameworks – in particular regarding the use or distribution of different types of content – can be quite broad and subjective and therefore open to different potential interpretations (for example, legal prohibitions on content that is contrary to public morals or considered to be offensive). On the other hand, certain prohibitions or restrictions under UAE legal frameworks can be quite prescriptive or specific (for example, restrictions on the use of certain specified technologies, such as VOIP).

Therefore, it would be prudent to make an assessment as to the overall UAE legal and regulatory compliance of activities being conducted via VPN. To the extent that such activities are not in fact compliant with the wider UAE legal and regulatory framework, there is indeed a clear risk of potential repercussions pursuant to the Cybercrimes Law (as amended or otherwise). It is also worth bearing in mind that the corresponding fines under Article 9 have been increased significantly pursuant to the 2016 Amending Law (from a maximum of approximately US$135,000 to a maximum of approximately US$550,000), and therefore any potential misuse of a VPN in the UAE may now also carry a significantly heightened commercial risk.

What Should Be Done Now?

In light of the developments and observations set out above, we would recommend taking next steps as follows:

  • Audit and assess your specific VPN usage – is it compliant with the applicable UAE laws and wider regulatory framework, in particular regarding matters of communications regulation and/or content restrictions?  
  • If the answer to the above query is no, undertake appropriate corrective action – if you are uncertain, your local legal adviser should be able to assist.
  • Implement a system to continue monitoring and stay informed of any relevant legal/regulatory developments in this area. 
  • Ensure that any changes to your activities/usage involving a VPN in the UAE are cognisant of the points raised above.

Please do not hesitate to contact your usual Dentons contact if you would like to receive further updates on this matter, or require further advice or assistance in connection with this or any other areas of Technology, Media & Telecoms law in the UAE generally.

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.