How and why does the QFC Regulatory Authority process your personal data?
As a general principle, the Qatar Financial Centre Regulatory Authority ("Regulatory Authority") only collects and processes personal data for the performance of statutory tasks assigned to it on the basis of the Qatar Financial Centre Data Protection Regulations, and the applicable laws of the State of Qatar.
Regarding the collection and processing of personal data received in the usual course of business or practice through international transfers, the Regulatory Authority is committed to have in place the safeguards set out in the Administrative Arrangement
(hereinafter "AA") for the transfer of personal data between European Economic Area ("EEA") and non-EEA securities regulators, without prejudice to any laws or legal basis that may apply.
In particular, when the Regulatory Authority collects and processes personal data transferred under the AA, it guarantees the following:
- the Regulatory Authority will only transfer personal data that is relevant, adequate and limited to what is necessary for the purposes for which it is transferred and further processed;
- the Regulatory Authority has in place appropriate technical and organisational measures to protect personal data that are transferred to it against accidental or unlawful access, destruction, loss, alteration, or unauthorised disclosure;
- the Regulatory Authority will retain personal data for no longer than is necessary and appropriate for the purpose for which the data is processed;
- to decision will be taken by the Regulatory Authority concerning a natural person based solely on automated processing of personal data, including profiling, without human involvement; and
- the Regulatory Authority will not divulge personal data for other purposes, such as for marketing or commercial purposes.
What are your safeguards under the Administrative Arrangement?
With regards to the personal data shared under the AA, you can make a request to the Regulatory Authority to receive information about the processing of your personal data. To access your personal data and to correct any inaccurate or incomplete personal data, as well as to make requests about the erasure, restriction of processing, or to object to the processing of your personal data a written request should be addressed to firstname.lastname@example.org.
Given the often sensitive nature of our work, and the risk of prejudice to the discharge of our public functions, in some cases your safeguards might be restricted in accordance with applicable laws of the State of Qatar and other relevant legal provisions, such as our own Data Protection Regulations which create the obligation not to disclose confidential information pursuant to professional secrecy or other legal obligations, or to prevent prejudice or harm to its supervisory or enforcement functions or to the supervisory or enforcement functions of a transferring or receiving Authority under the AA acting in the exercise of the official authority vested in it. This may include functions relating to the monitoring or assessment of compliance with applicable laws, prevention or investigation of suspected infringement; for important objectives of general public interest, or for the supervision of regulated individuals and entities. In each case, the Regulatory Authority will assess whether the restriction is appropriate. The restriction should be necessary and provided by law, and will continue only for as long as the reason for the restriction continues to exist. For more information, please see the Qatar Financial Centre Data Protection Regulations.
What redress is available to you?
If you believe that your personal data has not been handled consistent with these safeguards, you can lodge a complaint or claim at the transferring Authority, the receiving Authority or both Authorities. For the Regulatory Authority, you can contact email@example.com.
In such event, the Authority or the Authorities will use best efforts to settle the dispute or claim amicably in a timely fashion.
In the event where the matter is not resolved, other methods can be used, by which the dispute could be resolved unless the request is manifestly unfounded or excessive. Such methods include participation in non-binding mediation or other non-binding dispute resolution proceedings initiated by the natural person or by the Authority concerned.
If the matter is not resolved through cooperation by the Authorities, nor through non-binding mediation or other non-binding dispute resolution proceedings, in situations where you raise a concern and a transferring Authority is of the view that a receiving Authority has not acted consistent with the safeguards set out in the AA, the transferring Authority will suspend the transfer of personal data under this Arrangement to the receiving Authority until the transferring Authority is of the view that the issue is satisfactorily addressed by the receiving Authority, and will inform you thereof.