Book an appointment with us, or search the directory to find the right lawyer for you directly through the app.Find out more
We are excited to share the latest edition of the Law Update, beautifully and appropriately titled “Sustainable Horizons: The Saudi Arabian Vision.” Giving special honor to the Kingdom’s 2030 vision, this update focuses on a collection of both informative and inspiring articles.
For those in construction, you can learn about how the tendering environment impacts risk-pricing for contractors, the updates on the legal framework of the construction industry and how contractors can protect themselves against financial difficulties.
There is good news too from the kingdom’s banking sector, from which the practice of “Open Banking” is being pushed for! But what is open banking? We’re answering that too.
Also . . . Are there any women trail blazers in Saudi Arabia you can name? We’ll help you with that. We cover how the Middle East has been making strides in empowering women in the entrepreneurial space,most notably in STEM fields.Read the full edition
Martin Hayward - Head of Digital & Data - Digital & Data
Charlotte Sutcliffe - Associate - Digital & Data
All around the world, technology companies are disrupting markets with electronics personalising consumer experience. The amount of products categorised as part of the ‘Internet of Things’ (‘IoT’) is on the rise, transferring data across networks in devices as sophisticated as smartphones, and as simple as a toaster. With the value of personal data on the rise, and the willingness of consumers to hand it over, there are predictions that connected devices sharing user data offer the potential for a fourth industrial revolution. It is true that IoT offers an infinitely connected world, bringing us closer together in very real and important ways.
Consumers are becoming less satisfied with the idea of ‘one size fits all’, and are growing a lot more accustomed to personalised treatment. The hotel industry has recognised this well; especially in the UAE, which is fast embracing the use of IoT in its hotels to offer a hyper personalised experience and act as a key differentiator in a highly competitive market.
Consumers now expect to find smart technology in their hotel rooms; technology that mirrors the smart technology they have at home, whether it is an intelligent thermostat, colour-changing lamp, or smart door lock. They are looking to control their hotel rooms at the press of a button or, increasingly, with a voice command. The hoteliers that get this right will secure key brand loyalty.
International hotel chains are building their IoT technology footprint with key partnerships with IoT providers. Examples of this are Marriott’s partnerships with Legrand’s IoT programme and Samsung’s ARTIK cloud-based IoT platform.
Hotels are also using IoT services to offer personalised services such as restaurants, gyms and activities, using location-based information (which also brings with it certain legal challenges). This can be used to send real-time information about menu options, activities close by and transport updates.
Hotel guests can even rely on their smart phones to check in and unlock their hotel doors, perhaps setting up their hotel room preferences as they walk through the lobby on arrival, creating a truly seamless customer experience.
Real-time information also allows hotel staff to be alerted to any required repairs and preventive maintenance within the hotel. There is nothing a hotel guest dislikes more than a broken TV in their room on arrival!
In addition to the advantages of making hotel guests’ stays more convenient, interactive and personalised, IoT in hotels has economic and environmental advantages. For example, smart rooms that are able to monitor and adjust air, heat or lights may save company owners money on energy bills. Hotels can leverage these cost savings whilst emphasising their green footprint to hotel guests who are increasingly choosing hotels based on environmental criteria.
Of course, like any industry disrupter, IoT has the potential to pose certain risks unless businesses fully understand the relevant legal landscape in which they are operating and take steps to ensure their compliance. Laws chase emerging technology trends, but sometimes struggle to predict the unchartered waters of this increasingly connected world. This is particularly relevant in the Middle East.
As IoT devices are connected to the internet, they can be hacked. This is especially concerning given the number of IoT devices and the interconnection of each IoT device within each hotel room, and with the wider hotel network. If a hacker enters through a single point of entry, there is an ability for that hacker to compromise additional parts of the overall network. Given both the growth in the use of technology like virtual room keys activated via your mobile phone and the increasing collection of hotel guest personal data through IoT devices, this potentially puts hotel guests at increased risk.
The more use hotels make of IoT devices, the more information a hotel can collect on a hotel guest and the greater the opportunity for personalisation and increasing guest brand loyalty. Hoteliers need to take steps to ensure the risk of a security breach is low and hotel guest personal data collected via IoT devices is protected. Penalties for non-compliance with laws can be severe, as can the consequences of reputational damage for hotel brands. With a number of recent high profile global cyber incidents impacting hotels, hoteliers need to be very focused on installing robust and secure IoT systems
Hoteliers need to be aware of a number of key UAE legal and regulatory requirements as they move forward with greater guest data collection and usage:
The UAE Telecommunications Regulatory Authority (‘TRA’) recently issued an IoT regulatory policy which aims to regulate IoT with the intention of making the UAE a leading country in developing IoT services and driving innovation (‘IoT Policy’). Please see our previous article titled ‘What’s Got Hot in the Internet of Things?’.
An IoT Service Provider is defined broadly under the IoT Policy as ‘any person that provides an IoT Service to users (including individuals, businesses and the government), that will comprise the provision of IoT services’. IoT services is also broadly defined. IoT Service Providers have a number of key obligations, including registration with the TRA, under the IoT Policy, and hotels adopting new IoT solutions need to assess whether they could fall into the IoT Service Provider category.
Moreover, personal data collected via IoT devices needs to be kept secure and the IoT Policy sets out key requirements for ensuring data security, particularly in relation to the transfer of personal data outside the UAE. Hotel chains use global hotel management systems and transfer and store data regionally, or even, globally. UAE hoteliers need to consider whether their current data collection, transfer and storage practices meet the requirements of the IoT Policy.
Hoteliers generally want large, centralised datasets to analyse and monetise. This allows them to track trends in the hotel industry, as well as guest behaviour and preferences. Please see the related article entitled ‘Unlocking the value in data: successfully implementing compliant data monetisation strategies’. IoT devices, by their, nature generate large amounts of valuable personal data, particularly when aggregated and mined using emerging technologies, like AI.
As set out above hotel chains are global, running globalised IT infrastructure. They transfer and hold data at a regional, and often global, level. With no comprehensive ‘European style’ data protection legislation in the UAE specifically designed to regulate the collection, processing, transfer and/or use of personal data, except for certain specific UAE financial free zones (DIFC and ADGM), hoteliers need to be aware of a web of UAE laws that cover the use (and particularly the transfer) of personal data to ensure that they remain compliant. Where hotels are established in the DIFC and ADGM, hoteliers need to be aware of the current data protection laws that apply to them (and also the hotly anticipated new data protection laws that are expected very soon).
The implementation of IoT in hotels in the UAE is increasing and UAE hoteliers should be looking to take full advantage of the benefits IoT offers to their businesses. They need to balance this opportunity with heightened awareness of, and full compliance, with all relevant UAE laws.
For further information, please contact Martin Hayward (email@example.com) or Charlotte Sutcliffe (firstname.lastname@example.org).
To learn more about our services and get the latest legal insights from across the Middle East and North Africa region, click on the link below.