United Arab Emirates: Recent Case Highlights Risks Of Using Social Media In The UAE

Media outlets in the UAE and elsewhere have picked up on a variety of recent stories regarding the use of social media in the UAE.  These stories include one about an Australian expat being arrested, jailed and deported after posting a picture of a car taking up two disabled parking spots.  A similar story from earlier in the summer related to an appellate decision to overturn the sentence of a man who had been found guilty in Dubai of insulting a colleague in a WhatsApp message.   The man was originally fined AED3,000 (approx. £500).   However the Federal Supreme Court held that the sentence was too lenient and ordered a retrial.  These cases follow another case earlier this year where an American man was arrested after posting derogatory comments about his employer in the UAE on Facebook.

The cases were brought under Federal Laws No.3 and 5 of 2012 (the Cyber Crimes Law) which provide for potential penalties of fines of AED250,000 (approx. £43,500), as well as potential prison sentences and deportation (if applicable) if someone is found guilty of a breach.

In this article we consider the overlap between an individual's online activities in the UAE, the applicable legal framework and the employment relationship.

Social media

There is no specific regulation in the UAE of the use of social media.However, careless use of social media (whether for a private or business matter) can result in criminal and civil liability arising for both individuals and companies.

The main legislative provisions that give rise to criminal liability are as follows:

• Federal law No. 5 of 1985 (the Civil Code) and  Federal Law No. 3 of 1987 (the Penal Code) both provide for liability where industrial or trade secrets of the employer or another third party are disclosed without consent.  For example, Article 379 of the Penal Code provides for a minimum prison sentence of one year and/or a minimum fine of 20,000 Dirhams if somebody "who is entrusted with a secret by virtue of his profession, trade, position or art...discloses it in cases other than those lawfully permitted, or if he uses such a secret for his own private benefit or for the benefit of another person, unless the person concerned permits the disclosure or use of such a secret";
• Articles 372, 373 and 378 of the Penal Code contain provisions relating to defamation. Defamatory content could include posting information about others without their consent (even if such information is true), or posting photographs or videos without the consent of the subject of the photograph or video, unless the photograph was taken at a public event or occasion;
• the Penal Code also includes provisions relating to the insult or abuse of any religion, using any means (which is wide enough to include the posting of religious comments to Twitter and Facebook).  The UAE is an Islamic country, and statements or acts that are deemed to be anti-Islamic could result in criminal complaints being made.  It should be noted however, that a criminal offence arises where someone insults any of the "recognised divine religions" and therefore the criminal offence is not limited only to anti-Islamic offences.
• the Cyber Crimes Law, for example where posted content:
  • offends religious sanctities or encourage sins;
  • offends against the interests of the State;
  • provides pornography, gambling activities, and other materials prejudicial to public morals;
  • promotes prostitution/debauchery;
  • slanders another person;
  • breaches the privacy of another (e.g. by intercepting communications, taking photographs, publishing information, etc.); or
  • intentionally abolishes, destroys, or reveals secrets, or that results in the republication of personal information.

In addition to criminal charges, civil liability could arise where somebody, whether an organization or an individual, suffers loss as a result of comments made about them or the disclosure of confidential information belonging to them.

Social media in an employment context

General

In the UAE, as is the case elsewhere, permitted use of social media should be regulated by an employer's internal policies and practices, and an employer is free to impose disciplinary sanctions where an employee acts in breach of internal policies.

Article 109 of the Federal Labour Law expressly provides that disciplinary penalties may not be imposed on an employee who has committed an offence outside the place of business "unless such act is connected with work, the employer or its responsible manager".  Accordingly, the employer must prove that the employee's online actions have had an impact on its business.

The DIFC Employment Law permits immediate termination "in circumstances where the conduct of [the employee] warrants termination and where a reasonable employer ... would have terminated the employment".   This means that employers are able to consider summary dismissal in a wider range of circumstances than under the Federal Labour Law, and the unauthorised use of social media, or the use of social media in a way that harasses or otherwise discriminates against a colleague, may well justify immediate dismissal in the DIFC.

Where an employer has documentary evidence to demonstrate that there has been a disclosure of confidential information or trade secrets and is able to quantify the damage sustained by the business as a result, the employer may initiate both criminal and civil proceedings. Similar action could be taken by an employer in the event that the employee's use of social media defames the employer or its business. The matter could also be reported to the police and if found guilty, individuals can face up to two years in prison or a fine of up to AED 20,000.  There is no civil action for defamation; however an employer may file a civil claim for damages for harm caused by reason of the employee's actions under the Civil Code and may be entitled to financial compensation, provided the elements can be proved.

In addition to the above, criminal and civil action (including under the Cyber Crimes Law) could also be taken against the employee by victims of the employee's conduct.Where the opinions or actions of the employee are presented or performed on behalf of (or seen to represent those of) the employer a criminal complaint could be made by the victim against the employee's manager as well as the employee.

Discrimination

Under the DIFC Employment Law, an employer established in the DIFC may also be held legally responsible for any discriminatory acts of their employees, subject to such acts having been committed in the course of employment.  This could, for example, include cyber-bullying or harassment of employees or the posting of discriminatory comments or material on an individual's Facebook page.  In order to avoid liability, an employer must demonstrate that an employee who is allegedly responsible for the bullying, harassment, etc., acted outside "the course of their employment" and that the employer took reasonable measures to prevent such employee from committing the acts in question.  There are no stated guidelines on the necessary level of preventive action nor is there any case law that directly addresses this, but a written equal opportunities policy that is very actively implemented should serve as a useful measure in this regard.

Although there is no general prohibition of discrimination under the Federal Labour Law, sexual harassment (which could include any harassment carried out through social media) is a violation of the Penal Code, which provides that it is a criminal offence to "obstruct a female in such a manner as to violate her honour by work or deed."

What should employers do?

Policies

In light of the above an employee's permitted use of social media in the private context can and should be regulated by an employer's internal policies and codes of conduct.Employers are well advised to set clear expectations with regard to acceptable behaviour online.Internal policies should also require employees to clearly state in any blogs or postings that their comments and opinions do not reflect those of their employer.Finally, any such policy should include guidelines for any staff whose roles require them to publish business related news or information on social media; for example marketing teams who use Twitter or LinkedIn for publicity purposes.

As noted above, the Federal Labour Law provides that disciplinary penalties may not be imposed on an employee who has committed an offence outside of work unless the act is connected in some way to the business.A disciplinary policy should therefore make it clear that if private activities detrimentally affect the employer's reputation, the employer is entitled to take disciplinary action. Without this, an employer will struggle to justify any subsequent disciplinary action.Given the clear risk that individuals in the UAE could be prosecuted if they fall foul of the relevant local laws, employers should also use their social media or IT policy to educate their staff more generally about the risks of posting online.

Training

As well as ensuring a clear policy is in force, employers should consider rolling out training to new recruits and existing employees to ensure that they understand what they can and can't do and what the consequences of getting it wrong could be.

Monitoring

An employer's ability to monitor employees' activities online must be carefully managed and prior consent obtained.  The Constitution of the UAE contains a general right to privacy for individuals and guarantees freedom of communication by post, telegraph or other means of communication.  Articles 378, 379 and 380 of the Penal Code also establish criminal offences in relation to the interception or disclosure of correspondence or telephone conversations and Article 15 of the Cyber Crimes Law appears to extend this to IT communications.

Although there is no specific guidance on the point, it is likely that the monitoring of an employee's online activities outside of the workplace and through their own personal devices would be considered unlawful.  However, it is arguable that where the individual is using the employer's IT systems and e-mail accounts, reasonable monitoring may not be considered to be in violation of the above provisions.  In such circumstances, the extent to which employees' online activities will be monitored during company time should be clearly set out in an IT policy, which outlines the expected standards in terms of reasonable usage during working time.  Employees should also be informed of the purposes for which the monitoring is being carried out, and their consent to such monitoring should be obtained.  It may also be sensible to put in place a 'pop up' reminding employees who access the internet from their work computer, tablet or smartphone of what restrictions apply to their internet use and that their usage is being monitored.

Conclusion

The UAE has strong cyber laws in place in order to protect individuals' privacy and reputation.Falling to comply with these laws could result in employees and/or employers being subjected to criminal and/or civil proceedings.It is therefore important that organisations employing staff in the UAE take steps to implement and enforce rules relating to employees' use of the internet and, in particular, social media.

As noted above, where an employee is in breach of the terms of a well-communicated IT, data protection, or social media policy, the employer may impose disciplinary sanctions.Where the misuse of IT or social media systems has resulted in confidential information or trade secrets being disclosed or the employee being convicted of an offence involving honour, honesty or public morals, an employer may dismiss the employee without notice or end of service gratuity. Employers in the DIFC have greater discretion than employers outside of the DIFC to summarily dismiss employees who disregard the company's IT, data protection, or social media policies.

However, as well as wanting to ensure employees are aware of what internal rules they are subject to in respect of their use of the internet, employers in the UAE will also want to make their employees aware of the wider risks that their activities online may expose them to given the robust approach taken in the UAE to enforce legislative provisions that criminalise certain online activities.

Stop press

On 20 July 2015 a law criminalizing discrimination on grounds of religion, caste, creed, doctrine, race, colour or ethnic origin was enacted. Although the law is not workplace specific, Clyde & Co's Employment team will be monitoring the publication of the new law closely and will publish commentary in due course.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.