In Brief:
- To help streamline administrative tasks relating to the admission and registration of students, many UAE school administrators are moving towards online admission and registration platforms.
- These platforms allow schools to electronically collect and store information from students, parents and alumni, allow parents or students to use an electronic signature to accept online offers of admission or agree certain terms and conditions or waivers and, ultimately, allow for the payment of deposits or school fees.
- These platforms are powerful tools and undoubtedly make the admission and registration process more efficient, however, UAE school administrators will need to take into consideration UAE technology-related commercial legislation and data protection laws to ensure the electronic contracts (such as the online terms and conditions and waivers signed by students or parents), the related electronic signatures and data processing consents are valid, and that the data they collect is ultimately processed in compliance with relevant data protection legislation.
UAE E-Transactions Law
Federal Decree Law No. 46/2021 on Electronic Transactions and Trust Services (“E-Transactions Law”) reinforces the UAE's commitment towards a digital economy, and sets out various requirements for electronic transactions, signatures and documents. With respect to electronic signatures, the E-Transactions Law assigns the same weight and treatment to these signatures as handwritten (or ‘wet’) signatures, however, the legislation sets out a number of requirements to determine the validity and ‘reliability’ of electronic signatures. These requirements include that a signature is under the ‘full control’ of the signatory and a signature is capable of identifying the signatory. There are also a number of other requirements to ensure an electronic signature is ‘reliable’, such as the party relying on the signature determining the appropriate level of security for the electronic signature based on the nature, value or importance of the transaction.
It should be noted that the E-Transactions Law states that the party relying on an electronic signature bears the risk if the signature is deemed invalid (i.e. if a school relies on the electronic signature of a party and the signature is deemed invalid, the school would bear this risk and thereby be responsible for any damages caused by relying on such signature).
Electronic signatures are common for online admission and registration portals – parents and students routinely log on to sign terms and conditions, sports waivers, field trip waivers, school policies, etc. These electronic signatures usually take the form of the signatory typing their name in a box, or clicking a box to accept the terms, which, when combined with the log in details and identification provided on the portal, make it easy to identify the signatory. However, this process is not fail safe. Multiple users may potentially log on to a portal if they have the password, and a school cannot guarantee documents are signed by the intended party. It is important that the parties to a contract are identifiable to ensure the contract stands up under legal scrutiny of the UAE Courts, if tested.
In light of these potential risks and in consideration of the E-Transactions Law, school administrators may want to consider more sophisticated and secure forms of electronic signatures for online contracts, particularly where they have a high value or importance, such as contracts relating to significant fees, or containing waivers, indemnities and other limitations of liability that potentially increase the value and import of a contract.
In addition to online contracts found on admission and registration portals, UAE school administrators may also want to undertake the same type of analysis for any other online contracts they enter into (for example, online contracts with third party service providers such as ECA providers, food service companies, IT companies, web applications, etc.).Similar to the terms and conditions mentioned above, if a contract has a high value, nature or importance, a more secure form of signature may be warranted.
The E-Transaction Law also sets out a number of requirements for the storage of electronic documents and the sending and receiving of electronic documents, which should be considered by school administrators. For example, electronic documents must be stored in the form in which they were created, sent or received, and in such a way that allows them to be used and referenced later.
UAE E-Commerce Law
Since online admission and registration platforms often permit parents to electronically sign terms and conditions, and may also permit the payment of deposits and school fees, where these actions fall within the broad definition of ‘trading by modern technological means’ (as in our view is likely), Federal Decree-Law No 14/2023 of Trading by Modern Technological Means (“E-Commerce Law”) may apply to the online transactions between UAE schools and parents or students. “Trading by modern technological means” is widely defined to include the sale and purchase of goods or services on websites, platforms and smart applications.
The E-Commerce Law addresses key areas in digital trade, such as the regulation of e-commerce, the provision of related consumer rights, and the steps for dispute resolution. In the context of online admission and registration platforms, the E-Commerce Law sets out various requirements for the terms and conditions of online contracts, including those relating to digital identity and verification of the parties.
The E-Commerce Law also sets out a number of standards and consumer rights when ‘trading by modern technological means’ such as the requirement to provide a non-paper invoice, a right to choose whether or not to agree to receive advertising and marketing, a right to rate the experience with the ‘seller’, and the ability to submit complaints. The E-Commerce Law goes into detail in these areas and, for example, requires a merchant (or seller of services) to provide a phone number, which is permanently available, with qualified staff on hand to address complaints.
UAE school administrators should consider the E-Commerce Law to ensure that their portals and websites not only provide for the necessary complaints process, invoicing requirements and other standards and requirements set out in the E-Commerce Law, but also to be aware of their own rights when entering into online contracts with third party service providers.
UAE Data Protection Law
Whether UAE schools are collecting or storing personal information about current or prospective students, parents or alumni (such as student medical files, passports, birth certificates, school reports, etc.) via an online admission and registration platform, any other online solution or in paper format, UAE school administrators ought to consider Federal Decree Law No. 45/2021 regarding the Protection of Personal Data (“PDPL”) which is not yet being enforced (pending the issuance of the executive regulations envisaged under the law) but is, nevertheless, law in force, as well as, potentially, other UAE data protection laws, such as the data protection laws applicable in the Dubai International Financial Centre and the data protection regulations of the Abu Dhabi Global Market (dependent on the place of establishment of the school in question).
The PDPL (unlike the data protection regimes of the DIFC and ADGM) covers the processing of personal data belonging to UAE ‘data subjects’, regardless of where the entity controlling the data, or the entity processing the data is established. In assessing their compliance with the PDPL, UAE school administrators ought to consider the following questions:
- What personal data does your school collect and who provides it to the school?
- When is the personal data collected and by what means?
- For what purpose does the school use the personal data?
- Who has access to such personal data, including both internal staff and third parties?
- Where does the school store the personal data, and for how long?
As part of a data protection compliance review, UAE school administrators would be advised to complete a full assessment of the flow of data in their school(s), including data collected and stored on any online admission and registration platform or other solution. Administrators will want to know who has access to the personal data (most platforms offer a ‘permissions’ feature, so only certain staff can access data) and determine if personal data is being shared by a school with other entities (such as other group schools, head office, or third party service providers). If personal data is being shared, administrators will also need to consider if the proper consent (in accordance with the PDPL) has been obtained, and identify where all personal data is being stored (if the school has an admission and registration platform that is cloud-based, it will be important to ask the provider about storage details).
For student medical records, likely being classified as ‘health data’, and which accordingly are afforded a higher level of protection than other forms of personal data, being ‘sensitive’ personal data, UAE administrators will need to consider not only the PDPL, but also any applicable UAE healthcare-specific data protection laws or regulations, as well as any relevant guidelines as may be applicable to UAE school health clinics.
Lastly, UAE school administrators will need to consider the extra-territorial effect of international data protection regulations (such as the UK Data Protection Act 2018 and the European General Data Protection Regulations 2016/the ’GDPR’) which may apply to UAE schools collecting personal data of, for example, prospective students and their parents who are providing personal information from their home country. These laws may have an effect on any international student recruitment efforts and any direct queries from students and parents living in their home countries.
In summary, when taking advantage of powerful technology such as online admission and registration platforms, UAE school administrators must look beyond the platform to ensure that the underlying contracts, signatures, payments, consumer rights and collection and processing of data are in compliance with relevant UAE (and sometimes international) legislation.
The above references to potentially applicable laws is not intended to be exhaustive; however, we will be publishing additional articles on the application of various other UAE laws relevant to the education sector in further newsletters.
For more information, please contact Julie Beeton, Senior Associate, Commercial at j.beeton@hadefpartners.com