Congratulations! You’re a Winner! New Anti-Spam Regulations in Saudi Arabia

Saudi Arabia has recently updated its regulations relating to electronic messages and unsolicited marketing communications. In this article, we provide a brief summary of the key points.

New Anti-Spam Regulation

The Communications and Information Technology Commission (‘CITC’) is responsible for regulating the telecoms sector in Saudi Arabia. This includes responsibility for licensing telecommunications service providers, as well as responsibility for issuing rules to ensure compliance with the Telecoms Law (Council of Ministers resolution No. 74, dated 05/03/1422H; 27 May 2001; Royal Decree No. M/12, dated 12/03/1422H; 3 June 2001) and its By-Law (issued by Minister of Post, Telegraph and Telephone Resolution No. (11) dated 15/05/1423H; 27 July 2001)).

Article 37 of the Telecoms Law prohibits the misuse of telecommunications services to cause a disturbance. Article 58 of the Telecoms By-Law requires telecommunications service providers to protect the personal information of subscribers/users. With these considerations in mind, the CITC has recently issued new regulations addressing unsolicited marketing communications or ‘spam’, and certain other message categories.

The new Regulation for the Reduction of SPAM (the ‘Regulation’; CITC Decision No. 395/1439 dated 3/11/1439H; 14 August 2018) will go some way to addressing the ambiguity arising out of its now defunct predecessors: the Regulation for Reduction of SPAM (CITC Decision No. 259/1431 dated 12/4/1431H; 28 March 2010), and the Measures to Reduce SPAM (notified to telecoms service providers by CITC on 25/5/1439H; 11 February 2018).

Telecommunications service providers licensed in Saudi Arabia are required to take action to reduce SPAM messages transmitted across their networks, including by implementing prevention and monitoring mechanisms. ‘SPAM messages’, as per the Regulation, can be broadly understood as certain types of electronic messages sent without any opt-out mechanism. An ‘electronic message’ means messages sent by means of telecommunications networks to an electronic address such as an email, SMS, MMS, Flash SMS, or fax. Notably, the definition of electronic message specifically excludes voice calls.

Requirements for Telecoms Service Providers

The Regulation requires telecommunications service providers licensed by CITC to include, in contracts with other telecommunications service providers and with senders of electronic messages (e.g. Bulk SMS service providers), clear conditions conforming to the Regulation. These conditions include the need to set out the possible consequences of non-compliance, such as the possibility of the suspension or cancellation of services. In this context, the Regulation appears to apply directly to telecommunications service providers licensed in Saudi Arabia; and indirectly to their customers/clients by way of the applicable service terms. (This provides some colour to the statement in the Regulation that the Regulation applies to electronic messages sent within the Kingdom.)

Pursuant to the Regulation, senders of electronic messages are required to address a number of conditions aimed at reducing the nuisance value of unsolicited messages. These include the following requirements:

• including a contact electronic address in the electronic message;
• providing a convenient mechanism for recipients to unsubscribe; and
• acting upon unsubscribe requests within less than 24 hours.

Senders are prohibited from sending SPAM messages. Additionally, senders are prohibited from sending ‘Flash SMS’ messages, which appear directly on a recipient’s screen without any interaction. Senders are also prohibited from sending electronic messages using electronic addresses gathered by automated means – address harvesting and dictionary attack type methods.

Classification of Message Types

The Regulation is somewhat prescriptive in terms of the steps that must be taken in respect of promotional messages, and other types of messages. Telecoms service providers must ensure that electronic messages are classified using the following classifications:

• Awareness messages: electronic messages with awareness or guidance content sent to all users (or specific categories of users) by entities such as government agencies, banks, hospitals, universities, schools, associations and others.
• Personal messages: electronic messages from a specified user number to another specified user number.
• Promotional messages: electronic messages of a commercial or marketing nature for products or services or in respect of donations.
• Service messages: electronic messages with service content, sent to a specific user for the purpose of providing a contracted service, or to provide information on operational aspects of that service, its features and options. (This would include electronic messages relating to appointments, or for identity authentication, or to provide access to sites or software, at the request or with the consent of the user.)
• Warning messages: Urgent electronic messages sent by responsible government authorities to warn of an imminent event or to alert users to an event that has already occurred.

Telecommunications service providers are required to filter promotional messages, but not awareness messages, personal messages, service messages or warning messages. Awareness messages, personal messages, service messages and warning messages should not contain any commercial or marketing content, including in respect of donations.

For the purposes of managing electronic messages, message service providers are required to maintain a list of names of senders, to be approved by the telecommunications service provider with whom they contract. All awareness messages, promotional messages, service messages and warning messages should be sent in the names of approved senders. Telecommunications service providers are required to maintain records of such senders, including information on responsible contact people, and to make such information available to the CITC upon request.
Promotional messages must be sent through their own unique short codes (although not all promotional messages will be in SMS format), and need to be marked to indicate that they are promotional in nature. Telecommunications service providers are required to provide users with filtering functionality that will enable them to avoid receiving promotional messages in general, or from specific senders.

So What?

For telecommunications service providers, the Regulation clearly sets out the mechanisms that need to be implemented in order to ensure compliance. For consumers, the Regulation makes clear what they should expect in terms of the ability to opt out of marketing communications, partially or entirely. For corporate entities wishing to send promotional messages, care needs to be taken to ensure that such messages fall within the regulatory framework.

Bulk SMS Services

The CITC has a specific Type B Class Licence for the provision of Short Message Services, or ‘Bulk SMS Services’. This Type B Class Licence applies to message service providers who want to send short text, audio or video messages, for promotional or informational purposes. The special terms and conditions associated with the licence set out a number of requirements for Bulk SMS service providers, including the following:

• message service providers must comply with the Regulation for the Reduction of SPAM;
• message service providers must use message centres and telecommunications licensed in the Kingdom, and servers and data must be located in the Kingdom;
• pricing must be clear, so that users are aware of any changes before they use a service and incur costs. The service cannot be used as a means of collecting fees associated with other services;
• only licensed message service providers are permitted to provide the services, and they are not permitted to subcontract the services, nor are they (or their clients) permitted to resell messages to others;
• message service providers must coordinate with licensed telecommunications service providers before sending SMS messages to recipients located outside Saudi Arabia, and be prepared to bear the consequences of any resulting breach of obligations vis-a-vis international requirements; and
• message service providers may only send messages on behalf of clients engaged in regulated professions where such clients are licensed in Saudi Arabia and the relevant authorities have approved the sending of such messages.

Al Tamimi & Company’s Technology, Media & Telecommunications team regularly advises on telecommunications licensing and regulatory matters, including matters relating to unsolicited marketing communications. For further information please contact Nick O’Connell (n.oconnell@tamimi.com).