This issue of the Wasl newsletter features two legal papers and a podcast episode from Masaar. The first paper examines differences among the Personal Data Protection Law, its Executive Regulations, and the relevant center’s guidance on calculating the time limit for decisions on data protection licenses. It considers the effects of delays and implied refusals as the compliance period ends on 1 November 2026.
The second addresses defense safeguards in remote criminal proceedings, from lawyers’ ability to raise objections and consult their clients to the review of hearing records produced by digital tools. In ‘From the Masaar Archives’, we revisit two publications concerning the offense of operating a website without a license.
The Connect podcast episode examines the problem of phone lines registered in the names of people who did not consent to their registration, and the extent to which facial verification can address it.
In our regional selections, a study by 7amleh traces the interception and algorithmic analysis of voice communications in Palestine. Another study, examining posts in Levantine Arabic dialects, finds that platform classifications may miss patterns of gender-based violence. A study by INSM in Iraq examines the targeting of a woman activist through defamation and violations of privacy, and the associated threat to women’s participation in public affairs. This issue also features SMEX’s report on the effects of fear and persecution on the work of human rights organizations in Egypt, Iraq and Tunisia.
Masaar Publications
As the Compliance Deadline Nears: Uncertainty Over the 90-Day Limit for Data Protection Licensing Decisions
Masaar’s paper examines conflicting deadlines for personal data processing licenses in Egypt, where the compliance grace period ended on November 1, 2026. Article 27 of the Personal Data Protection Law (No. 151 of 2020) requires the Personal Data Protection Center to decide within 90 days of the completion of the required documentation, and failure to do so by the deadline will be treated as a rejection. Article 36 of the Executive Regulations instead specifies “90 working days,” extending the wait by excluding holidays. The Center’s guidance also starts the clock when an application is received, rather than when its documentation is complete. These differences leave applicants uncertain about when a decision is due and when they can challenge a deemed rejection.
Without a published procedure for documenting when an application is complete, the statutory period may start late, while additional document requests can create uncertainty over when it ends. Masaar recommends aligning the regulations and guidance with the law, clarifying procedures for receiving applications and for notifying applicants of missing documents, and requiring explicit, reasoned decisions that are subject to administrative and judicial review. These safeguards aim to prevent applicants from bearing the consequences of administrative delays while preserving substantive review of protections for data subjects before licenses are granted.
Lawyer Training and Defense Safeguards in Remote Criminal Proceedings
Masaar’s paper examines whether training judges and lawyers for remote criminal proceedings adequately addresses defense rights. Egypt’s Ministry of Justice has announced training on electronic attendance, document submission, and AI-powered transcription. However, the announced topics focus on system operation and offer limited clarity on how lawyers can exercise their rights. Joining a hearing online does not ensure that lawyers can request to speak, consult clients confidentially, or record objections when connection failures disrupt testimony or the presentation of evidence.
The paper draws on the Egyptian Constitution’s fair trial safeguards and Article 14 of the International Covenant on Civil and Political Rights. It calls for rules allowing procedural steps to be suspended or repeated when technical failures affect defense rights, with those failures documented in the hearing record. It also recommends safeguarding lawyer-client consultations and reviewing and correcting automated transcripts before approval.
New on “CONNECT” Podcast (Arabic Audio)
Episode 23 | A Phone Line in Your Name Without Your Knowledge… Is Facial Verification the Answer?
The episode examines mobile lines registered in people’s names without consent and whether facial and fingerprint verification is an appropriate response. It distinguishes identity verification from proof of consent and explores alternatives that rely on stronger controls over companies’ registration practices, notifications when new lines are registered, and mechanisms for users to challenge registrations and correct their records.
Listen on Apple Podcasts | Spotify
From the Masaar Archives
In this section, we revisit earlier Masaar publications whose subjects relate to current issues and developments.
Powers and Oversight in the Digital Space: The Crime of Operating a Website without a License and the Authority of the Supreme Council for Media Regulation | August 2025
Drawing on Egypt’s 2014 Constitution, the 2018 Press and Media Regulation Law, and court rulings, this paper examines when operating an unlicensed website constitutes an offense. It considers the limits of the Council’s authority, the distinction between licensing requirements and content oversight, and the ambiguity surrounding the establishment and operation of websites. It also examines the requirement that a website be operated from within Egypt and how to identify the person criminally responsible.
The paper assesses the proportionality of fines of EGP 1–3 million, closure, and equipment confiscation. It outlines constitutional concerns about vague provisions and the prescribed penalties, and examines how enforcement affects press freedom, freedom of expression, and safeguards for defendants.
Memorandum on the Unconstitutionality of the Crime of Operating an Unlicensed Website | August 2025
The Press and Media Regulation Law prescribes fines of EGP 1–3 million, closure, and confiscation of equipment for establishing or operating an unlicensed website. Masaar’s memorandum sets out grounds for challenging Articles 6 and 105 of Law No. 180 of 2018 and explains the procedures for bringing a constitutional challenge.
It examines how closure and confiscation conflict with constitutional prohibitions and affect workers’ and owners’ rights to work and property. It also considers unclear distinctions between establishing, creating, and operating a website, particularly when a site must already exist technically before a license application can be submitted.
From the Arab Region
7amleh | Captive Voices: Algorithmic Voice Surveillance in Palestine
The study traces how Palestinians’ voice communications are collected and analyzed within Israel’s surveillance system. It covers telephone and internet calls, voice messages, and related data on participants, timing, devices, and locations. It follows the data from interception and storage through transcription, translation, speaker identification, and integration with other information sources. It also examines cloud storage and the roles of Israeli military intelligence Unit 8200 and infrastructure and technology providers.
Drawing on reports, investigations, testimony, and published material, the study reconstructs the system from available evidence while acknowledging the limits imposed by operational secrecy. It does not claim to document every surveillance incident or possible commercial relationship. It highlights privacy violations and the risk that information about speakers’ family and political ties and sources could be exposed and linked for intelligence use.
SMEX | Fear as a Form of Governance: Digital Rights Under Pressure in Egypt, Iraq, and Tunisia
Drawing on interviews and correspondence with 20 journalists, lawyers, researchers, digital rights specialists, and civil society representatives, alongside a review of laws and policies, SMEX examines digital repression in Egypt, Iraq, and Tunisia. It highlights overlapping telecommunications, media, security, and legal powers in Egypt, increasing prosecutions under Decree-Law 54 in Tunisia, and multiple centers of power in Iraq. The report shows how vague concepts, including public security, family values, and foreign interference, enable punishment for online activities whose legal boundaries were unclear in advance.
Participants describe smear campaigns’ effects on organizational resources, credibility, and staff mental health. The report finds that digital security is often treated as a one-time training exercise and recommends integrating it into daily management. It calls for long-term support for institutional infrastructure, cooperation networks, and mental health, alongside the reform of laws used against peaceful expression and platform investment in local-language and dialect expertise. These measures aim to sustain organizations’ work without relying solely on individuals’ ability to withstand pressure.
More From the Arab Region
SMEX | Comments on Lebanon’s National Artificial Intelligence Strategy 2032
Access Now | Internet Shutdowns during Exams: Declines in Some Countries, Continued Restrictions in Others
INSM | Privacy Lost and Honor Imposed – Zainab Jawad in the Crosshairs of Digital Violence (Case Study)