| Article/Section of the Law | Issue/Gap |
| Article 1 | The existing e-commerce law is heavily criticized for having an open definition of a consumer, impeding the ability to initiate and win claims. According to the new law, a consumer is any natural person seeking to acquire a product or service to satisfy personal, family or household needs. Consumers can be businesses or organizations within KSA. |
| Article 1 Article 3 Article 1 Article 3 Article 5 | Saudi Arabia does not have comprehensive enforcement mechanisms because the e-commerce economy is still in its infancy. The law does not specifically state the competent authority for the enforcement of the law. The new law introduces some statutes and regulations to govern data protection, but the Kingdom still does not have a distinct and comprehensive guidance framework. The e-commerce law does not differentiate B2B and B2C, leaving room for an open definition of a consumer as a legal entity or natural person. A narrow definition of data controllers. It is equally unclear if the data processor works on data for its benefit or on behalf of the data controller. The law has to clarify whether data controllers and processors are public entities, such as security intelligence. Unlike the GDPR, the new law does not cover or regulate all parties that can engage in e-commerce transactions in the Kingdom. practitioners not registered in the KSA have room to circumnavigate consumer protection because there are no provisions for determining their addresses. The regulations cover service providers that have a domicile or place of residence within the Kingdom. GDPR covers both domestic and foreign service providers operating in Europe. Equally covers a gap that data controllers are taking advantage in covering e-retailer storage and use of consumer data after a financial transaction. Also unlike the GDPR, there is a gap as M/126 does not specify the maximum period a service provider can retain personal information following the termination of a transaction. A critical analysis of the GDPR extends the argument further to show there is no clear information on how Saudi law deals with third parties that disclose personal data without consumer consent. |
| Section 1 Article 7, Article 8 | There is inadequate enforcement of informed consent. The e-commerce law does not specify the conditions in which direct consent is required for the use of consumer personal data. Another gap, is as of now, “Legitimate interest” is not included as lawful basis for processing activities by the controller. (general provisions for consumer rights. The e-commerce law does not recognise contracts executed with data subjects as a legal basis for processing. As a result, personal information can be processed without consent where the data controller is a public entity. This is a violation because it is not clear if the information is used for security purposes only. |
| Article 12, 13 Article 13 | Delayed implementation and enforcement benefiting retailers at the expense of consumers. Merchants have a lot of leeway in how they respond to consumer requests or complaints concerning personal data. According to the e-commerce law, response times to such requests will be specified in the Implementing Regulations and additional rights may be included in the Implementing Regulations. The e-commerce law does not specify the types of products and services exempted from contractual cancellation as a form of consumer protection. The traditional commerce law for brick and mortar transactions does not allow terminations or rejections for all types of products and services. (later studies highlight that pricing protection only applies to products related to health and safety. The government emphasizes such products because Saudi Arabia is a welfare state) Unlike the GDPR, the Saudi e-commerce law is not clear on the period for making corrections to an online contract, making it hard to make claims against retailers. |
| Article 18, 19 | Consumer redress: consumers have insufficient trust and confidence in KSA’s e-commerce market due to the lack of a comprehensive online dispute resolution framework. KSA’s online arbitration model does not conform to Western models, hindering business between foreigners and residents. KSA online dispute resolution uses common law, originating from the Middle Ages. The law provides a jurisdictional perspective that might not suit modern practice. |
| Article 20, 22 | Foreigners would be cautious doing business in the Kingdom because disputes will result in a disadvantaged position. There is no specific mention on accountable judicial courts for online dispute resolution. |
| Other Identified Issues | |
| Online dispute resolution (ODR) | Supervision of ODR bodies: The lack of brick and mortar locations where disputing parties meet face to face is highlighted as a reason behind the legitimacy concerns over the ODR bodies. A lack of awareness and perceived legitimacy affect the adoption of online dispute resolution in Saudi Arabia. |
| The e-commerce law does not specifically mention the appointment of Data Protection Officers. Only data controllers are required to appoint a DPO. The role is essential in controlling private entities and their use of personal consumer data. | |
| Online dispute resolution (ODR) | Unlike Europe’s UNCITRAL model, KSA lacks effective arbitration laws for online transactions. The current Saudi arbitration system, based on Sharia law, is slightly archaic and embodies protectionist principles. Sharia does not tailor conventional arbitration to electronic transactions. |
| Incompatibility of KSA’s delivery system with global online commerce. | Makki and Chang’s article highlights the problem of Saudi delivery systems using P.O. boxes instead of on-street addresses[1]. The structure of the delivery systems affects the promotion and distribution of services, such as Pizza. The main way for people to receive their items is through drivers and landmarks. The government tried to introduce a new delivery system called ‘Wasel’ in 2005, but there has been a slow uptake of the services because locals have to request and apply first |
[1] Id.