Federal Decree-Law No. (34) of 2021 on Combating Rumors and Cybercrimes

Legal Definitions

Federal Decree-Law No. (34) of 2021 was promulgated upon reviewing the Constitution and relevant federal laws, and based on the proposal of the Minister of Justice and the approval of the Cabinet.

Article (1) - Definitions

Article 1 sets out the legal meanings of terms and expressions used in applying the decree-law, including:

• The State: The United Arab Emirates.

• State Institutions: Any federal or local government entity, or company/establishment in which such entities own not less than 25% of the capital.

• Competent Entities: Federal or local entities concerned with electronic and cybersecurity affairs in the State.

• Information Technology: All forms of technology used to create, process, store, exchange, and use electronic information systems, software, websites, information networks, and any IT tools.

• Cyber: Everything relating to computer information networks, the Internet, software programs, and all executed services.

• Data or Information: Structured or unstructured sets of data, facts, concepts, instructions, observations, or measurements in the form of numbers, letters, words, symbols, images, videos, signals, sounds, maps, or any other form.

• Government Data and Information: Electronic data or information not available to the public, belonging or relating to a State institution.

• Personal Data and Information: Data or information relating to natural persons that concerns their private life or identifies them directly or indirectly.

• Confidential Information and Data: Any information or data not authorized to be accessed or disclosed without prior permission from the authorized person.

• Traffic Data: IT data generated by an information system indicating communication source, destination, routing, time, date, size, duration, and type of service.

• Website: A virtual location or domain on the network enabling users to share, exchange, or publish content.

• Electronic Information System: A software program or set of programs designed to process, manage, or store electronic information to execute instructions.

• Illegal Content: Content constituting a legally punishable crime or likely to harm State security, sovereignty, public health, public peace, friendly relations with other states, election results, or inciting hatred and hostility.

• Fake Data: Rumors and false or misleading data, whether entirely or partially.

• Electronic Bot: An electronic program created or modified to execute automated tasks efficiently and swiftly.

• Hacking, Leaking, Interception, and Cyber Attacks: Unauthorized access, unauthorized data disclosure, unlawful surveillance/monitoring of communications, and deliberate targeting of systems to degrade or damage their functions.

Crimes Against Information Technology

Completion of Definitions

Article (1) further defines encryption, electronic media, digital evidence, service providers, the child (anyone under 18), child pornography, misleading advertising, data processing, and orders of correction, disablement, and access blocking.

Part One: Crimes and Penalties - Chapter One

• Article (2) - Electronic Hacking: Imprisonment and a fine between AED 100,000 and AED 300,000, or either, for unauthorized access to a website, system, or network. Aggravated to at least 6 months imprisonment and a fine between AED 150,000 and AED 500,000 if damage, deletion, modification, copying, or disclosure occurs, and at least 1 year imprisonment and a fine from AED 200,000 to AED 500,000 if done for an unlawful purpose.

• Article (3) - Hacking State Institutions Systems: Temporary imprisonment and a fine between AED 200,000 and AED 500,000. Aggravated to at least 5 years imprisonment and a fine between AED 250,000 and AED 1,500,000 if causing damage or if committed via a cyber attack, and at least 7 years if aimed at obtaining data.

• Article (4) - Damaging Information Systems: Imprisonment for at least 1 year and a fine between AED 500,000 and AED 3,000,000, or either, for intentionally damaging or disrupting systems. Aggravated to temporary imprisonment if targeting banking, media, health, or scientific entities, or if committed via a cyber attack.

• Article (5) - Damaging Systems of State Institutions and Vital Facilities: Temporary imprisonment and a fine between AED 500,000 and AED 3,000,000 for damaging State or vital facility systems, with cyber attacks acting as an aggravating circumstance.

• Article (6) - Assault on Personal Data: Imprisonment for at least 6 months and a fine between AED 20,000 and AED 100,000, or either, for unlawfully acquiring, modifying, deleting, or leaking personal electronic data.

Assault on Data, Payment Instruments, and Electronic Records

• Article (6, paras 2-3): Data involving medical records or banking/payment data acts as an aggravating circumstance. Retaining unlawfully acquired data is punishable by imprisonment and fine.

• Article (7) - Government Data Assault: Temporary imprisonment of at least 7 years and fine of AED 500,000 to AED 3,000,000 for acquiring or leaking confidential government data; reaching at least 10 years and fine up to AED 5,000,000 if causing State damage or breaching military/security systems.

• Article (8) - Financial and Commercial Data: Temporary imprisonment of at least 5 years and fine of AED 500,000 to AED 3,000,000 for unauthorized access or leakage of confidential commercial/financial data.

• Article (9) - Unauthorized Acquisition of Codes and Passwords: Imprisonment and fine of AED 50,000 to AED 100,000, aggravated to 6 months imprisonment and fine up to AED 500,000 if used to access systems to commit a crime.

• Article (10) - IP Address Spoofing/Circumvention: Temporary imprisonment and fine of AED 500,000 to AED 2,000,000, or either, for manipulating IP addresses to commit a crime or prevent detection.

• Article (11) - Fabrication of Fake Accounts and Websites: Imprisonment and fine of AED 50,000 to AED 200,000, reaching 2 years imprisonment if used defaming the victim, and up to 5 years imprisonment and fine up to AED 2,000,000 if impersonating a State institution.

• Article (12) - Unlawful Interception: Imprisonment and fine of AED 150,000 to AED 500,000, rising to 1 year and fine up to AED 1,000,000 upon disclosure, and temporary imprisonment if targeting State communications.

• Article (13) - Unlawful Processing of Personal Data: Imprisonment and fine of AED 50,000 to AED 500,000.

• Article (14) - Electronic Forgery: Temporary imprisonment and fine of AED 150,000 to AED 750,000 for forging government documents; imprisonment and fines apply to non-government records.

• Article (15) - Electronic Payment Crimes: Imprisonment and fine of AED 200,000 to AED 2,000,000 for forging, cloning, or unlawfully using payment/credit cards.

• Article (16) - Evidence Concealment and Encryption: Imprisonment for at least 2 years and fine of AED 200,000 to AED 1,000,000 for using tools or encryption to conceal cybercrimes.

Content Violations, Public Order, and State Security

• Article (17) - Website/Account Manager Crimes: Imprisonment of at least 1 year and fine between AED 300,000 and AED 500,000, or either, for operating an account/site to facilitate crimes.

• Article (18) - Tampering with Digital Evidence: Imprisonment of at least 6 months and fine of at least AED 200,000 for concealing or altering digital evidence to obstruct investigations.

• Article (19) - Non-compliance with Media Standards: Imprisonment up to 1 year and fine between AED 30,000 and AED 300,000, or either.

Chapter Two: Content Crimes - Section 1: Content Crimes

• Article (20) - Calling to Suspend Constitution and Laws: Life imprisonment for establishing/managing platforms promoting overthrowing the ruling system, changing the regime, or suspending the Constitution and laws.

• Article (21) - Promoting Terrorist Groups: Life imprisonment and fine between AED 2,000,000 and AED 4,000,000 for managing terrorist sites or sharing explosive-making methods. Downloading or sharing such hate-inciting content carries up to 5 years imprisonment and fine from AED 500,000 to AED 1,000,000, with court discretion to order rehabilitation or electronic monitoring for first-time offenders.

• Article (22) - Damaging State Interests: Temporary imprisonment for providing unauthorized confidential documents to entities to harm the State's standing.

• Article (23) - Incitement against State Security and Judicial Officers: Temporary imprisonment and fine up to AED 1,000,000.

• Article (24) - Inciting Strife and Harming National Unity: Temporary imprisonment and fine between AED 200,000 and AED 1,000,000 for promoting racial or sectarian discord.

• Article (25) - Mockery of the State and its Symbols: Imprisonment up to 5 years and fine up to AED 500,000 for defaming the State, founding leaders, flag, currency, or national anthem.

• Article (26) - Calling for Unauthorized Demonstrations: Imprisonment and fine of AED 200,000 to AED 1,000,000.

• Article (27) - Inciting Non-compliance with Laws: Imprisonment and fine of AED 100,000 to AED 500,000.

• Article (28) - Insulting a Foreign State: Imprisonment of at least 6 months and fine of AED 100,000 to AED 500,000 (prosecution initiated only by the UAE Attorney General).

• Article (29) - Trafficking in Firearms and Explosives: Imprisonment of at least 1 year and fine of AED 500,000 to AED 1,000,000.

Illicit Funds, Moral Offenses, and Prohibited Electronic Activities

• Article (30) - Unlawful Funds and Money Laundering: Imprisonment up to 10 years and fine between AED 100,000 and AED 5,000,000 for transferring, disguising, or using illicit funds via electronic networks.

• Article (31) - Trafficking and Promoting Narcotics: Temporary imprisonment and fine between AED 500,000 and AED 1,000,000 for managing platforms promoting drugs or facilitating their abuse.

• Article (32) - Human and Organ Trafficking: Temporary imprisonment and fine of AED 500,000 to AED 1,000,000.

• Article (33) - Inciting Prostitution and Debauchery: Temporary imprisonment and fine of AED 250,000 to AED 1,000,000, increasing to at least 5 years imprisonment if the victim is a child.

• Article (34) - Pornography and Public Morals: Imprisonment and fine of AED 250,000 to AED 500,000; imprisonment of at least 1 year if enticing children.

• Article (35) - Child Exploitation in Pornography: Imprisonment of at least 2 years and fine of AED 250,000 to AED 1,000,000, rising to temporary imprisonment if the child is the subject, with full criminal immunity for the child victim.

• Article (36) - Possession of Child Pornography: Imprisonment of at least 6 months and fine of AED 150,000 to AED 1,000,000 for intentional possession.

• Article (37) - Contempt of Religions: Imprisonment and fine of AED 250,000 to AED 1,000,000 for insulting religions or promoting sins, rising to temporary imprisonment up to 7 years for blasphemy against the Divine entity, Prophets, or challenging Islam.

• Article (38) - Promoting Gambling: Imprisonment and fine of AED 250,000 to AED 500,000.

• Article (39) - Illicit Antiquities Trade: Imprisonment and fine of AED 500,000 to AED 1,000,000.

• Article (40) - Electronic Fraud: Imprisonment of at least 1 year and fine of AED 250,000 to AED 1,000,000 for fraudulent appropriation of funds or impersonation.

• Article (41) - Unlicensed Fund Raising: Imprisonment up to 5 years and fine of AED 250,000 to AED 1,000,000 for creating fake investment schemes, with mandatory restitution of funds.

Privacy Protection, Commercial Integrity, and Rumors

• Article (42) - Extortion and Electronic Threats: Imprisonment up to 2 years and fine of AED 250,000 to AED 500,000; rising to temporary imprisonment up to 10 years if involving a felony threat or demands impacting honor.

• Article (43) - Online Defamation and Insult: Imprisonment and fine of AED 250,000 to AED 500,000, with targeting a public servant acting as an aggravating circumstance.

• Article (44) - Breach of Privacy: Imprisonment of at least 6 months and fine of AED 150,000 to AED 500,000 for eavesdropping, recording, publishing accident victims photos, or tracking geographical locations. Altering images/recordings for defamation carries at least 1 year imprisonment and fine of AED 250,000 to AED 500,000.

• Article (45) - Professional Secrets Disclosure: Imprisonment of at least 6 months and fine of AED 200,000 to AED 1,000,000, aggravated if used for personal gain.

• Article (46) - Unlicensed Donation Campaigns: Imprisonment and fine of AED 200,000 to AED 500,000.

• Article (47) - Unauthorized Polls and Surveys: Imprisonment and fine of AED 100,000 to AED 500,000; temporary imprisonment if intended to harm State interests.

• Article (48) - Misleading Advertising and Unlicensed Virtual Currencies: Imprisonment and fine of AED 20,000 to AED 500,000 for misleading promotions or dealing in unauthorized cryptocurrencies.

• Article (49) - Unlicensed Medical Products: Imprisonment and fine.

• Article (50) - Unauthorized Use of Broadcast/Telecom Services: Imprisonment of at least 1 year and fine of AED 250,000 to AED 1,000,000.

• Article (51) - Online Begging: Imprisonment up to 3 months and fine of at least AED 10,000, applying also to fraudulent aid requests to government bodies.

Section 2: Publication of Rumors and False News

• Article (52) - Disseminating Rumors and Fake News: Imprisonment of at least 1 year and fine of at least AED 100,000 for circulating false or misleading news harming public security or the economy; rising to at least 2 years imprisonment and AED 200,000 fine if inciting against authorities or committed during pandemics, crises, or emergencies.

Illegal Content, Measures, and Penalty Frameworks

• Article (53) - Failure to Remove Illegal Content: Fine between AED 300,000 and AED 10,000,000 for refusing or failing to remove unlawful content within specified deadlines.

• Article (54) - Electronic Bots for Fake Data: Imprisonment up to 2 years and fine between AED 100,000 and AED 1,000,000 for configuring bots to spread fake news, with aggravated penalties for multiple perpetrators.

• Article (55) - Accepting Bribes/Gifts for Publishing: Temporary imprisonment, fine up to AED 2,000,000, and confiscation of financial gains, applicable also to managers of abusive accounts and advertisers purchasing space thereon.

Chapter Three: Special Provisions on Penalties and Measures

• Article (56) - Confiscation: Mandatory confiscation of hardware, software, and proceeds, with data deletion, preserving good-faith third-party rights.

• Article (57) - Attempt in Misdemeanors: Punishable by half the penalty of the completed offense.

• Article (58) - Liability of Actual Managers of Legal Persons: The manager faces the prescribed penalties if aware of the crime, with corporate joint liability for fines and damages.

• Article (59) - Penal Measures: Includes electronic monitoring, IT bans, rehabilitation placement, and total/partial blocking or closure of offending websites.

• Article (60) - Aggravating Circumstances: Committing the crime during work duties, utilizing IT for other unlisted offenses, or acting on behalf of a foreign or terrorist entity.

• Article (61) - Exemption from Penalty: Judicial discretion to reduce or exempt penalties upon Attorney General request for offenders cooperating with authorities to disclose perpetrators.

• Article (62) - Orders for Correction, Disablement, and Blocking: Competent entities may issue orders to delete or block illegal content.

• Article (63) - Grievance and Judicial Appeal: Grievance filed within 3 working days (decided in 1 week); appealable to the Federal Court in the capital within 1 week, decided in chambers within 7 days by a final ruling.

Procedural, Jurisdictional, and Concluding Provisions

• Article (64) - Non-Exemption from Liability: Professional duty or lodging a grievance does not negate criminal liability for non-compliance with orders.

Part Two: Procedural and Final Provisions

• Article (65) - Probative Value of Digital Evidence: Digital evidence derived from devices, networks, or digital media holds the exact evidentiary weight of physical forensic evidence.

• Article (66) - Attorney General Authorities: Power to order IT restrictions/monitoring following reconciliation, and issuing blocking orders against sites threatening national security or economy.

• Article (67) - Criminal Settlement: Permissible in designated offenses (Articles 13, 19, 24, 25, 26, 27, 28, 47, 48, 49, 50, 51, 52, 53) upon paying prescribed fines (half minimum to half maximum before referral, or double minimum to two-thirds maximum after referral), extinguishing criminal action.

• Article (68) - Reconciliation with the Victim: Permissible in specific private complaint crimes (Articles 2/1, 6/1, 9/1, 11/1, 42/1, 43, 44, 45) under Criminal Procedure rules.

• Article (69) - Extraterritorial Jurisdiction: The law applies to crimes committed outside the State targeting State institutions, planned/funded within the UAE, threatening State security/interests/citizens, or if the offender is present in the State and not extradited.

• Article (70) - Judicial Police Officers: Designated staff authorized to detect and record cyber infractions.

• Article (71) - State Security Offenses: Specific key articles designated as offenses against State security.

• Articles (72-74) - Final Provisions: Primacy of severer penalties under the Penal Code, repeal of Federal Decree-Law No. (5) of 2012 on Combatting Cybercrimes, and enforcement starting 2 January 2022.

Conclusion of the Official Document

The official document of Federal Decree-Law No. (34) of 2021 concludes the legislative enactment issued by the President of the State at the Presidential Palace in Abu Dhabi on 13 Safar 1443 AH, corresponding to 20 September 2021, establishing its enforceable date and repealing conflicting prior legislation.