Mechanism for Requesting a Legal Opinion

Introduction

This Mechanism sets out the controls and procedures for submitting a request for a legal opinion on disputes arising from the application of the Data Sharing Policy, the General Rules for Secondary Use of Data, the rules governing Collaborative Data Labs, and the Data Monetization Policy. It also establishes criteria for reviewing legal opinion requests, including criteria for identifying the Data Source Entity, thereby contributing to the achievement of the objectives for which those documents were issued.

Article 1: Definitions

The following terms and expressions, wherever used in this document, shall have the meanings assigned to them below, unless the context requires otherwise:

1. Mechanism: The mechanism for requesting a legal opinion.

2. Office: The National Data Management Office (NDMO).
3. Entity: Any entity within the scope of the documents referred to in Article (3) of this document.

Article 2: Scope and Purpose

This Mechanism applies to all entities governed by the Data Sharing Policy, the General Rules for Secondary Use of Data, the rules governing Collaborative Data Labs, and the Data Monetization Policy. It aims to:

1. Enhance the quality of reviews of legal opinion requests concerning the matters specified in this Mechanism.

2. Establish the controls and procedures governing requests for legal opinions from the Office.

Article 3: Types of Legal Opinion Requests

A request for a legal opinion from the Office may concern any of the following:

a. Rejected data-sharing requests.

b. Disputes arising from the application of the Data Sharing Controls, a Data Sharing Agreement, or a Data Use License, as applicable.

c. Disputes concerning the identification of the Data Source Entity.

d. Rejected requests for authorization to share data.

e. Any other dispute arising from the application of the Data Sharing Policy.

f. Any other dispute arising from the application of the General Rules for Secondary Use of Data.

g. Rejection by the Saudi Data & AI Authority (SDAIA) of a request to access the Collaborative Data Labs.

h. Rejection by the Data Source Entity of a request to access the Collaborative Data Labs.

i. Any other dispute arising from the application of the rules governing Collaborative Data Labs.

j. Disputes arising from the application of the Data Monetization Policy.

Article 4: Submission of Requests to the Office

An Entity shall submit its request to the Office concerning any matter listed in Article (3) of this Mechanism through the National Data Governance Platform. The request shall include the documents and information specified in Article (5) of this Mechanism.

Article 5: Obligations of the Requesting Entity's Data Office

1. If the legal opinion request concerns Paragraph (a) of Article (3) of this Mechanism, the Entity shall provide the following details:

   1. Identify the parties to the data-sharing process.

   2. Specify how the data-sharing request was submitted, including the request number on the Data Marketplace platform if the request was submitted through the platform.

   3. Describe the data content.
   4. State the purpose of the data-sharing request.
   5. Attach the documents relevant to the matter.
   6. Any other requirement the Office deems necessary.
2. If the legal opinion request concerns Paragraph (b) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Identify the parties to the data-sharing process.
   2. Specify how the data-sharing request was submitted, including the request number on the Data Marketplace platform if the request was submitted through the platform.
   3. Describe the requested data content.
   4. State the purpose of the data-sharing request.
   5. Attach the documents relevant to the matter.
   6. Any other requirements specified by the Office.
3. If the legal opinion request concerns Paragraph (c) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Identify the parties to the dispute.
   2. Identify the data field or set of data fields.
   3. Identify the statutory instrument or international agreement that assigns the Entity responsibility for the data field or set of data fields; describe the Entity's activities and operations through which the data was generated within the remit conferred on it by its governing law or regulation; or provide any other grounds for the request.
   4. Attach the documents relevant to the matter.
   5. Any other requirements specified by the Office.
4. If the legal opinion request concerns Paragraph (d) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Identify the data field or set of data fields.
   2. Identify the Data Source Entity for the data field or set of data fields.
   3. Specify how the request for authorization to share data was submitted, including the request number on the National Data Catalog platform if the request was submitted through the platform.
   4. Attach the documents relevant to the matter.
   5. Any other requirements specified by the Office.
5. If the legal opinion request concerns Paragraph (e) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Identify the parties to the data-sharing process.
   2. Specify how the data-sharing request was submitted, including the request number on the Data Marketplace platform if the request was submitted through the platform.
   3. Describe the requested data content.
   4. State the purpose of the data-sharing request.
   5. Attach the documents relevant to the matter.
   6. Any other requirements specified by the Office.
6. If the legal opinion request concerns Paragraph (f) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Identify the parties to the data-sharing process.
   2. Specify how the data-sharing request was submitted, including the request number on the Data Marketplace platform if the request was submitted through the platform.
   3. Describe the requested data content.
   4. State the purpose of the data-sharing request.
   5. Attach the documents relevant to the matter.
   6. Any other requirements specified by the Office.
7. If the legal opinion request concerns Paragraph (g) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Specify how the data access request was submitted.
   2. Identify the datasets intended to be used for analysis.
   3. State the purpose of the data access request.
   4. Attach the documents relevant to the matter.
   5. Any other requirements specified by the Office.
8. If the legal opinion request concerns Paragraph (h) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Specify how the data access request was submitted.
   2. Identify the datasets intended to be used for analysis.
   3. State the purpose of the data access request.
   4. Attach the documents relevant to the matter.
   5. Any other requirements specified by the Office.
9. If the legal opinion request concerns Paragraph (i) of Article (3) of this Mechanism, the Entity shall provide the following details:
   1. Specify how the data access request was submitted.
   2. Identify the datasets intended to be used for analysis.
   3. State the purpose of the data access request.
   4. Attach the documents relevant to the matter.
   5. Any other requirements specified by the Office.
10. If the legal opinion request concerns Paragraph (j) of Article (3) of this Mechanism, the Entity shall provide the following details:
    1. Identify the parties to the dispute.
    2. Attach the documents relevant to the matter.
    3. Any other requirements specified by the Office.
11. The Entity's Data Office shall provide the Office with any information or clarifications in the required format and within the timeframe specified by the Office.
12. If the requesting Entity fails to satisfy the requirements of this Article, the Office may close the request after notifying the Entity of the outstanding requirements and allowing it five (5) business days to satisfy them. The Office shall notify the requesting Entity that the request has been closed. The requesting Entity may submit a new request in accordance with the procedures set out in this Mechanism.

Article 6: Review of Requests and Outcomes

1. After verifying that the requesting Entity has satisfied the requirements of Article (4) of this Mechanism, the Office shall review the request in accordance with the criteria set out in Paragraph (3) of this Article and decide on it within thirty (30) days. The Office may meet with any or all parties or extend the review period if necessary.

2. If a meeting is held with the relevant parties, the Office shall prepare minutes setting out its legal opinion on the request.

3. The Office shall initially base its review of the request on the following criteria:
   1. The request must concern a matter stipulated in Article (3) of this Mechanism.
   2. The data-sharing procedures that are the subject of the request must have been completed in accordance with the controls and procedures stipulated in the Data Sharing Policy, the General Rules for Secondary Use of Data, or the rules governing Collaborative Data Labs.
   3. The request must not have been previously decided.
   4. No more than thirty (30) business days may have elapsed since the dispute arose; however, the Office may consider disputes that exceed this period where circumstances so require.
4. Subject to Paragraph (3) of this Article, if the legal opinion request concerns Paragraph (c) of Article (3) of this Mechanism, the Data Source Entity shall be identified in accordance with the following criteria:
   1. Legal instruments or international agreements that expressly assign the Entity responsibility for the data in dispute.
   2. If the criterion specified in Subparagraph (a) of this Paragraph does not apply, consideration shall be given to whether the data fields in dispute resulted from the Entity's operations and activities assigned to it under its governing laws or regulations. However, if those fields, or any part of them, resulted from another entity's operations and activities in the exercise of its mandate, that other entity shall be the relevant entity for those fields in that context only, and not in any other context at the national level.
   3. If neither criterion specified in Subparagraphs (a) and (b) of this Paragraph applies, the Office shall review the request and propose appropriate grounds. These may include, without limitation and as applicable, the originator of the data, the extent to which the Entity is uniquely positioned to collect the data, and the frequency with which the data is shared with other entities.
5. If a party to the data-sharing process fails to implement the legal opinion issued by the Office, either party may notify the Office, which may take the necessary legal and regulatory measures, as applicable.