VPNs with servers in Bahrain

Law 60/2014 on information technology crimes lets the Public Prosecution order any person to preserve data, route data included, for up to 90 days, extendable by a court by a further 90 (article 12), and order a service provider to supply subscriber information but not route data or content (article 13). The law sets no general retention period. Whether a VPN operator is a “service provider” under article 1 is not established.

The Personal Data Protection Law (Law 30/2018) prohibits a controller from transferring personal data abroad except to countries on the Authority’s list, with its authorisation or in the cases article 13 lists, and does not apply to public-security processing by the security bodies (article 2).

Article 10 of Law 60/2014 punishes producing, distributing or making available pornographic content through an information technology system, with heavier penalties where children are the audience.

With a lower-court judge’s authorisation, the Public Prosecution may assign a person to obstruct the contents of an information technology system by which a crime has been committed, for up to 30 days at a time (article 18(1)(c)). Failing to comply with such orders is punishable by up to two years’ imprisonment (article 19).

Article 75 of the Telecommunications Law punishes, by a fine of up to BD 10,000 and without prejudice to stricter penalties, sending through a telecommunications network a message known to be false or misleading and offensive to public policy or morals, endangering third parties or harming a service. Article 23 of Law 60/2014 applies the penalty of any other law to a crime committed by an information technology system.

To identify an account, the Public Prosecution can demand subscriber information from a provider (article 13), and a lower-court judge can order route data disclosed (article 14).

Article 26 of the Constitution guarantees the confidentiality of postal, telephonic and electronic communication, allowing censorship or breach only in exigencies specified by law and under the procedures and guarantees it prescribes. Article 104 provides that no authority shall prevail over a judge’s judgment and that the law guarantees independence.

The order of the rows is the security score, and a server’s location is not a recommendation.