VPNs with servers in Oman

Its final chapter covers the liability of legal entities. A company is liable where an offence is committed in its name or for its account by its chairman, a board member, its manager or another officer acting in that capacity, and is fined twice the maximum fine for the offence (article 57).

The Personal Data Protection Law (Royal Decree 6/2022) does not apply to processing for national security or the public interest, to processing a legal obligation requires, or to processing to detect or prevent a crime on a formal written request of the investigating entities (art. 3). The Cybercrime Law sets no period for keeping user data. Whether any of this reaches a VPN operator is not established.

The sixth chapter of the Cybercrime Law lists content offences: crimes against the State, offences affecting families and society, gambling, pornographic material, insult and defamation, and infringement of intellectual property. Article 34 punishes producing or spreading the principles of a terrorist organisation, and the heavier penalty of article 20 applies where content is meant to incite sedition, hatred, racism or sectarianism.

On conviction the court may order confiscation of the devices, tools and programs used and of the proceeds, and the closure, temporary or permanent, of the information system, website or premises where the offence was committed (article 60).

Article 20 punishes using a website, information system or device to produce, store, send or publish anything that disturbs public order or morals, or rumours and misleading information, with one month to three years’ imprisonment and a fine of RO 1,000 to 3,000, or either. Where the intent is to stir up sedition, hatred, racism, sectarianism or division, or self-harm, the penalty is three to ten years and RO 5,000 to 10,000.

Article 23 punishes false or malicious news or inflammatory propaganda meant to harm the reputation or prestige of the State or its authorities, or to affect its security, social or health stability, with three months to three years and RO 2,000 to 5,000. Article 27, on publicly undermining the respect due to the judiciary so as to cast doubt on its integrity, carries one to three years and RO 1,000 to 3,000, or either.

Article 32 punishes challenging the Sultan’s rights and authority or insulting him, and insulting his wife, heir or children, with three to ten years and RO 3,000 to 5,000. Article 21 punishes inciting or calling for gatherings, strikes, sit-ins or marches outside the licensed cases with three months to one year and RO 1,000 to 3,000.

The Basic Statute (Royal Decree 6/2021) makes electronic correspondence of all kinds inviolable: monitoring, inspecting, accessing or disclosing it is permitted only in cases the law prescribes and by the procedures it specifies (art. 36).

It declares the judicial authority independent (art. 77) and judges irremovable except in cases the law specifies (art. 78), while the Sultan appoints and relieves senior judges (art. 49). The order of the rows is the security score, and a server’s location is not a recommendation.