VPNs with servers in Qatar

Article 21 also requires technology data, traffic data and content information to be kept for 90 days, renewable on request, and providers to help collect electronic data when judicial authorities order it. Article 47 punishes a provider that breaches article 21 with a fine. Whether a VPN operator is a service provider within these duties is not established.

A provider must take the necessary steps to block internet links when the judicial authorities order it (art. 21(2)). The Law also penalises content itself. Setting up or running a website for a terrorist group, or promoting its thoughts, carries up to three years and a fine of up to QR500,000 (art. 5).

Producing or circulating child pornography carries up to five years and the same fine, and possessing it up to a year (art. 7).

Article 6 punishes setting up or running a website to publish false news threatening the safety and security of the State or its public order with up to three years and a fine of up to QR500,000; spreading such news for the same purpose carries up to a year.

Article 8 punishes, with up to three years and a fine of up to QR100,000, publishing through an information network news, photos or recordings on the sanctity of private or family life even if true, or insulting or slandering others. Article 9 covers threats and blackmail.

Identification runs through the provider. On the public prosecution’s order it must supply what it holds (arts 17, 18, 21), and the user information it keeps for a year includes the user’s identity, email or geographic address, telephone number and payment details held under the service arrangement (art. 1).

The Constitution declares human privacy inviolable and permits interference with private matters, family affairs, residence or correspondence only according to the provisions of law (art. 37). It makes the judicial power independent (art. 130) and states that judges are dominated by no power except the law and that no institution may interfere in the lawsuits or the process of justice (art. 131).

The Cybercrime Prevention Law lets the public prosecution order the prompt collection or recording of traffic data and content information whenever it deems this necessary for the investigations (art. 17). The order of the rows is the security score, and a server’s location is not a recommendation.