How UAE cold callers snare private data for sale to the highest bidder

Regulations come into effect on August 27 to protect the public against rogue telemarketers

The tightened protocols from the Ministry of Economy and Telecommunications and Digital Government Regulatory Authority apply to all licensed companies in the Emirates, including free zones. Photo: GeShow more

Tough UAE telemarketing rules being introduced this month aim to offer respite to residents on the receiving end of nuisance cold calls.

Regulations from the Ministry of Economy and the Telecommunications and Digital Government Regulatory Authority come into force on August 27 and target a practice common across the UAE.

Unwanted callers often obtain a person's contact details by buying customer data from third-party providers, said Alasdair Hall-Jones, global director of The Marketing Society.

“These data brokers collect information from a variety of sources, including online forms, public records and even social media platforms,” Mr Hall-Jones told The National.

“While regulations like the General Data Protection Regulation in Europe have made it significantly harder for such data to be bought and sold, other regions, such as the GCC, lack regulatory frameworks.”

The absence of such regulations creates an environment where the buying and selling of personal data is more prevalent, making it easier to access sensitive information.

How is data obtained?

A person’s data is often recorded when they buy or rent a property, one agent who sources data for clients, told The National.

In Dubai, the agent said, there are about 1,600 Excel sheets for all areas, with each sheet including anywhere between 5,000 to 50,000 rows of data.

“The latest data for property owners and high-net-worth individuals ranges from Dh3,000 to Dh8,000, although you’ll see widely exaggerated numbers like $5,000 upwards. Those are just tactics to root out time wasters.”

Since the UAE’s new rules were announced in June, those involved in selling and buying data have reported a decrease in activity, even though they have yet to go into effect.

“You see less people selling and even fewer people buying,” the agent said. "There has been a noticeable dip.”

What are the new rules?

The tightened protocols from the Ministry of Economy and TRA apply to all licensed companies in the Emirates, including free zones.

They include guidelines such as: telemarketing calls can only be made from 9am until 6pm; companies must obtain prior approval from authorities to carry out telemarketing calls; companies are barred from calling back the customer if they reject the service of products in the initial conversation; telemarketers cannot make a call on the same day if the consumer has declined or ended the call; and marketing calls can be made only from phone numbers registered under the name of licensed companies.

Customers can also file a complaint with authorities if these rules are breached.

Penalties include warnings, fines of up to Dh150,000, partial or total suspension of activity, cancellation of the licence and telecommunication services being blocked for up to one year.

A government-wide effort

These new regulations follow long-term government efforts to protect the rights of the public and ensure companies abide by the rules.

In 2011, the UAE's Central Bank banned cold calling. This prevented banks and finance companies from offering loans and services to people who had not sought out their business.

In November 2021, the UAE issued Federal Law No. 45 of 2021 (the UAE Data Protection Law), a GDPR-style law that set stricter standards for data privacy and protection, including requiring organisations to be transparent about what personal data they are capturing and how it's going to be used.

In January 2022, the TRA launched a service called Kashif, which shows all mobile phone users where a call originates from.

In September 2022, the Do Not Call Registry feature was launched to stop unwanted calls as all telemarketers are not allowed to make calls to numbers listed in the directory unless they have the customer’s prior consent.

An effective strategy?

Research has shown cold calling and spam marketing to be highly ineffective, yet the practice remains widespread, “particularly where the work culture prioritises activity over results”, said Mr Hall-Jones.

“In these environments, the act of making calls is often viewed as a sign of productivity, regardless of the outcome. This ‘box-ticking’ mentality allows management to demonstrate that efforts are being made, even if those efforts do not translate into meaningful business growth.”

It’s a particularly common practice in the real estate market, whether it’s agents calling about properties on behalf of clients or secondary maintenance companies looking for new work.

The property industry has been cracking down on this practice for some time, although there is still a long way to go, said Claire George, director of marketing and communications at real estate agency haus & haus.

“The practice of cold calling may be more common in smaller or less mature companies that may not have the resources or the marketing capability to do more strategic targeted marketing that uses their own client data more effectively to better meet their needs,” Ms George told The National.

“It is essential for companies to be thinking smarter about how they collect data in legitimate ways and then use that data to engage with potential clients in a way that adds value.”

How to protect your data

While it can be difficult for the public to protect themselves from having their data shared, there are some steps you can take, said Ms George.

For example, when you fill out a form or provide your details at a business, whether a store, hotel or restaurant, make sure you understand where your information is going and what it's being used for.

“You may find in the ‘fine print’ that it says your information may be shared with other companies, so if this is the case, ask to be removed or ‘opt-out’ if possible,” she said.

“If you receive an unwanted phone call, ask where they got your details from, to see if you can identify the source. Any legitimate company should be able to provide this information for you and update their database to reflect your desires.”

The introduction of fines and restrictions across the UAE is a positive step towards curbing the excessive use of the practice, said Mr Hall-Jones.

“By limiting the frequency of calls – such as only allowing one call per day or a maximum of two calls per week – these measures aim to reduce the intrusive nature of the practice,” he said.

It may not be enough to achieve a sustainable outcome, however, he added.

“To fully address the issue, future regulations may need to expand to cover other forms of communication, such as email, text messaging and WhatsApp, which are increasingly being used for unsolicited marketing,” he said.