ABSTRACT

1 INTRODUCTION

1.1. Research Context and Significance

Artificial intelligence is a trending issue transforming multiple sectors, including healthcare, education, governance, and societal systems. Researchers increasingly recognise both the positive and negative impacts AI can have on human rights, particularly digital human rights.¹ The implementation of AI raises significant ethical and legal issues regarding privacy, fairness, and transparency. As AI technologies advance, specific legislation becomes necessary to ensure they respect individual rights in the digital world.

At the core of the current technological evolution centred on AI's transformative potential, growing concerns exist about its effects on human rights. The legal debate primarily addresses three fundamental issues: how these new technologies violate existing rights, create conflicts among established rights, and introduce entirely new legal questions for which no established rights framework yet exists. This complex intersection of technology and rights requires thoughtful consideration of equity, transparency, and accountability in AI governance frameworks.²

The Kingdom faces a distinctive opportunity to contribute to the global discourse on digital rights by articulating an approach that harmonises international norms with

Islamic ethical principles and local cultural values. Saudi Arabia's Vision 2030³ initiative explicitly recognises the transformative potential of digital technologies, but this transformation necessitates careful consideration of how rights frameworks must evolve in parallel. Vision 2030 aims to diversify the economy, rebalance the country's dependence on oil revenues, and develop new technologies. This has led to setting strategic objectives for the digitalisation of several sectors, including the application of artificial intelligence and data technologies in health and other sectors.⁴ However, as machine intelligence is increasingly implemented across governance activities and multiple aspects of life, there is a need to address human rights in the digital world. As a modernising country in the contemporary world, the KSA stands at the intersection of technology and human rights in the digital environment.

Unlike countries where digital rights discussions emerged gradually alongside technological development, K.S.A is engaging with these questions during an accelerated period of digital transformation, potentially allowing for more integrated approaches to rights protection within technological infrastructure.⁵

1.2. Research Problem and Gap

The governance of artificial intelligence at the international level has evolved rapidly, moving from early ethical principles to increasingly formalised regulatory approaches. The Asilomar AI Principles (2017)⁶and IEEE's "Ethically Aligned Design" initiative (2016-2019)⁷represented initial efforts from the research and engineering communities.⁸ More comprehensive intergovernmental frameworks emerged with the OECD Principles on AI (2019)⁹ and UNESCO's Recommendation on the Ethics of AI (2021),¹⁰ adopted by 193 countries.

International frameworks exist along a spectrum from voluntary principles to legally enforceable regulations. The OECD Principles and UNESCO Recommendation function as "soft law," shaping behaviour through normative expectations rather than formal sanctions.¹¹ The EU AI Act¹² establishes legally binding obligations with significant penalties for non-compliance.¹³ However, no universally accepted definition of digital human rights exists, and no binding treaty framework comprehensively addresses them.

Within this context, K.S.A presents a particularly compelling case: the Kingdom is undergoing accelerated digital transformation under Vision 2030 while integrating Islamic ethical principles into its legal system. Research examining how K.S.A's domestic framework aligns with, diverges from, or innovates upon international digital rights governance remains limited.

1.3. Research Objectives and Questions

This paper addresses the previously explained gap by critically examining K.S.A’s evolving legal framework on digital rights and AI governance in light of international standards. It is guided by the following research questions:

1. To what extent are digital human rights conceptually established within international legal discourse and scholarly literature?
2. How has Saudi Arabia integrated global digital human rights frameworks and principles into its domestic legislative and regulatory infrastructure?
3. What distinctive challenges and strategic opportunities characterise Saudi Arabia's approach to digital rights protection within the context of accelerating technological advancement?

1.4. Contribution and Structure

By answering these questions, this paper contributes to the growing body of literature on digital rights. It employs a comparative doctrinal analysis, focusing on statutory analysis, soft law examination, and jurisdictional analysis of the digital rights framework.¹⁴

The comparative doctrinal approach allows for positioning Saudi Arabia’s regulatory efforts within a broader international framework.

This paper is organised into five main sections. Section 2 develops the conceptual foundation by examining how digital human rights are defined in international scholarship and identifying five core categories: privacy, internet access, data protection, anonymity, and the right to be forgotten. Section 3 situates these concepts within the MENA regional context, examining how Islamic legal and ethical principles interact with emerging digital governance frameworks. Section 4 analyses international AI governance approaches, contrasting the EU's binding regulatory model with UNESCO and OECD soft-law frameworks to establish comparative benchmarks. Section 5 evaluates Saudi Arabia's legal framework—primarily the PDPL and Anti-Cybercrime Law—against these international standards, identifying both achievements and regulatory gaps. The paper concludes with targeted recommendations for legal reform that balance international alignment with cultural distinctiveness.

It highlights Saudi Arabia’s progress in AI regulation through a systematic analysis of existing legal instruments, such as the Personal Data Protection Law (PDPL) and the Saudi Data and Artificial Intelligence Authority (SDAIA) Ethical Guidelines. It helps to analyse their compliance with international standards and their ability to respond to new digital human rights issues in the era of AI. More broadly, the study underscores how cultural and religious values, particularly Islamic ethical principles, can inform distinctive approaches to digital rights governance in non-Western contexts. 2 LITERATURE REVIEW AND CONCEPTUALIZING DIGITAL HUMAN RIGHTS

2 LITERATURE REVIEW AND CONCEPTUALIZING DIGITAL HUMAN RIGHTS

2.1. Overview and Rationale

This section reviews the evolving concept of digital human rights, surveys the main categories identified in the literature, and examines international and regional governance

approaches. The review highlights definitional debates, recurring principles, and regulatory models. It underscores the role of cultural and religious values, specifically Islamic ethical principles, in shaping non-Western approaches to digital rights governance.

2.2. Defining Digital Human Rights

The concept of digital human rights remains relatively new and emerging, unlike conventional human rights vested under International Human Rights frameworks such as the Universal Declaration of Human Rights (UDHR) and the International Covenant on Civil and Political Rights (ICCPR).¹⁵ It was only during the early 2000s that international recognition of this category of rights began to emerge, with the World Summit on the Information Society (2003, 2005) marking a significant milestone in their institutional recognition.¹⁶

The digital human rights framework has evolved as an extension of traditional human rights frameworks, adapted to address the unique challenges posed by technological advancement. Digital rights are generally understood as human and legal rights that allow individuals to access, use, create, and publish digital content on devices such as computers and mobile phones, as well as in virtual spaces and communities.

The academic discussion reveals a significant question: do effective digital rights protections require entirely new frameworks, or can they be achieved by extending existing approaches? The answer to this issue remains challenging, since there is no agreement on a definition of digital human rights. While some scholars, such as Pangrazio and Sefton-Green,¹⁷ define digital rights as merely a contextual expression of established rights, particularly freedom of expression and the right to privacy.¹⁸ Others consider them a distinct category of rights,¹⁹ particularly as new technologies like AI present issues not foreseen in traditional frameworks; thus, human rights are facing novel challenges that require new protection mechanisms.

The definitional ambiguity surrounding digital human rights, emphasised by AllahRakha,20 Bendary and Rajadurai,²¹ undermines consistent protection because jurisdictions adopt divergent interpretations of these rights. To address this, scholars propose different strategies. Cong advocates a “translation approach,” arguing that existing human rights principles remain valid but must be carefully reinterpreted for digital contexts.²² Similarly, Land and Aronson highlight the potential of adapting traditional human rights frameworks to guide the governance of new technologies, reinforcing the idea that established principles can provide a normative foundation.²³ By contrast, Hildebrandt²⁴ insists that computational technologies introduce fundamentally novel challenges that cannot be resolved through reinterpretation alone. She cautions that smart technologies may erode the very “ends of law”, justice, accountability, and legal certainty, unless new forms of “legal protection by design” are embedded directly into technological infrastructures.

Adding to this debate, Custers goes further by exploring the possibility of articulating entirely new fundamental rights for the digital era, arguing that incremental reinterpretation may not be sufficient to protect individuals against AI-driven risks.²⁵ More recent scholarship in the non-Western context expands this conversation by emphasising the role of cultural and religious traditions. For example, Elmahjub²⁶ proposes a pluralist ethical benchmarking for AI governance that incorporates Islamic ethics, while Ali et al.²⁷ explicitly evaluate AI through the lens of maqāṣid al-sharīʿa, demonstrating how Islamic jurisprudential principles of dignity, justice, and privacy can enrich digital rights discourse.²⁸ These perspectives underline that the recognition and definition of digital human rights should not only deal with whether they are “translated” or “new” rights, but also consider how cultural and religious frameworks may inform distinctive and contextually legitimate approaches to governance.

Thus, digital rights are the rights individuals have in the digital realm. These rights are derived from conventional universal rights but are adapted to meet the demands and opportunities posed by the rapidly growing new technologies, including artificial intelligence. As digital environments increasingly shape humans’ sociopolitical, economic, and personal existence, the scope of these rights has extended.

Ultimately, digital human rights represent a renewed paradigm, well-anchored in international human rights conventions, while suggesting an adaptive conceptual and normative approach.

2.3. Core Categories of Digital Human Rights

Comparative studies reveal both convergence and divergence across existing frameworks. Jobin et al., in their analysis of 84 ethics guidelines, identified documents transparency, justice, non-maleficence, responsibility, and privacy as recurring principles.²⁹ While the OECD emphasises inclusive growth and human-centred values, UNESCO places greater emphasis on cultural contexts and sustainability. The EU's AI Act adopts a more regulatory stance through its risk-based classification system.³⁰

These frameworks address the issue of individuals' inherent rights in digital spaces with varying levels of specificity. Privacy protections are dominant in both ethical and legal discourse, though conceptualised differently across contexts. Non-discrimination principles appear consistently, but with varying approaches to bias mitigation. Transparency requirements have converged around key elements, including disclosure of AI use and appropriate explainability, though implementation guidance varies substantially.³¹ Despite these variations, several consensus principles have emerged across frameworks. Fjeld et al. identified eight key themes with widespread support: privacy, accountability, safety and security, transparency and explainability, fairness and non-discrimination, human control of technology, professional responsibility, and promotion of human values.³²

Taken together, these various frameworks show that digital rights discourse both continues established human rights traditions and introduces innovative protections. Building on this literature, the present research focuses on five essential digital rights: privacy, internet access, data protection, anonymity, and the right to be forgotten.

2.3.1. Privacy Rights in Digital Contexts

Digital privacy right is, ultimately, an extension of the privacy right. The international legal framework has long recognised privacy as a fundamental right. According to the International Covenant on Civil and Political Rights, Article 17 protects individuals against “arbitrary or unlawful interference with their privacy, family, home, or correspondence.”³³ Article 12 of the Universal Declaration of Human Rights similarly asserts the right to privacy and protection from arbitrary interference.³⁴

The problem does not lie in recognising the normative value of this right nor in defining its limits within the traditional framework in which it was established, but rather in its rapid transposition to the digital context. In the physical world, it is relatively easy to define the scope of application of this right, limit the actions considered violations, and assign ongoing responsibility for them. However, in the virtual realm, parameters become increasingly blurred. The decentralised nature of digital environments has shifted the focus from protecting individuals from surveillance to empowering them, raising concerns about digital access, inclusion, and protection and giving rise to profound regulatory uncertainty.

The use of advanced technologies, such as facial recognition, big data, and AI-assisted surveillance, has been unparalleled in human history and has been carried out primarily without people’s knowledge or permission, thereby altering this right. For instance, in Glukhin v. Russia (App. No 11519/20),³⁵ the European Court of Human Rights stressed that the use of facial recognition to identify to identify, locate, and subsequently arrest the applicant from photographs and video posted on social media constituted an interference with his right to respect for his private life and infringe Article 8 of the European Convention on Human Rights.

Custers³⁶ expressively affirms that AI surveillance impacts privacy rights, leading to their violation, and calls for greater attention to ensuring that artificial intelligence adheres to privacy-freedom governing principles.³⁷ Furthermore, research on algorithmic bias is especially concerning for diverse societies. Studies from the United States demonstrate that even the most advanced AI facial recognition tools exhibit significantly higher error rates when identifying black women compared to white men.³⁸

2.3.2. Right to Internet Access

The concept of a “right” to internet access, or “digital connectivity,” implies the ability of a person to connect to the internet to seek, receive and impart information.³⁹ Although, there is no binding international treaty that recognises the right to internet, the internet is growingly considered as an enabler of many human rights such as the right to freedom of speech and expression and the right to information as provided under Article 19 of the Universal Declaration of Human Rights, or the right to have equal access to public services (Article 21).⁴⁰ Recognising that internet access plays a facilitative role in the enjoyment of fundamental rights, the UNHRC (United Nations Human Rights Council) adopted Resolution 47/16 in 2021, calling on governments to close the gap in the availability and accessibility of affordable, stable Internet.⁴¹

Scholarly perspectives on this issue can be divided into three distinct groups for this research. Advocates for classifying internet access as a human right emphasise how digital connectivity has become essential for exercising numerous established rights in contemporary society, from freedom of expression to education.⁴² According to the second group, represented by scholars such as Veale and Zuiderveen Borgesius,⁴³ internet access is only a means to the enjoyment of other rights; consequently, they contend that it lacks the fundamental quality required for recognition as a human right. For this group, internet access serves merely as a technological enabler of rights rather than constituting a right itself.⁴⁴

Among these perspectives, the most compelling is the view that internet access can be conceptualised as an emerging human right.⁴⁵ This nuanced approach acknowledges the internet's crucial role in contemporary rights fulfilment while acknowledging that it does not carry the same foundational status as primary human rights, such as freedom from torture or the right to life. Yet, in a world where digital infrastructure has become indispensable for daily life, meaningful participation in society becomes severely limited without internet access.

The resulting legal discourse reflects both continuity and innovation: it builds upon existing treaty obligations while pressing towards recognition of a distinct digital entitlement in practice.

2.3.3. Data Protection Rights

Data protection has become indispensable as AI systems process vast amounts of personal information, raising fundamental rights concerns. Traditionally, data protection has been governed by various legislations—such as the GDPR⁴⁶ in the EU— which grant individuals power and meaningful control over their information through rights of access, correction, and deletion.⁴⁷

Data Protection right was firmly established in Digital Rights Ireland Ltd v. Minister for Communications (Joined Cases C-293/12 and C-594/12),⁴⁸ where the Court of Justice declared the Data Retention Directive invalid for exceeding the limits of proportionality under Articles 7, 8, and 52(1) of the Charter of Fundamental Rights. While acknowledging the Directive’s legitimate objective of combating serious crime, the Court held that its general and indiscriminate retention of telecommunications data constituted a particularly serious interference with the rights to privacy and data protection. The judgment required any data retention regime to be strictly necessary, supported by clear and precise rules, and subject to independent supervision, thereby establishing the modern constitutional standard for data protection within the European Union.

However, the rise of AI places these standards under unprecedented pressure. The automated, predictive, and often opaque processing models that characterise AI challenge the very assumptions of informed consent, transparency, and proportionality that the Digital Rights Ireland judgment sought to safeguard. AI technologies rely on big data analytics and machine learning algorithms that often operate beyond conventional privacy safeguards. The "black box" nature of many AI systems—characterised by opaque decisionmaking processes lacking self-explainability—prevents individuals from understanding how their personal information is processed, analysed, and potentially shared.

This lack of transparency fundamentally weakens the principle of informed consent that underpins modern data protection regimes. As Vogel⁴⁹ argues, these obstacles can only be

overcome through adaptive legal frameworks that ensure users maintain meaningful control over their data in increasingly complex AI environments. The rapid advancement of AI technologies necessitates specialised legislation that balances innovation with robust rights protection, addressing mounting concerns about fairness, transparency, and accountability in these rapidly evolving systems.

2.3.4. Right to Anonymity

The right to anonymity enables individuals to preserve their identity and personal integrity by preventing unwanted disclosure. This safeguard has become increasingly vital in digital environments where personal information can be exposed and circulated without consent.⁵⁰ Traditionally, this right has been understood as an extension of fundamental rights—most notably, the right to privacy⁵¹ and the freedom of expression.⁵²

In Standard Verlagsgesellschaft MBH v. Austria (App. No 21277/19),⁵³ the European Court of Human Rights reinforced this principle within the context of online expression. The Court held that compelling the disclosure of anonymous commenters’ identities violated Article 10 of the Convention, emphasising that anonymity shields individuals from retaliation and is essential to preserving free and uninhibited participation in democratic debate.

In today’s digital age, anonymity has acquired renewed urgency. AI-driven technologies, such as facial recognition, predictive analytics, and pervasive data tracking, have profoundly altered the boundaries of private life. These systems continuously monitor user behaviour, eroding the ability to remain unidentifiable online. As Kettemann et al.⁵⁴ observe, anonymity now serves as a crucial safeguard against intrusive surveillance, reinforcing personal agency and autonomy in increasingly datafied societies.

With the proliferation of algorithmic profiling and biometric identification across everyday environments, protecting anonymity is no longer a matter of convenience but a condition for preserving individual freedom, diversity, and democratic discourse in the digital era. Ultimately, safeguarding anonymity is not only about concealing identity but about affirming each individual’s right to define their digital presence and personal boundaries in a world of pervasive visibility.

2.3.5. Right to Be Forgotten

The right to be forgotten reflects one of the most human aspirations in the digital age, the wish to move on from the past and regain control over one’s own story. The legal recognition of this right has developed most clearly within the European Union, where it emerged from the long-standing commitment to privacy and data protection. The landmark Google Spain SL and Google Inc. v. AEPD and Mario Costeja González (Case C-131/12)⁵⁵ captured this idea in a remarkably personal way, when an ordinary citizen sought to erase outdated information that no longer accurately defined who he was. The Court of Justice ruled that individuals may ask search engines to delist links containing outdated or irrelevant personal data, provided this does not override the public’s right to know. The decision transformed a private grievance into a principle of digital dignity, later codified in Article 17 of the General Data Protection Regulation (GDPR), which formally grants individuals the right to request the erasure of their personal data.⁵⁶

Later cases, such as Google LLC v. CNIL (Case C-507/17),⁵⁷ further clarified the boundaries of the right to be forgotten. The Court of Justice affirmed that while individuals deserve the chance to outgrow their digital past, this right cannot extend without limit; it must be balanced with freedom of expression and the public interest. The result is not a promise of invisibility but a nuanced recognition that every person has the right to be more than the sum of their search results.⁵⁸

Yet the challenges today go far beyond search engines. In an era dominated by big data and AI, personal information is not merely stored; it is constantly inferred, replicated, and reassembled by systems that learn from the digital traces individuals leave behind. AI models trained on personal data may reproduce information long after it has been deleted from public sources, raising new questions about whether technological forgetting is even possible.

Still, scholars such as Paolucci⁵⁹ emphasise that the right to be forgotten carries profound moral weight; it restores a sense of agency and redemption, allowing individuals to reclaim their narrative from the permanence of the digital archive. In this sense, the right is not only a legal tool but a deeply human one, anchored in dignity, mercy, and the universal need for renewal. It recognises that the digital world—like life itself—should allow space for growth, change, and new beginnings.

These five digital rights—privacy, internet access, data protection, anonymity, and the right to be forgotten—provide the conceptual framework for evaluating national regulatory approaches. Across global contexts, three findings stand out. First, the normative core of human rights remains stable, but their application in digital environments varies depending on governance models and technological capabilities. Second, while the European Union leads with legally enforceable standards like the GDPR and AI Act, other regions, including MENA, still rely heavily on ethical or strategic frameworks. Third, the rise of artificial intelligence introduces new tensions between innovation and protection, as data-driven decision-making often exceeds traditional accountability mechanisms. These results highlight the importance of context-specific approaches to digital rights governance. In particular, the MENA region, characterised by rapid technological transformation, strong state involvement, and deeply rooted ethical traditions, offers a distinctive perspective on how universal digital rights are being adapted in practice.

3 DIGITAL RIGHTS AND AI IN THE MENA CONTEXT

3.1. Regional Regulatory Frameworks and Emerging AI Strategies

Building on the conceptual and legal foundation discussed earlier, this section examines how these universal principles translate into regional contexts, particularly in the Middle East and North Africa (MENA) region. Governance approaches to digital rights and AI in the MENA region reflect distinctive regional dynamics and priorities.

Ismail and Ahmad⁶⁰ observe that digital transformation across the region has progressed rapidly but unevenly, with Gulf Cooperation Council (GCC) countries generally establishing more advanced governance frameworks than other MENA nations. These differences stem from varying resource availability, institutional capacity, and prioritisation of digital development within national strategies. Several GCC countries have adopted comprehensive AI strategies that engage with both innovation and governance dimensions. The UAE's National Strategy for Artificial Intelligence (2017) was among the first in the region, establishing "responsible AI" as a core pillar alongside economic development goals.⁶¹ Similarly, Qatar's National Artificial Intelligence Strategy emphasises ethical principles including fairness, transparency, and human-centred design.⁶²

Many MENA states draw significantly from international frameworks while adapting governance approaches to regionally specific cultural contexts. Qatar’s Data Protection Law⁶³ incorporates GDPR-inspired provisions while reflecting local legal traditions. Similarly, Bahrain's Personal Data Protection Law⁶⁴ establishes rights and principles aligned with international standards while maintaining flexibility for national security considerations. The intersection of Islamic legal principles with digital rights frameworks represents a distinctive aspect of regional governance approaches.

Regional cooperation initiatives on digital governance have emerged through bodies including the Arab League and the Gulf Cooperation Council. The Arab Strategy for Information Security and Digital Technologies establish shared principles and cooperation mechanisms, though implementation remains primarily national.⁶⁵ As Fatafata and Samaro⁶⁶ note, regional initiatives have focused more on cybersecurity cooperation than on comprehensive digital rights frameworks.

Despite these developments, the academic literature on AI ethics and digital rights in the MENA region remains relatively limited compared to the European and North American context.⁶⁷ Significant gaps persist in region-specific research on algorithmic fairness, cultural adaptation of AI ethics principles, and implementation studies of digital rights frameworks. This underscores the need for expanded scholarship examining distinctive regional approaches and challenges rather than simply applying external frameworks.

3.2. The Role of Islamic Legal and Ethical Principles

A distinctive feature of AI and digital governance in the MENA context is the interaction between emerging digital rights frameworks and deep-rooted Islamic legal and ethical principles. Ethical foundations derived from maqāṣid al-sharīʿah, can enrich regional interpretations of privacy, dignity, justice, and trust as dynamic governance criteria (e.g. hurmah al-insān, adl, amānah). However, integrating these values into AI policy demands more than rhetorical invocation; it demands methodological translation, normative calibration, and institutional embedding.

Several scholars have explored how Islamic ethics might inform distinctive approaches to emerging challenges such as algorithmic decision-making, data ownership, and privacy by design. In recent research, Ali et al.⁶⁸ maintain that Islamic ethics can contribute as a pluralist benchmark for AI evaluation, combining textual sources (Qur’an, Sunnah) with maslahah (public benefit) and maqāṣid reasoning in a dynamic, context-sensitive manner. Elmahjub⁶⁹ argues that Islamic ethics should not be considered a static overlay, but rather a living tradition capable of negotiating tensions such as privacy versus utility or fairness versus efficiency through a purpose-based moral methodology.

Islamic jurisprudence provides a set of ethical imperatives that align closely with contemporary human rights standards. Principles such as hurmah al-insan (human dignity), adl (justice), and amanah (trust) resonate strongly with modern values of transparency, accountability, and respect for personal data. As AlKubaisi⁷⁰ argues, these principles can complement and reinforce digital rights protections when appropriately integrated into governance frameworks. Trust and responsibility, captured by the concept of amānah, are especially important when AI systems are involved in human affairs. From an Islamic perspective, ethical AI should hold developers and users responsible for handling sensitive data and decisions, using tools like audits, clear explanations, and ways to address problems. Western AI ethics are not entirely devoted to this more profound sense of moral accountability; in this regard, Islamic ideas of trusteeship (amānah) can offer new ways to embed responsibility into AI systems.

Islamic ethics can make AI governance more meaningful and humane; however, there are still challenges in translating Islamic ethical ideals into a clear regulatory system, especially without a clear, binding legal framework, independent Sharia-based ethical audits, or certified compliance programs. These ideals may not be put into practice.

4 THE INTERSECTION BETWEEN AI GOVERNANCE AND DIGITAL HUMAN RIGHTS IN INTERNATIONAL LEGAL FRAMEWORKS

The intersection between AI governance and digital human rights in international legal frameworks reveals significant variations in regulatory philosophy and implementation strategies. Different jurisdictions have struck varying balances between innovation and rights protection. The European approach generally applies what Jasanoff⁷¹ terms a “precautionary principle,” establishing substantial oversight before technologies enter the

market. The American approach has historically emphasised innovation with more limited ex-ante restrictions, relying more heavily on market forces and ex-post remedies. Asian approaches often frame AI governance as “enabling innovation” through guidelines and certification rather than comprehensive restrictions.

Yet despite their differences, most jurisdictions face similar challenges when implementing digital rights frameworks. One challenge concerns the elastic nature of concepts such as "fairness" and "transparency," which are subject to varying interpretations, resulting in persistent definitional ambiguity. A second challenge arises from the technical verification difficulties that emerge when assessing complex socio-technical systems that cannot be fully predicted through traditional compliance mechanisms. A third challenge is the "expertise gap" between regulators and the regulated entities they oversee; regulatory bodies often lack the specialised technical capacity to effectively evaluate AI systems for compliance with abstract principles. These issues collectively explain why translating human rights norms into effective AI governance remains an unfinished global project.

4.1. The European AI Act: A Milestone in Human-Rights-Centred Regulation

Against this fragmented background, the European Union's AI Act, which was proposed in 2021 and entered into force on 1 August 2024, stands as the first comprehensive and binding legal framework allocated to managing the dangers and responsibilities of AI.⁷² Its central aim is to reconcile technological innovation with the protection of human dignity and fundamental rights.

The Act classifies AI systems according to their potential risk—ranging from prohibited to high, limited, and minimal—with each category carrying corresponding duties relating to transparency, human oversight, and accountability (EU AI Act, Arts. 5–9).⁷³ For example, the Act prohibits the use of AI for social scoring or real-time biometric surveillance in public spaces, considering these practices incompatible with human dignity. Systems used in law enforcement, healthcare, employment, or education fall into the high-risk category and must undergo strict risk assessments, provide traceable documentation, and ensure that humans remain in control of key decisions.⁷⁴ By contrast, tools such as chatbots or emotion-recognition software—classified as limited-risk—are mainly required to inform users that they are interacting with AI, while minimal-risk systems such as spam filters face no additional regulation.⁷⁵

This system of categorisation, however, is not without limitations. Some technologies formally labelled as “low risk” may still raise deep ethical concerns, especially when their algorithms amplify bias, manipulate emotions, or operate in an opaque manner.

Despite its ambition, the Act has faced criticism for its ambiguous terminology, reliance on private standard-setting bodies, and limited enforcement pathways. Nevertheless, it remains a historic milestone, transforming abstract principles like privacy, fairness, and non-discrimination into enforceable obligations.

The widespread use of artificial intelligence systems has created a need to adopt mandatory legal measures to protect them, ensure their safety, and guarantee their accountability and adherence to human rights. The lack of binding legislative norms issued by international legislative bodies has left significant gaps in the central part. These gaps in the accountability system reflect a broader challenge of attributing criminal or moral responsibility when algorithmic systems contribute to harmful outcomes. As Abdelaziz⁷⁶ argues, the shift from physical to virtual life for human beings has blurred the traditional boundaries of liability, a shift that urgently requires comparative legal systems to rethink how intent, causation, and foreseeability apply to AI-mediated harm.

4.2. Soft-Law Approaches: UNESCO and OECD Frameworks

Beyond the European Union, many international organisations, such as the United Nations, have taken steps to develop ethical baselines for AI safe development and use of artificial intelligence and on the path of the leading world organisations, the Islamic World Educational, Scientific and Cultural Organisation (ICESCO) and the Saudi Data and Artificial Intelligence Authority launched in 2024 the Riyadh Charter for Artificial Intelligence in the Islamic World, which aims to establish an ethical framework for the development and use of artificial intelligence in line with the principles of Islamic moral traditions.

The UNESCO Recommendation on the Ethical Use of Artificial Intelligence, adopted by 193 member countries in November 2021, is particularly significant.⁷⁷ Unlike binding regulatory instruments, which rely on prohibitions and strict compliance measures, the Recommendation adopts a life-cycle approach that emphasises human dignity, the protection of individuals' privacy, and the inclusion of people in the development of AI. It challenges states to embed human rights into AI governance and seeks to ensure that technological innovation strengthens societies, respects liberty, and unites individuals. Its holistic approach sets out ten core principles—proportionality, safety and security, privacy and data protection, governance, inclusivity, responsibility and accountability, transparency and explainability, sustainability, human oversight, public AI literacy, and fairness and unbiased AI.

Similarly, the OECD AI guidelines offer a set of recommendations with clear aims for the responsible stewardship of the development and use of AI that respects and protects human rights and includes democratic rights and core freedoms.⁷⁸ These principles were adopted by OECD member countries and remain a significant step towards the formation of an AI regulatory framework. The OECD AI Principles share significant similarities with UNESCO’s principles regarding inclusiveness, collaboration, openness, and responsibility.⁷⁹ The principles also provide that, to ensure fair and balanced rights for individuals, the AI systems used to process and reach decisions that affect people should be transparent and explainable to all stakeholders involved. 5 DIGITAL HUMAN RIGHTS WITHIN THE SAUDI ARABIA’S LEGAL FRAMEWORK: A PRELIMINARY ASSESSMENT

5 DIGITAL HUMAN RIGHTS WITHIN THE SAUDI ARABIA’S LEGAL FRAMEWORK: A PRELIMINARY ASSESSMENT

The Kingdom of Saudi Arabia has developed a multi-layered legal framework governing digital activities and data protection, comprising the Personal Data Protection Law (PDPL, 2021, amended 2023), the Anti-Cyber Crime Law (2007), and various sector-specific regulations. This framework operates within the broader context of Vision 2030, which explicitly prioritises digital transformation while recognising the need for rights protections.⁸⁰

The regulatory architecture reflects a hybrid approach: comprehensive data protection provisions modelled on international standards⁸¹ (particularly GDPR-inspired elements in the PDPL) coexist with cybersecurity legislation predating the AI era. The Saudi Data and Artificial Intelligence Authority (SDAIA) has issued AI Ethics Principles (2023), though these remain non-binding guidance rather than enforceable law. The Saudi Data and Privacy Protection Authority (SDPPA) serves as the primary enforcement body for data protection.⁸²

This section evaluates Saudi Arabia's framework against the international benchmarks established in Section 3, examining both areas of alignment with global standards and regulatory gaps that limit comprehensive digital rights protection in AI-driven contexts. The analysis begins by assessing the achievements of the PDPL, before examining its limitations, and before turning to the contemporary relevance of the Anti-Cybercrime Law. The section concludes with a comparative assessment of the Kingdom's overall positioning within international governance models.

5.1. Personal Data Protection Law (PDPL)

The Personal Data Protection Law (PDPL), enacted on 16 September 2021 and amended on 27 March 2023,⁸³ constitutes Saudi Arabia's primary legal framework for data protection. Enforced by the Saudi Data and Privacy Protection Authority (SDPPA), the PDPL establishes comprehensive provisions governing the collection, processing, and storage of personal information, demonstrating the Kingdom's recognition of data privacy as an essential component of digital rights protection.

The PDPL reflects influence from established international frameworks, particularly the Council of Europe's Convention 108⁸⁴ and the EU's General Data Protection Regulation (GDPR).⁸⁵ The law incorporates several internationally recognised principles, including purpose limitation, data minimisation, and consent requirements for data processing. Article 5 mandates explicit consent for data processing, while Article 12 imposes transparency requirements for data use. Article 19 enforces data minimisation principles, requiring data collection to be limited to essential information.⁸⁶ These provisions constitute the foundational legal framework for digital human rights in Saudi Arabia, particularly regarding the right to informational self-determination that enables individuals to exercise control over their personal information.⁸⁷

The Kingdom has successfully implemented additional protective measures that mirror global best practices. Article 24 requires data breach notification to both authorities and affected individuals without undue delay—a provision consistent with leading international data protection regulations. Article 32 mandates the appointment of Data Protection Officers within organisations that process personal data, and establishes an internal compliance mechanism.⁸⁸ The establishment of the SDPPA as a dedicated regulatory body reflects international trends toward specialised data protection oversight, providing institutional capacity for enforcement and guidance. The law grants individuals specific rights regarding their personal data, including access, correction, and deletion rights, demonstrating the Kingdom's commitment to empowering citizens with meaningful

control over their personal information. Substantial penalties for non-compliance— potentially reaching 5 million Saudi Riyals (approximately 1.3 million USD) for serious violations—signal strong enforcement commitment.⁸⁹

Despite these achievements, several areas reveal divergence from international best practices and warrant additional attention to address contemporary technological challenges. Article 16 delineates multiple circumstances that permit the waiver of consent requirements, including public interest, vital interests protection, national security considerations, credit referencing, and research purposes. These exceptions, though providing operational flexibility, create broader latitude than comparable provisions in the GDPR, which may weaken the foundational principle of informed consent that underpins modern data protection regimes.

The current legal framework provides limited algorithmic accountability provisions, creating gaps in oversight of AI decision-making systems that increasingly affect citizens' lives across sectors, from employment to public services. The law currently lacks specific provisions addressing emerging technological applications. Spatiotemporal data and AIgenerated information receive limited attention despite their widespread use across healthcare, transportation, and smart city initiatives. Post-mortem data processing, particularly regarding facial recognition and predictive analytics, lacks clear regulatory guidelines. Additionally, the framework does not explicitly address bias mitigation in automated systems or transparency requirements for AI decision-making processes, creating a significant regulatory gap, as the Kingdom lacks unified legislation that addresses the full spectrum of AI-related rights and risks.⁹⁰

These gaps create challenges for comprehensive digital rights protection as artificial intelligence and machine learning technologies expand throughout Saudi society. Developing provisions for algorithmic transparency and accountability would strengthen the framework's capacity to address automated decision-making in employment, judicial processes, and public services. As the Kingdom advances its digital transformation agenda under Vision 2030, evolving the PDPL to encompass these emerging areas would enhance alignment with international best practices while supporting technological innovation objectives.

5.2. 2007 Anti-Cybercrime Law and Digital Rights Implications

The 2007 Anti-Cybercrime Law⁹¹ complements the PDPL but predates both contemporary data protection standards and the proliferation of AI technologies. Article 3(1) prohibits unauthorised data interception through information networks. Article 3(4) addresses privacy invasion through mobile devices and similar technologies.⁹² These provisions establish baseline privacy protections but do not explicitly address AI-powered surveillance technologies such as facial recognition systems or predictive analytics.⁹³

Article 6(1) regulates content production and transmission that impinges on public order, religious values, or privacy. Article 7(2) addresses unauthorised system access that may result in the obtaining of data relevant to national security or economic interests. These provisions provide flexibility for addressing evolving threats but lack specific guidance on algorithmic content moderation or AI-driven security measures. Such systems currently operate throughout the Kingdom, including biometric identification at border entry points, the ABSHER digital government services platform,⁹⁴ and AI-powered urban management technologies deployed in NEOM smart city initiatives.⁹⁵

Article 14 designates the Communications and Information Technology Commission to provide technical support to security agencies during investigations. The law does not address algorithmic bias in automated enforcement systems, transparency requirements for AI-powered investigative tools, or citizens' rights to challenge automated decisions.⁹⁶ International courts have increasingly recognised these gaps as human rights concerns. The European Court of Human Rights found that mass surveillance systems lacking adequate safeguards violate privacy rights in Big Brother Watch and Others v. United Kingdom (Apps. Nos 58170/13, 62322/14 and 24960/15).⁹⁷ The Court of Justice of the European Union invalidated data transfer mechanisms where surveillance frameworks

provided insufficient individual protections.⁹⁸ The CJEU also recognised individuals' rights to request deletion of inadequate or outdated personal data, a principle not yet incorporated into Saudi legislation.⁹⁹

The 17-year gap between the law's enactment and current AI capabilities underscores the need for updated provisions that address algorithmic accountability and transparency. Developing such provisions would strengthen the Kingdom's framework capacity to balance security objectives with digital rights protections as AI technologies expand throughout Saudi society. 6 CONCLUSION AND RECOMMENDATIONS

6 CONCLUSION AND RECOMMENDATIONS

K.S.A has established foundational digital governance structures that demonstrate general alignment with international standards, particularly through the Personal Data Protection Law (2021, amended 2023) and the creation of specialised regulatory institutions. The PDPL incorporates core data protection principles, including purpose limitation, data minimisation, consent requirements, and breach notification, while granting individuals meaningful rights over their personal information. These achievements position the Kingdom comparably to other jurisdictions pursuing digital transformation under comprehensive data protection regimes.

However, the accelerating deployment of AI systems across governance, healthcare, education, and smart city infrastructure has outpaced the legal framework's capacity to address algorithmic decision-making. Three critical gaps persist: the PDPL does not recognise data protection as a fundamental human right; neither the PDPL nor the 2007 Anti-Cybercrime Law adequately addresses AI-specific challenges, including algorithmic accountability, bias mitigation, and transparency requirements; and fragmented regulatory oversight leaves individuals without clear mechanisms to challenge automated decisions affecting their interests.

The path forward requires targeted legal reforms. Amending the PDPL to explicitly recognise data protection as a fundamental right would strengthen its constitutional foundation. Comprehensive AI governance legislation that consolidates SDAIA's ethical guidelines into binding requirements would establish clear obligations for high-risk applications, mandatory transparency standards, and enforceable bias-prevention measures. Expanding the PDPL's scope to explicitly cover AI-generated data, biometric information, and spatiotemporal analytics would address technological developments since

the law's enactment. Strengthening enforcement mechanisms—including accessible complaint procedures, rights to explanation for automated decisions, and meaningful remedies for violations—would transform abstract protections into actionable rights.

KSA’s distinctive position presents both challenge and opportunity. The Kingdom is undergoing accelerated digital transformation while simultaneously integrating Islamic ethical principles into its legal system. Operationalising concepts of human dignity (hurmah al-insan), justice (adl), and trust (amanah) within technical standards and compliance frameworks would position the KSA model for governance approaches that harmonise international norms with cultural values. Rather than viewing Vision 2030's technological ambitions and robust rights protections as competing imperatives, the Kingdom can demonstrate their mutual reinforcement—innovation flourishes most sustainably within frameworks that safeguard human dignity and accountability.

By addressing these regulatory gaps through comprehensive legal reform, Saudi Arabia can establish itself as a regional leader in rights-based AI governance, demonstrating that rapid technological advancement and fundamental rights protection are not opposing forces but complementary pillars of sustainable digital transformation. REFERENCES

FOOTNOTES

REFERENCES

AUTHORS INFORMATION

RIGHTS AND PERMISSIONS

ADDITIONAL INFORMATION

EDITORS

ABOUT THIS ARTICLE

DETAILS FOR PUBLICATION

AI DISCLOSURE STATEMENT

АНОТАЦІЯ