The paper Sarah is referring to is Privacy & Social Media in the Context of the Arab Gulf by Norah Abokhodair & Sarah Vieweg (DIS 2016). The full paper is worth a read, but in this case study we'll examine some key quotes that highlight some of the privacy differences in the cultural context of the Arab Gulf.

Privacy as a Societal Expectation

When asked about their views of privacy, participants often referred to societal expectations rather than personal limits or beliefs. They spoke of an ongoing boundary negotiation that encompassed their entire families, and how they act as representatives to meet societal expectations. This is illustrated in a male Saudi's (M3) response to a question regarding privacy:

"It [privacy] is not about me and my beliefs; it is about the audience and what they believe in and their objective."

M3 is very clear in his assertion that in the case of a Saudi audience, the maintenance of privacy is not related to what he believes is permissible or ethical, but is instead driven by societal expectations.

Privacy is often conceptualized as an individual right, for example in Article 12 of the Universal Declaration of Human Rights and in data protection laws that define individual data subject rights. However, this study's participants conceptualized privacy instead as a societal expectation - even an obligation that they must fulfil to uphold their family's honor.

Consider:

• Do you feel any privacy obligations towards others?
• Do you picture privacy as an individual right, collective right, or both?
• If you imagine having the opposite perspective: would this change your opinion of the tech products you use on a daily basis?

Beyond Western Definitions of Sensitive Personal Data

As Saudis we know how to keep our private life private and what is suppose to be public, we still keep private." First author: "Like what?" M5: "Your name, your work, your mother's name...the worst example we have here...a lot of guys are ashamed of their mothers' name."

In his reference to "mothers' names," M5 is referring to the significance of honor and shame as they manifest in everyday situations. In the GCC, men experience shame if their male friends know their mother's name; this custom is borne of tribal practices that persist today. A man's mahram women (mother, wife) are usually referred to by nicknames or in the abstract (e.g., "the family," "the mother of my children"). In this regard, men "consider the names of their female relatives a private part of their lives that they do not want to share with others", i.e. female relatives' names are awrah, and must be protected. If names are known to other men, then 'ird is damaged. As this relates to digital behavior; the onus is on men to ensure that female relatives' names are not released nor spread.

We learned earlier in the course that in some countries data relating to one's racial or ethnic origin, caste, or tribe is considered sensitive personal data, meriting stronger legal safeguards. In the Arab Gulf, customs rooted in tribal practices extend this scope to the family. For example, data concerning one's family members - or that even indirectly reveals your family - is considered sensitive under data protection law in both the UAE and Qatar. And in Saudi Arabia under the PDPL, even the personal data of the deceased is in scope of the law if it would lead to identification of the deceased's family members. This contrasts with the GDPR, which only applies to living individuals.

Publishing photos and videos of other people without their permission is also culturally taboo and illegal, in stark contrast to most Western countries. In 2019, for example, someone was arrested in Dubai for filming an incident where a man was sitting on the front of a woman's car trying to prevent her driving away. What in other cultures might be interpreted as a well-intentioned attempt to gather evidence of a crime taking place is considered a violation of privacy in the UAE and may be punished with fines and imprisonment for six months. One thing to consider in this case, however, is that the video went viral on social media and so the two people filmed were exposed very publicly, in contrast to the video being provided only to the police.

Recommendations for Social Media Platforms

• Gender-sensitive friend recommendations
• No 'real name' or 'one account only' policies (although this may conflict with content moderation goals and national laws requiring user identification)
• Privacy by default. Making posts private by default and ensuring they stay that way would have prevented some of the privacy harm described by the participants. It is never appropriate to make your users' data public without their consent.
• More fine-grained privacy controls would help Arab Gulf users share posts with the appropriate audience to ensure that honor is maintained. Similarly, as we discussed in the last section, collaborative privacy management features would be useful to maintain group privacy, for example family privacy settings that can be shared across multiple accounts.
• In this section, we've been discussing how important it is to meet the privacy expectations of your users. However, actually the product decisions you make may impact many indirect stakeholders who don't use your product but are affected by it, for example because they are in the social network of a user. When doing privacy threat modeling of your designs, start by asking yourself not "who will use this?" but "who may be affected by this"?

Further Reading

A related article by the same authors is Fatwas and Social Media, which discusses "a recent fatwa (a point of Islamic law) that claims that women should not be allowed to access the Internet without supervision or permission from a muhram (related male guardian)". What does privacy mean if your female users have a male guardian watching over their shoulder? Is it still possible to protect their privacy? There are similarities here to the privacy challenges faced by the blind and partially-sighted, and some of the same UI-level privacy protections can be applied.

For more on group privacy, check out:

• Privacy Beyond the Individual Level - Jennifer Jiyoung Suh & Miriam J. Metzger, Modern Socio-Technical Perspectives on Privacy (2022)
• What About My Privacy, Habibi? Understanding Privacy Concerns and Perceptions of Users from Different Socioeconomic Groups in the Arab World - Mennatallah Saleh, Mohamed Khamis & Christian Sturm, INTERACT: IFIP Conference on Human-Computer Interaction (2019)
• "I Am Datafied Because We Are Datafied": an Ubuntu Perspective on (Relational) Privacy - Urbano Reviglio & Rogers Alunge, Philosophy & Technology (2020)