Civil Law and UAE Balancing Test in Privacy and Expression Claims

1. Introduction

The balancing of privacy and freedom of expression in the UAE is not based on an unrestricted “free speech versus privacy” formula. UAE law approaches the conflict through a combination of:

• constitutional protections;
• civil-law principles;
• privacy and personal-data legislation;
• criminal restrictions on insults and unlawful disclosure;
• cybercrime legislation;
• rules concerning evidence and judicial proceedings; and
• the rights and legitimate interests of the persons affected.

The central legal problem is:

When does the exercise of expression become an unlawful interference with another person's privacy, reputation, dignity, personal data, or family life?

The answer depends heavily on purpose, context, consent, method of publication, truth or falsity, legitimate interest, proportionality, and the nature of the information disclosed.

The current framework includes Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, and Federal Law by Decree No. 31 of 2021 promulgating the Crimes and Penalties Law. The Personal Data Protection Law, for example, requires consideration of necessity, suitability, privacy risks and measures to reduce those risks in specified high-risk processing activities.

Importantly, the UAE does not simply apply a broad U.S.-style First Amendment balancing test. The appropriate UAE analysis is better described as a proportionality and competing-rights analysis within a civil-law and statutory framework.

2. Meaning of the Balancing Test

A privacy-expression dispute generally involves two competing interests:

Privacy interest

The individual seeks protection of:

• private life;
• family life;
• personal communications;
• photographs;
• personal data;
• reputation;
• dignity;
• identity;
• sensitive information.

Expression interest

The speaker may claim an interest in:

• criticism;
• journalism;
• public discussion;
• reporting wrongdoing;
• complaints to authorities;
• political/social commentary;
• commercial communication;
• defence of legal rights.

The court therefore has to determine whether the particular expression is legally protected or whether the manner in which it was exercised unlawfully interfered with another person's rights.

3. UAE Law Does Not Treat Privacy and Expression as Absolute Rights

Neither side has an unlimited right.

A person cannot generally argue:

“I have freedom of expression, therefore I can publish another person's private photograph.”

Likewise, a person cannot automatically argue:

“This information concerns me, therefore nobody can lawfully discuss it.”

The legal inquiry is contextual.

A useful formula is:

Expression interest + legitimate purpose + factual basis + proportionality

versus

privacy interest + sensitivity of information + harm + absence of consent/legal justification.

4. Constitutional Foundation

The UAE constitutional framework protects individual freedoms while simultaneously protecting privacy, reputation and the family.

The constitutional framework therefore creates the background against which ordinary legislation operates.

The practical result is that courts do not have to choose between:

“privacy always wins”

and

“expression always wins.”

Instead, the legislation determines the circumstances in which an interference becomes unlawful.

5. Privacy Under the Personal Data Protection Law

Federal Decree-Law No. 45 of 2021 provides a comprehensive framework for personal-data protection.

It regulates matters including:

• processing of personal data;
• consent;
• lawful processing;
• sensitive personal data;
• rights of data subjects;
• controllers and processors;
• data-security obligations;
• cross-border transfers;
• data-protection officers;
• impact assessments.

An important feature is the law's emphasis on necessity and proportionality of processing.

For specified high-risk processing, the impact assessment must consider:

1. the processing operations;
2. their purpose;
3. necessity;
4. suitability;
5. potential privacy and confidentiality risks; and
6. measures for reducing those risks. 

This provides a useful statutory model for the privacy-expression balancing exercise.

6. Expression Through Digital Media

The conflict becomes especially difficult where expression occurs through:

• Facebook;
• Instagram;
• TikTok;
• WhatsApp;
• X;
• websites;
• blogs;
• online newspapers;
• messaging applications.

A private statement may become a public publication once uploaded or forwarded to a large audience.

Therefore, the court may consider:

Who received the information?

How was it obtained?

Was publication authorised?

How many people could access it?

Was it private information?

Was there a legitimate reason for publication?

Was the statement insulting or defamatory?

7. Federal Decree-Law No. 34 of 2021

The Cybercrimes Law is particularly important because digital expression can trigger liability where it:

• violates privacy;
• publishes or disseminates protected information;
• insults or defames another person through information technology;
• unlawfully uses or publishes photographs or recordings;
• spreads false or harmful information in circumstances prohibited by law.

The legislation remains part of the UAE's current federal framework and was still listed as current on the official UAE legislation portal in 2026.

Therefore:

The fact that expression occurs online does not remove ordinary legal responsibility; in some situations, digital publication creates additional statutory consequences.

8. Privacy of Private and Family Life

The UAE Crimes and Penalties Law contains specific protection for private and family life.

Article 431 addresses unlawful interference with private or family life, including specified forms of:

• recording;
• transmitting conversations;
• photographing persons in private places; and
• transmitting such material,

where done outside legally permitted circumstances or without consent.

This demonstrates that the UAE legal system places substantial weight on privacy.

9. Case Law 1 — UAE Federal Supreme Court Cassation No. 1533/2022

This is one of the most directly relevant cases.

The accused had originally been charged with insulting another person through Facebook.

The trial court additionally convicted the accused for unlawfully attacking the victim's privacy by publishing:

• a private photograph;
• the name of the company managed by the victim; and
• the victim's personal Facebook account.

The Federal Supreme Court overturned the judgment because the additional privacy offence was not contained in the original referral/charge. The court could not convict the accused on a different factual accusation without following the required procedural mechanism.

Principle

The case establishes an important limitation on state intervention:

Even where conduct potentially violates privacy, the criminal court must remain within the procedural boundaries of the charge.

Importance for balancing

This case demonstrates that privacy protection does not eliminate procedural rights.

There are therefore two separate questions:

1. Was privacy unlawfully invaded?
2. Was the accused properly charged and tried for that alleged invasion?

The second question remains independently important.

10. Case Law 2 — UAE Federal Supreme Court Cassation No. 1094/2022 Penal

This case concerned dissemination of a video and questions concerning the accused's knowledge and intention.

The Federal Supreme Court explained that criminal intent is an internal psychological matter and must be inferred from external conduct and surrounding circumstances.

Principle

The court may examine:

• what the person did;
• how the material was transmitted;
• the circumstances of transmission;
• the relationship between the parties;
• surrounding communications;
• the person's conduct.

Privacy-expression significance

This is important because not every disclosure has the same legal character.

For example:

Accidental transmission

is different from:

deliberate publication designed to expose or humiliate another person.

Intent and surrounding circumstances can therefore influence the legal assessment.

11. Case Law 3 — UAE Federal Supreme Court Cassation No. 1001/2022 Penal

The case involved allegations concerning insulting communications and questions regarding whether the relevant communications constituted the same factual conduct for purposes of prior adjudication.

The Court held that the identity of proceedings depends on the relevant facts, parties and cause, and that the trial court has authority to determine the factual circumstances from the evidence.

Relevance

Digital expression frequently consists of:

• multiple messages;
• multiple posts;
• forwarding;
• screenshots;
• different publication dates.

The court therefore has to determine exactly what was said, when, by whom, and in what circumstances.

This prevents privacy or expression claims from being evaluated through isolated screenshots without understanding their context.

12. Case Law 4 — UAE Federal Supreme Court Cassation No. 891/2019 Administrative

This case is especially useful because it concerned social-media expression.

A public employee had posted videos on social media stating, in substance, that a group of doctors and pharmacists had been denied justice and that their rights were being violated.

The administrative authority treated the conduct as disciplinary misconduct.

The Federal Supreme Court found that the dismissal sanction was excessive because the statements were connected with the administrative measures taken against the employee and were intended, according to the court's assessment, to report what she believed to be unlawful treatment rather than to insult or defame.

Principle

This case provides one of the strongest UAE examples of contextual proportionality in expression.

The Court considered:

• the content of the expression;
• the surrounding circumstances;
• the speaker's purpose;
• whether the statement was genuinely directed at reporting perceived injustice;
• whether the punishment was excessive.

Importance

It shows that:

Not every harsh or critical statement is automatically equivalent to unlawful insult or defamation.

Context and purpose matter.

13. Case Law 5 — UAE Federal Supreme Court Cassation No. 445/2022 Penal

The Court considered social-media publication through a TikTok account and confirmed the trial court's authority to evaluate the factual circumstances and evidence.

The case involved online publication of material that the prosecution considered contrary to public morals. The Federal Supreme Court emphasised that the trial court may form its conclusion from sufficient evidence when it has properly understood the circumstances and supported its conclusion with adequate reasoning.

Relevance

The case demonstrates that digital expression is assessed through:

• content;
• context;
• evidence;
• statutory restrictions;
• the circumstances of publication.

It also reinforces that the court's assessment must be based on a comprehensive understanding of the circumstances, rather than unsupported assumptions.

14. Case Law 6 — UAE Federal Supreme Court Cassation No. 507/2022 Penal

The Court stressed that a judgment must demonstrate that the court examined the evidence, requests and substantive defences presented by the accused.

Failure to address a material defence can invalidate the decision because it affects the right of defence.

Privacy-expression significance

Suppose a person accused of unlawful disclosure argues:

“The photograph was already publicly available.”

or:

“I published the information solely to report a crime.”

or:

“I had the person's consent.”

Such potentially decisive defences must be properly considered.

Therefore, privacy protection must be balanced with procedural fairness and substantive defence rights.

15. Case Law 7 — UAE Federal Supreme Court Cassation No. 410/2022 Penal

The Court emphasised that judgments must explain their consideration of the elements of the case and material defences.

The Court found a violation of the right of defence where a significant defence was not properly addressed.

Relevance

In privacy-expression disputes, the court should not simply conclude:

“Privacy was violated.”

It should establish:

• what information was involved;
• whether it was private;
• how it was obtained;
• how it was disseminated;
• whether consent existed;
• what statutory provision applies;
• what defence was raised.

This promotes a genuine balancing analysis.

16. Case Law 8 — UAE Federal Supreme Court Cassation No. 660/2023 Penal

The Court again emphasised that trial courts must examine the evidence and material defences and must reach conclusions supported by evidence contained in the case file.

Importance

The case is particularly useful for digital privacy disputes because social-media evidence can easily be:

• incomplete;
• selectively reproduced;
• taken out of context;
• attributed to the wrong person;
• disconnected from earlier communications.

The court must therefore determine the factual context before applying legal restrictions.

17. Case Law 9 — UAE Federal Supreme Court Cassation No. 1422/2022 Penal

The Court stressed that evidence supporting conviction must be sufficiently persuasive and mutually supportive and that the judgment must demonstrate examination of the evidence.

Relevance

A privacy-expression claim should not depend merely upon:

• an anonymous screenshot;
• an unverified account;
• a cropped message;
• an unattributed photograph.

The prosecution or claimant must satisfy the applicable evidentiary requirements.

18. Case Law 10 — UAE Federal Supreme Court Cassation No. 79/2020 Civil

Although not a privacy case, this decision provides an important general evidentiary principle.

The Court held that a qualified admission should be considered as a whole, rather than separating an admission from its qualifications.

Privacy significance

This principle can apply by analogy where:

“I sent the photograph, but only to the person who originally sent it to me.”

or:

“I disclosed the information, but only to a competent authority.”

Context may fundamentally change the legal meaning of the conduct.

Thus:

The court should assess the complete communication rather than isolated words.

19. What Is Actually Balanced?

A UAE court dealing with a privacy-expression dispute can conceptually examine the following factors.

This is not a mechanical mathematical test. It is a contextual legal assessment.

20. The Importance of Consent

Consent can significantly alter the balance.

For example:

Scenario A

A person voluntarily posts a photograph publicly.

Another person reposts it.

The privacy analysis may differ from a situation where:

Scenario B

A person secretly photographs the individual in a private location and publishes the photograph.

The second situation involves a much stronger privacy interest.

However, public availability does not automatically mean unrestricted lawful use for every purpose. The circumstances and applicable legislation still matter.

21. Public Interest

Public interest can be a powerful consideration in expression cases.

Examples include reporting:

• corruption;
• fraud;
• abuse of public office;
• serious misconduct;
• threats to public safety;
• consumer danger.

But the concept should not be confused with:

“The public is curious about this person.”

Public curiosity is not necessarily public interest.

A person's private medical information, family dispute or intimate photograph may attract enormous public attention without becoming legitimate public-interest material.

22. Complaints to Authorities

The UAE legal framework gives particular importance to good-faith complaints made through appropriate channels.

The Crimes and Penalties Law recognises circumstances concerning statements made in the course of legal defence and good-faith reporting to judicial or administrative authorities.

This is an important balancing mechanism.

For example:

Employee reports suspected fraud to a competent authority.

This is fundamentally different from:

Employee publishes an accusation of fraud against the suspected person to millions of social-media users.

The underlying allegation may be identical, but the method and audience are different.

23. Public Figures

The fact that someone is a public official, celebrity, business leader or other prominent person does not eliminate privacy rights.

However, public status can affect the legitimate scope of public discussion.

The court may distinguish:

Public conduct

from

Private conduct.

For example:

A public official's performance of official duties

has a stronger public-interest dimension than

the official's private family communications.

Therefore:

Public status can reduce privacy in some areas without eliminating privacy altogether.

24. Journalistic and Media Expression

Media organisations must balance:

• public-interest reporting;
• accuracy;
• privacy;
• reputation;
• confidentiality;
• source protection;
• personal data.

A journalist investigating alleged wrongdoing may have a stronger justification for publishing relevant facts.

But the publication should remain connected to the legitimate subject.

For example:

Relevant disclosure: documents demonstrating alleged financial misconduct.

Potentially excessive disclosure: unrelated private photographs of the person's family.

The second disclosure may add little public-interest value while substantially increasing privacy intrusion.

25. Proportionality

The principle of proportionality can be expressed through four questions:

1. Legitimate purpose

Is the expression pursuing a legitimate objective?

2. Necessity

Was disclosure necessary to achieve that objective?

3. Suitability

Was the chosen method reasonably capable of achieving the purpose?

4. Excessiveness

Did the disclosure go further than necessary?

This approach closely resembles the risk-assessment logic found in UAE personal-data legislation, which requires attention to necessity, suitability and privacy risks in specified high-risk processing.

26. Private Communication Versus Public Publication

The degree of privacy intrusion often depends upon the audience.

Consider:

Private message → trusted friend

versus

public Instagram post → millions of people

The second creates a much greater potential privacy and reputational impact.

Similarly:

complaint to police

is very different from:

public accusation on social media.

Thus:

Audience is an important factor in proportionality.

27. Photography and Video

Photography is particularly sensitive because it can combine:

• identity;
• image;
• personal data;
• private circumstances;
• reputation.

Article 431 of the Crimes and Penalties Law specifically addresses unauthorised recording/transmission of conversations and photography/transmission of photographs in private circumstances.

Therefore, the court may ask:

1. Where was the photograph taken?
2. Was the person in a private place?
3. Did the person consent?
4. Who took it?
5. Why?
6. Who received it?
7. Was it published?
8. Was there a legal justification?

28. Personal Data Versus Expression

The Personal Data Protection Law introduces another important distinction.

A statement may contain both:

expression

and

personal data.

For example:

“Employee X committed misconduct.”

This contains an expressive assertion but may also involve personal information.

The analysis must therefore determine:

• whether personal data are being processed;
• whether a lawful basis exists;
• whether disclosure is necessary;
• whether the information is sensitive;
• whether another legal regime applies.

The existence of an expressive purpose does not automatically eliminate data-protection considerations.

29. Defamation Versus Privacy

These concepts overlap but are not identical.

Defamation

The principal concern is:

Damage to reputation through an unlawful statement.

Privacy violation

The principal concern may be:

Unlawful intrusion into or disclosure of private information.

A statement can therefore be:

Private but true

and still create a privacy issue.

Conversely:

Public but false

and primarily create a reputation/defamation issue.

And a single publication may potentially implicate both.

30. Truth Does Not Automatically Resolve Every Privacy Question

This is a crucial distinction.

Suppose a person publishes a true medical fact about another person.

The statement may be factually accurate.

But the legal inquiry does not necessarily end there.

The court may still consider:

• whether the information was private;
• whether publication was authorised;
• whether there was a legitimate legal basis;
• whether publication was necessary;
• whether disclosure was proportionate.

Therefore:

Truth and privacy are separate legal questions.

31. Expression Does Not Automatically Justify Personal-Data Disclosure

Likewise, saying:

“I was expressing my opinion”

does not necessarily answer the privacy issue.

For example:

“I think this person is dishonest.”

is expressive.

But publishing:

their private address, private phone number, personal photographs and private messages

may involve a separate privacy/data issue.

The legal system can therefore distinguish opinion from unnecessary personal-data exposure.

32. Cybercrime and Civil Liability

A single online incident may generate multiple consequences:

Criminal

Cybercrime or insult/privacy provisions.

Civil

Compensation for legally recognised damage.

Data protection

Potential regulatory consequences concerning unlawful processing.

Employment

Disciplinary consequences.

Contractual

Breach of confidentiality obligations.

Therefore, the same social-media publication can create several parallel legal questions.

33. The Importance of Intent

Intent can be especially important in criminal cases.

As Cassation No. 1094/2022 illustrates, criminal intent is generally inferred from external conduct and circumstances.

Relevant factors may include:

• repeated publication;
• deliberate tagging;
• selection of audience;
• accompanying comments;
• deletion attempts;
• forwarding;
• threats;
• prior communications.

But intent should not be confused with mere consequence.

A harmful result does not necessarily prove that the speaker intended the precise harm.

34. Procedural Fairness as Part of the Balance

The UAE cases demonstrate that balancing is not solely about substantive rights.

There is also a procedural balance.

A court must ensure:

• proper charge;
• opportunity to defend;
• examination of material evidence;
• consideration of substantial arguments;
• reasoned judgment.

Cassation Nos. 1533/2022, 507/2022, 410/2022 and 660/2023 all illustrate aspects of this principle.

This is particularly important in privacy-expression disputes because the factual context is often decisive.

35. A UAE Privacy-Expression Decision Framework

A court can conceptually proceed through the following sequence:

Step 1 — Identify the expression

What exactly was:

• said;
• written;
• photographed;
• recorded;
• transmitted;
• published?

Step 2 — Identify the privacy interest

Does it concern:

• private life;
• family;
• communication;
• photograph;
• sensitive data;
• reputation?

Step 3 — Determine consent

Was there:

• express consent;
• implied consent;
• no consent;
• withdrawal of consent?

Step 4 — Determine the purpose

Was the purpose:

• journalism;
• criticism;
• complaint;
• public warning;
• commercial activity;
• entertainment;
• humiliation;
• harassment?

Step 5 — Examine legal justification

Is there a recognised legal basis for the disclosure?

Step 6 — Examine necessity

Was disclosure necessary?

Step 7 — Examine proportionality

Did the publication go further than necessary?

Step 8 — Examine harm

What actual or legally recognised harm resulted?

Step 9 — Consider defences

For example:

• truth;
• good-faith complaint;
• legal defence;
• consent;
• public interest;
• lack of attribution;
• lack of intent.

Step 10 — Select proportionate remedy

Possible consequences depend upon the applicable statute and facts and may include:

• dismissal;
• acquittal;
• criminal penalty;
• civil compensation;
• removal or cessation;
• other statutory remedies.

36. Case-Law Comparison

37. Key Distinction: Privacy Versus Secrecy

Privacy is broader than secrecy.

A person may have privacy interests even where information is known to some people.

For example:

A photograph may be known to a small group but still be private in its intended context.

Therefore, the relevant question is not merely:

“Was someone else already aware of it?”

but:

“Was the particular use and dissemination legally authorised and proportionate?”

38. Key Distinction: Public Interest Versus Public Curiosity

This distinction is essential.

Public interest

Information genuinely relevant to:

• public safety;
• public administration;
• serious wrongdoing;
• consumer protection;
• institutional accountability.

Public curiosity

People simply want to know:

• celebrity relationships;
• family disputes;
• private medical information;
• intimate photographs.

The fact that material attracts attention does not automatically make its publication legally justified.

39. Social Media and the Expansion of Harm

Social-media publication creates special concerns because information can be:

• copied;
• forwarded;
• archived;
• screenshot;
• translated;
• algorithmically amplified;
• republished outside the original audience.

Consequently, proportionality should consider the foreseeable reach and persistence of the publication.

A private disclosure to five people and a viral publication to five million people may involve the same underlying information but very different privacy consequences.

40. AI and Automated Privacy-Expression Conflicts

The balancing problem is becoming more complicated through AI.

Examples include:

• AI-generated images of real people;
• deepfakes;
• facial recognition;
• automated profiling;
• AI-generated allegations;
• automated publication;
• scraping personal information;
• generative-AI summaries containing private information.

The Personal Data Protection Law's emphasis on privacy risks, necessity and impact assessment is particularly relevant to high-risk automated processing.

An AI system cannot simply justify disclosure by saying:

“The information was publicly available somewhere.”

The legal analysis must still examine:

• source;
• purpose;
• lawful basis;
• accuracy;
• necessity;
• sensitivity;
• dissemination;
• resulting harm.

41. Proportionality Matrix

This table is analytical rather than a prediction of any particular UAE court outcome.

42. Overall UAE Legal Test

The most useful formulation is:

Privacy + dignity + personal-data protection must be balanced against lawful expression, legitimate criticism, public interest and legally recognised reporting or defence rights, with the final outcome depending on the particular statutory framework, factual context, consent, purpose, necessity, proportionality and evidence.

This is not a free-standing common-law balancing test.

It is a statutory and civil-law proportionality analysis.

43. Conclusion

UAE law gives substantial protection to privacy while recognising that individuals may legitimately communicate, criticise, complain, report wrongdoing and participate in public discussion.

The most important point is that privacy and expression are not automatically winner-take-all rights.

The UAE cases demonstrate several recurring principles:

1. Context matters.
2. Intent can matter.
3. Purpose matters.
4. Consent matters.
5. The method and audience of publication matter.
6. Public interest may strengthen the justification for expression.
7. Unnecessary disclosure of private information weakens that justification.
8. Courts must examine material evidence and defences.
9. Procedural fairness limits state intervention.
10. Digital publication does not eliminate privacy rights.

Most importantly, UAE Federal Supreme Court Cassation No. 891/2019 Administrative demonstrates that the proportionality question can be decisive where social-media expression is genuinely connected with reporting perceived injustice: the Court considered the circumstances and purpose and regarded the dismissal sanction as excessive. Cassation No. 1533/2022 Penal, meanwhile, demonstrates the other side of the balance: privacy-related conduct may attract serious legal consequences, but the accused must be properly charged and tried for the relevant conduct.

The central principle can therefore be stated as:

“Under UAE civil and related privacy law, expression is not a blanket defence to privacy intrusion, and privacy is not a blanket prohibition on expression; the legality of the interference depends on the statutory right involved, consent, purpose, public interest, necessity, proportionality, context, evidence and procedural fairness.”