Personal Data Protection and Safeguarding Draft Act June 2019 Table of Contents Executive Summary 2 About the ARTICLE 19 Transparency and MENA Programme 6 I. Introduction 7 II. Data Protection and Freedom of Expression and Information 7 A. The Right to Privacy 7 1. Data Protection 8 2. Data Protection in Europe and Elsewhere 9 3. National Developments B. Balancing Privacy and Freedom of Expression and Information III. The Legal Framework in Iran 10 10 13 A. Constitution of 1979 13 B. Laws Protecting the Right to Privacy in Iran 13 C. Other Non-Binding Legal Instruments 14 D. Problematic Provisions of Laws for Freedom of Expression 14 IV. Analysis of the Personal Data Protection and Safeguarding Draft Act 17 A. Lack of Principles 17 B. Unclear Application of the Draft Act 18 C. Impacts on Freedom of Expression and Information 21 1. Failure to Include Journalistic, Artistic, Literary, and Other Cultural Exemptions 22 2. The Right to be Forgotten 23 3. Localisation Requirements 25 4. Failure to Balance Data Protection with the Right to Information 26 D. Limitations on Access Rights 29 E. Independence of the Data Protection Commission and Other Oversight Bodies 31 1. Structure and Powers 31 2. Problems of Independence in Bodies 32 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 4 of 58