Personal Data Protection and Safeguarding Draft Act June 2019 They should be subject to an assessment of harm which must be serious either immediately or subsequently. They should also be subject to an evaluation of public interest for providing or denying information for each request separately, which considers the relative interests that need to be protected and the purpose of the access request. There have been a number of decisions in the context of access to information91 on how to balance the two rights. The UK Information Commissioner has noted that: The public interest can cover a wide range of values and principles relating to the public good, or what is in the best interests of society. Thus, for example, there is a public interest in transparency and accountability, to promote public understanding, and to safeguard democratic processes. There is a public interest in good decision-making by public bodies, in upholding standards of integrity, in ensuring justice and fair treatment for all, in securing the best use of public resources and in ensuring fair commercial competition in a mixed economy. This is not a complete list; the public interest can take many forms. The Commentaries on the revised version of the CoE Modernised Convention 108 explain that the Convention confirms that the exercise of the right to data protection, which is not absolute, should notably not be used as a general means to prevent public access to official documents.92 Unfortunately, the Draft Act fails to take into consideration and to balance the right to data protection and the right of access to information. In Iran, the right to information is enabled by the Publication and Free Access to Information Act. Under Article 14, information relating to privacy or personal data can be withheld when it would harm the person’s interest. The exemptions are not considered absolute93. However, it should be noted that the Publication and Free Access to Information Act also falls short of balancing the right to privacy and right to information as described above. Under Article 9 of the bylaw: “[i]nstitutions subject to this Act are prohibited from publishing or providing private information that is considered restricted by law unless ordered otherwise by law.” 94 The definition of such private information does not clarify that under best practice and public interest, such personal information should not apply to names of officials or their official activities. The Publication and Free Access to Information Act also currently provides privacy protection for such information which is necessary to be published because of public interest. For example, under the Yemen right to information law (2012), personal information can be released if it is “connected to the duty or function or public office held by that individual.”95 In contrast, the Draft Data Protection Act makes no reference to the Publication and Free Access to Information Act. Article 12 of the Draft Act lists several conditions under which the processing of private data within the framework of relevant laws without data subjects’ consent is allowed. It mentions in particular cases when it is necessary for safeguarding the person’s reputation, life, or property or for the reputation and life of another person or preventing acute financial damage to them. There is no exemption for enabling the right to information and considering the public interest in the release of information. This provision appears to set up a conflict of laws with the Publication and Free Access to Information Act. Inter-American Court of Human Rights, Case of Claude-Reyes et al. v. Chile Judgment of September 19, 2006. Explanatory Report to the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, 10 October 2018, par 11. 91 92 This simply means that exemptions must have limited scope, be clearly and narrowly down and subject to strict harm and public interest test. This is important to ensure that public registers and other information relating to the operation of government or in the public interest also remain public, and are not unnecessarily restricted in the name of data protection. 93 Executive Bylaw of Article 9 of The Publication and Free Access to Information Act, Proclamation No: H51979T/84348, 21 September 2015 95 Law (13) for the Year 2012 Regarding the Right of Access to Information, §25(B). 94 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 28 of 58