Personal Data Protection and Safeguarding Draft Act June 2019 acts, expressions and transactions is subject to scrutiny by others trying to control him or her. Exercise of these freedoms is crucial to maintain all fundamental rights.33 Thus, it is crucial to not treat the relationship of the two rights as a “zero sum” game, in which one “wins” over another, but to recognise their mutually supporting mechanisms. III. The Legal Framework in Iran In Iran, there are a number of legal instruments about privacy and data protection, both binding and non-binding, which provide some, but not comprehensive protections. Notably, these are the Islamic Republic of Iran Constitution, Electronic Commerce Law, Computer Crimes Law,34 Islamic Penal Code and Civil Liability Act. Further, the right to privacy and data protection are mentioned in the Charter of Citizens’ Rights which is a non-binding legal instrument for the protection of human rights. The relevant provisions and principles are summarised below. However, there remains a significant gap relating to data protection. The Personal Data Protection and Safeguarding Draft Act constitutes the first attempt to introduce comprehensive legislation that regulates how personal information is used by organisations, businesses, or the government. A. Constitution of 1979 The 1979 Constitution contains provisions on freedom of expression, access to information, and privacy. Article 24 provides limited guarantees to the right to freedom of expression, as recognised by international law; it narrowly focuses on publications but does not expressly provide for a right to information. This right is limited by constitutional provisions that limit the freedom of expression on the basis of the protection of Islam or public rights. Article 25 enshrines the right to privacy and data protection as qualified ones, by providing that the inspection of letters and the failure to deliver them, the recording and disclosure of telephone conversations, the disclosure of telegraphic and telex communications, censorship, or the wilful failure to transmit them, eavesdropping, and all forms of covert investigation are forbidden. Article 3 on “state goals” requires that the government has a duty to use its resources for achieving several goals including reducing corruption and “raising the level of public awareness in all areas, through the proper use of the press, mass media, and other means”. B. Laws Protecting the Right to Privacy in Iran The Computer Crimes Law that was enacted in 2009 contains several provisions ensuring the rights of individuals, including ensuring that consumers have privacy protections. Under this law, any oral or printed disclosure of personal information, fabrication of facts to publicly vilify the dignity of persons, or damage the reputation through insults and defamation, and casting aspersions on individuals are considered a breach of the reputation of others, and therefore treated as defamation.35 It sets criminal penalties of imprisonment from one to five years and/or a fine for those who invade individual privacy through the use of electronic systems for “Every person who, without authority, steals data belonging to others, while the original data European Commission, Commission Staff Working Paper, Impact Assessment Accompanying the document Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), SEC(2012) 72 final, 25 January 2012. 33 ARTICLE 19, Islamic Republic of Iran: Computer Crimes Law, Legal Analysis (2012) https://www.article19.org/data/files/medialibrary/2921/12-01-30-FINAL-iran-WEB%5B4%5D.pdf. 34 35 Iran Computer Crimes Law, Chapters 4 and 5, ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 13 of 58