Personal Data Protection and Safeguarding Draft Act June 2019 identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.71 Recommendations ● The Draft Act should include a specific provision regulating its material and territorial scope of application. The provision should clearly state that it will apply to all government entities as well as to private bodies. Currently, these rights are not adequately protected by other Iranian legislation. These changes should also be harmonised with the Publication and Free Access to Information Act of 2009. ● Article 3 should be redrafted to put it in line with the principle of non-discrimination in order to apply to every individual and not just citizens and foreign citizens whose data are processed in the territory of Iran. In its current formulation, differentiating citizens and foreign citizens, as well as the exclusion of stateless citizens as regards the scope of application of the Draft Act violates international human rights obligations. ● The Draft Act should specifically remove application of privacy and data protection to corporations. C. Impacts on Freedom of Expression and Information Another significant problem with the Draft Act is its relationship to freedom of expression. As noted above, under international law, states should ensure that the enforcement of data protection rights includes broad exemptions or limitations in order to ensure the exercise of freedom of expression. The Office of the United Nations High Commissioner for Human Rights in their report “The Right to Privacy in the Digital Age”, presented to the Human Rights Council in August 2018, emphasised that: It is important that the legal framework ensures that those rights (i.e. privacy and data protection) do not unduly limit the right to freedom of expression, including processing of personal data for journalistic, artistic, and academic purposes.72 The European Court of Justice has long ruled that states must develop a “fair balance” between the right to privacy and freedom of expression based on the principle of proportionality. As noted by the ECJ in a 2008 case: In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary, first, to interpret notions relating to that freedom, such as journalism, broadly. Secondly, and in order to achieve a balance between the two fundamental rights, the protection of the fundamental right to privacy requires that the derogations and limitations in relation to the protection of data provided for in the chapters of the directive referred to above must apply only in so far as is strictly necessary. The Draft Act, in its introduction, recalls several constitutional provisions, namely Chapter Three in general and some provisions in particular, that the Draft Act aims to implement. Worryingly, the right to freedom of expression enshrined in Article 24 of the Constitution is not mentioned among the other rights such as the right to privacy. As explained above, the two rights are mutually supportive. They should be balanced in a fair manner without giving precedence to one over the other. International human rights law does not recognise a hierarchy of rights. Besides, it is crucial to recognise the importance of freedom of 71 GDPR, Recital 14. See also Art. 4. Annual report of the United Nations High Commissioner for Human Rights and reports of the Office of the High Commissioner and the Secretary-General, A/HRC/39/29 of 3 August 2018. https://www.ohchr.org/Documents/Issues/DigitalAge/ReportPrivacyinDigitalAge/A_HRC_39_29_EN.docx. 72 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 21 of 58