Personal Data Protection and Safeguarding Draft Act June 2019 may control their files. If such files contain incorrect personal data or have been collected or processed contrary to the provisions of the law, every individual should have the right to request rectification or elimination".96 This right has been widely incorporated into international law, as well as in major regional agreements on data protection. The European Court of Human Rights has described the right of access as a “vital interest, protected by the Convention”.97 In the GDPR, every individual has a strong right of access. As stated in the recitals: A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians, and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.98 The Citizen Charter99 also outlines this in Article 31: “Citizens have the right to access their personal data collected and kept by persons and institutions providing public services, and to request correction of such data, should they find it to be incorrect. Personal information pertaining to individuals shall not be placed at the disposal of others, save pursuant to the law or with the consent of the individuals themselves.”100 The Publication and Free Access to Information Act prescribes rights to access personal information. Requests for information of this type are the same as for other types of information described in the act. However, under Article 6 of the Act only the person whose information is being requested or their legal representative can ask for such personal information. Under the Article 15 of the Article 8 bylaw of The Publication and Free Access to Information Act, the Iran Information Technology Organization is obliged to provide, within six months and in collaboration with the national post, an operational system of citizens’ national files for access. [Executive Bylaw of Article 8 of The Publication and Free Access to Information Act, Proclamation No: H51979T/84348, 21 September 2015] 96 General Comment 16, ibid at §10. Gaskin v. the United Kingdom, 7 July 1989, § 49, Series A no. 160; M.G. v. the United Kingdom, no. 39393/98, § 27, 24 September 2002; Odièvre v. France[GC], no. 42326/98, § 41-47, ECHR 2003III); Guerra and Others v. Italy, 19 February 1998. 97 98 GDPR, Recital 63. In 2016, President Hassan Rouhani launched the Citizens’ Rights Charter (the Charter). The Charter is in a non-binding document made up of 120 articles which incorporates many of the existing international civil and political and social and economic rights obligations including freedom of expression, privacy, clean environment, and employment. Critics, including Nobel Laureate Shirin Ebadi, have described the Charter as being redundant12 but as described below, it does include new rights relating to access to information not in the Constitution. In 2017 the administration began proposing bills to the Parliament to make its provisions binding in sections. 99 Translation of draft text available at http://epub.citizensrights.ir/CitizensRightsEN.pdf ; Farsi version http://rouhani.ir/files/CitizensRights.pdf. 100 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 30 of 58