Personal Data Protection and Safeguarding Draft Act June 2019 The Data Protection Commission is designated to oversee the Act. The Commission is formed by the ICT Minister as head of the Commission, with additional members: the Intelligence Minister, the Interior Minister, the Justice Minister, the Culture Minister, the Finance Minister, the Secretary of High Council for Cyberspace, the head of the National Center for Cyberspace, the deputy head of the Judiciary in charge of the Prevention Department, the Head of the Article 90 Committee of the Majlis (Parliament), the National Prosecutor, and the Secretary of the Information Technology executive council as the Commission’s secretary. Powers for the Commission are set out in Articles 41 and 42. The Commission is given powers to regulate and supervise the expert working groups that are also in charge of overseeing the Act and more generally, to coordinate the organs in charge of the implementation. The working groups determine the regulatory and supervisory affairs. The Supervisory Board will supervise how well the supervisory tasks of expert working groups are being fulfilled and will receive complaints from stakeholders in personal data safeguarding and following up on them. This is clearly a function for the Commission staff to be handling rather than any oversight body. A Special Supervisor will be appointed pursuant to Article 54 for the processing of vital and sensitive personal data, grand processing of personal data, serious and numerous damages of processing of personal data, and other tasks as determined by the Supervisory Board. According to the present Draft Act, all powers and tasks in relation to the application of the Law will be established by the Commission. It is unclear why it is necessary to create such a complex structure while other countries have a single commission under which all activities are conducted by a secretariat and perhaps an oversight board who reviews its activities. 2. Problems of Independence in Bodies Two issues are of concern in relation to the Commission as set out. Firstly, it is composed solely of Government ministers and other representatives of security-related State bodies. This composition clearly lacks representatives whose field of expertise pertains to human rights or consumer rights. Secondly, the Commission sits in the headquarters of the ICT Minister. This constitutes a further aspect of great concern about the independence of the oversight body. It should also be noted that the Draft Act proposes that the Supervisory Board and the Commission have members in common such as the Minister of Justice. This aspect poses a serious threat to the independence of the oversight bodies. International law clearly requires that the oversight body must be functionally and administratively independent from all public authorities. The 1990 Guidelines for the regulation of computerised personal data files state: The law of every country shall designate the authority which, in accordance with its domestic legal system, is to be responsible for supervising observance of the principles set forth above. This authority shall offer guarantees of impartiality, independence vis-a-vis persons or agencies responsible for processing and establishing data, and technical competence. 104 More recently, the General Assembly Resolution on the Right to Privacy in the Digital Age of 19 December 2016 called on states to: Establish or maintain existing independent, effective, adequately resourced, and impartial judicial, administrative, and/or parliamentary domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception, and the collection of personal data.105 104 105 Guidelines for the Regulation of Computerized Personal Data Files, G.A. res. 45/95, 14 December 1990, paragraph 8. The right to privacy in the digital age, G.A. res. 71/199, 19 December 2016 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 32 of 58