Personal Data Protection and Safeguarding Draft Act ● ● ● June 2019 Whether the information is part of the public record; Whether the applicant has demonstrated substantial harm; and How recent the information is and whether it retains public interest value.81 Beyond the test, ARTICLE 19 recommends procedural protections on the implementation of the right: ● The courts should be tasked with balancing the relevant interests at issue rather than search engines or data protection authorities. ● Content providers should be notified that a “right to be forgotten” request has been made in relation to their content and be able to challenge such requests. ● Relevant providers, public authorities and the courts should be required to publish transparency reports about ‘RTBF’ requests. 3. Localisation Requirements The Draft Act also appears to limit Iranians’ access to websites and common services available on the internet, in violation of individuals’ freedom of expression, in the name of data protection. Chapter 3, Section 5 of the law sets limits on “foreign-based processing”. Article 38 states: For the processing of personal data of Iranian citizens, the following conditions need to be met: A) They can only be stored in the data centers located in the sovereign realm of the Islamic Republic of Iran or the foreign-based data centers approved by the relevant authorities. This section is problematic from a freedom of expression standpoint. Such “data localisation” laws have been used in a number of jurisdictions as a pretense to limit access to social media platforms. In Russia, they are being used to limit access to Twitter and Facebook. In addition, forced data localisation makes it easier for authorities to access the private communications of dissidents and others. The provision also violates the principle of non-discrimination by referring to the personal data of Iranian citizens.82 It is also unclear which process is to be followed for localisation as point B mentions the “issuing of a license by relevant authorities” without clarifying which ones are involved. The provision goes on by saying that personal data shall be transferred to foreign countries via “trustable communication networks” without providing any definition of what this means under the law. The Special Rapporteur for Freedom of Expression and Information of the Organization of American States has noted the problems with localisation: The forced localisation of data may be a mechanism for the restriction of freedom of expression for various reasons. First, the forced localisation of internet intermediaries substantially reduces the supply of services and platforms that users can freely access. It is important to note that the freedom to choose which services and platforms to access is a prerogative of users in the exercise of their freedom of expression and cannot be restricted by governments without violating the unique nature of the internet as a free, open, and decentralised medium. This opportunity to choose is essential in many States in which individuals are subjected to arbitrary interference in their privacy by the States. In such cases, the opportunity to choose the uninhibited exercise of freedom of expression. In other words, the absence of adequate local laws or public policies for the protection of data could cause greater insecurity in the access to data if they are located in a specific country, as opposed to being stored in multiple locations or in places that offer better safeguards. ARTICLE 19, The “Right to be Forgotten”: remembering Freedom of Expression (2016) available here https://www.article19.org/data/files/The_right_to_be_forgotten_A5_EHH_HYPERLINKS.pdf. 81 82 For the distinction posed by the Draft Act between Iranian citizens and foreign citizens see S ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 25 of 58