Personal Data Protection and Safeguarding Draft Act June 2019 As a primary step, the data protection Draft Act should be amended to include an explicit exemption for personal information relating to public activities of public officials or others acting under public authority or spending public money. Such amendment will reflect the right of information enshrined in the Publication and Free Access to Information Act. In this regard, the Draft Act risks being a step backwards and undermining the rights given under the Publication and Free Access to Information Act and protected by the Constitution. Recommendations ● The Introduction should be redrafted in order to recall also the right to freedom of expression as enshrined in the Constitution and to mention the Charter of Citizens’ Rights that provides framework for the protection of the right to freedom of expression, the right to access to information, the right to privacy and to data protection in Iran. The Draft Act should take into account Iran’s responsibilities as State party to the ICCPR, most notably Articles 17 (the right to privacy) and 19 (the right to freedom of expression). ● Revise Article 12 in order to include an exemption to processing that is intended to communicating information to the public, ideas, or opinions of general interest including for journalistic purposes and the purposes of academic, artistic or literary expression. Article 12 should also include assurances that due process is followed when accessing data without consent by better clarifying what the purpose of preventing or answering threats to order, security or public safety means. Such terms could also be defined in Article 2 which presents “Definitions” in order not to empower authorities to abuse rights of individuals, especially in efforts to repress and prosecute human rights defenders, minorities, journalists, bloggers and activists. ● The Draft Act should also ensure that journalists and other public interest communicators—including nongovernmental organisations that are publishing information of public interest—are protected from being forced to reveal the sources of their information. ● Ensure that any rules on the deletion of public information are balanced with freedom of expression and the public interest in accessing information and historical archiving by incorporating ARTICLE 19’s seven-part test to the “right to be forgotten” into Article 9. ● Remove requirements that all personal data be subject to data localisation. Replace with ensuring adequacy of data protection in foreign jurisdiction. ● Amend Article 12 to include an explicit exemption for personal information relating to public activities of public officials or others acting under public authority or spending public money to reflect the right of information enshrined in the Constitution and the public interest in obtaining information. ● The Draft Act should specifically recognise the public interest provisions granted by the Publication and Free Access to Information Act to public bodies and ensure that the public interest is considered in any request. D. Limitations on Access Rights The right of individuals to obtain access to personal information about themselves held by third parties (known usually as the “Subject access right” or "Interested-Person Access”) including public bodies and private companies is a fundamental right recognised under international law. The UN Human Rights Committee in General Comment 16 noted that the right is necessary in order to ensure respect of the right to privacy: “In order to have the most effective protection of his private life, every individual should have the right to ascertain in an intelligible form, whether, and if so, what personal data is stored in automatic data files, and for what purposes. Every individual should also be able to ascertain which public authorities or private individuals or bodies control or ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 29 of 58