Personal Data Protection and Safeguarding Draft Act June 2019 Executive Summary The Government of Iran’s proposals to protect the privacy rights of its citizens in the face of new threats brought by modern technologies, by introducing the Personal Data Protection and Safeguarding Draft Act, are a welcome effort. Overall, however, the Draft Act is poorly drafted and inconsistent with the international legal obligations of Iran to adequately protect the privacy rights of its citizens. The Draft Act departs from international standards on data protection and threatens the right to freedom of expression. ARTICLE 19 is also deeply concerned about the independence of the body in charge of overseeing the application of the Draft Act, as well as the lack of adequate remedies for individuals to counter violations of their rights and to seek compensation for any damage suffered. We urge the Iranian government to amend the Draft Act in accordance with the below recommendations, to ensure it complies with international human rights standards and properly protects the privacy rights of people in Iran. Recommendations: 1. The Draft Act should be redrafted to reorganise and streamline, fully incorporating the principles set out in international law in the text of the law and in a specific section placed after Section Two that presents the “Definitions”. 2. The Draft Act should include a specific provision regulating its material and territorial scope of application. The provision should clearly state that it will apply to all government entities as well as to private bodies. Currently, these rights are not adequately protected by other Iranian legislation. These changes should also be harmonised with the Publication and Free Access to Information Act of 2009. 3. Article 3 should be redrafted to bring it into line with the principle of non-discrimination, ensuring that the Bill applies to every individual - not just citizens and foreign citizens whose data are processed in the territory of Iran. In its current formulation, differentiating citizens and foreign citizens, as well as the exclusion of stateless citizens, the Draft Act violates Iran’s international human rights obligations. 4. The Draft Act should specifically remove the application of privacy protections to corporations. 5. The Introduction should be redrafted in order to recall the right to freedom of expression as enshrined in the Constitution and to mention the Charter of Citizens’ Rights that provides a framework for the protection of the right to freedom of expression, the right of access to information, the right to privacy, and to data protection in Iran. The Draft Act should take into account Iran’s responsibilities as State party to the ICCPR, most notably Articles 17 (the right to privacy) and 19 (the right to freedom of expression). 6. Article 12 should be revised in order to include an exemption to processing that is intended to communicate information to the public, ideas, or opinions of general interest—including for journalistic purposes and the purposes of academic, artistic, or literary expression. Article 12 should also include assurances that due process is followed when accessing data without consent by better clarifying what the purpose of preventing or answering threats to order, security, or public safety means. Such terms could also be defined in Article 2 which presents “Definitions” in order not to empower authorities to abuse the rights of individuals, especially in efforts to repress and prosecute human rights defenders, minorities, journalists, bloggers, and activists. 7. The Draft Act should also ensure that journalists and other public interest communicators—including nongovernmental organisations that are publishing information of public interest—are protected from being forced to reveal the sources of their information. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 2 of 58