Personal Data Protection and Safeguarding Draft Act ● June 2019 Article 21 imposes a sweeping requirement for ISPs to maintain records of internet traffic data and the personal information of their internet users, whilst Article 48 requires Internet Service Providers to record data from telephone conversations over the internet, in effect legalising mass surveillance. These vague provisions give wide discretion to law enforcement authorities, including the hardline Revolutionary Guards (IRGC), and the Iranian Cyber Police (FATA)50 to arbitrarily arrest and detain individuals on the basis of political motivations. Sanctions include prison sentences and fines, among others. In June 2015, in a notable case, FATA targeted the administrator behind ‘23 anti-cultural groups on the Line and WhatsApp applications that published falsehoods and immoral content’51 violating Article 14 of the CCL. This formed part of a pattern of targeting those sharing content via online platforms in the run up to the presidential elections and after, intended to deter Iranians from seeking and imparting crucial information online. IV. Analysis of the Personal Data Protection and Safeguarding Draft Act Overall, the Draft Act is poorly drafted and includes many inconsistent and conflicting provisions as well as being difficult to understand, which will seriously undermine its effectiveness. Given the lack of effective protections currently in Iranian law, it is crucial that these deficiencies be addressed to ensure that the law is compatible with international standards, fully protecting the data protection rights of all Iranians. Further, it also does not achieve parity with European law, which is apparently a primary purpose of the Draft Act. In May 2018, when the GDPR entered into force, ICT Minister MJ Azari Jahromi announced that a draft data protection Draft Act was expected to be passed in the following months and that constructive talks were hoped for with the EU about mutual and legal assistance.52 The Government in its press release announced that the Draft Act aimed to implement the constitutional right to privacy and to fill the legal gap existing in Iran.53 According to the present analysis, the Draft Act falls short on both aspects as it does not include GDPR compliance, and is not a comprehensive data privacy regulation as it lacks general principles. A. Lack of Principles The first problem with the Draft Act is that the basic principles that govern the law are not clearly stated and outlined in the text. As illustrated above, the UN’s 1990 Guidelines for the Regulation of Computerized Personal Data Files, adopted by General Assembly, requires six principles concerning the minimum guarantees that should be provided in national legislation. They are the principles of lawfulness and fairness, accuracy, purpose specification, interested-person access, nondiscrimination, and security. Only the transparency and security principles are clearly mentioned in Section 3 of the Draft Act. The principles of lawfulness and fairness, accuracy, purpose specification, interested-person access, and non-discrimination are not included in the draft. Such principles state that personal data must be processed lawfully and fairly for specified purposes and on the basis of the FATA was created in 2011 as the cyber crime unit of the Iranian national police force. The unit was created in compliance with the Cyber Crime Laws passed by the Iranian parliament in 2010. http://bbc.in/1VOXj2I. 50 “The Arrest of 23 Admins of WhatsApp and Line groups,” Iran Newspaper, 5 June 2015, http://www.irannewspaper.com/newspaper/BlockPrint/67527 51 MJ Azari Jahromi, ICT Minister of Iran tweeted on 25 May 2018: “Congratulations to @EU_Commission on the implementation of #GDPR, A comprehensive Data Protection rule! I'm also looking forward to passing the #DataProtection bill next months and conducting constructive talks with the EU about mutual legal & technical assistance". https://twitter.com/azarijahromi/status/999968731852877824?s=20. 52 See the Press Release announcing the Personal Data Protection and Safeguarding Draft Act: https://ito.gov.ir/news/-/view/‫اﻧﺘﺸﺎر‬‫ﭘﯿﺶ‬-‫ﻧﻮﯾﺲ‬-‫ﻻﯾﺤﮫ‬-‫ﺣﻤﺎﯾﺖ‬-‫از‬-‫داده‬-‫ھﺎ‬-‫وﺣﺮﯾﻢ‬-‫ﺧﺼﻮﺻﯽ‬-‫در‬-‫ﻓﻀﺎی‬-‫ﻣﺠﺎزی‬/1409. 53 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 17 of 58