Personal Data Protection and Safeguarding Draft Act June 2019 else where laws of a EU Member State apply by virtue of public international law. This can be the case in diplomatic missions or consular posts of EU Member States. According to international standards, it is crucial that the law applies to private as well as to public bodies. The UN Human Rights Committee and the UN General Assembly Declaration have both specifically stated that the right to privacy, as protected by data protection legislation, applies to information held by both private and public sector bodies. It is also generally recognised that the right to privacy creates positive obligations for states to also ensure that they adopt laws to protect all persons against attacks through legislation and actions. The UN HR Committee in General Comment No. 16 stated that: In the view of the Committee this right is required to be guaranteed against all such interferences and attacks whether they emanate from State authorities or from natural or legal persons. The obligations imposed by this article require the State to adopt legislative and other measures to give effect to the prohibition against such interferences and attacks as well as to the protection of this right.59 The UN General Assembly in the Guidelines on data protection for the Regulation of Computerized Personal Data Files, in relation to the “The Field of Application”, stated that: The present principles should be made applicable, in the first instance, to all public and private computerised files as well as, by means of optional extension and subject to appropriate adjustments, to manual files. Special provision, also optional, might be made to extend all or part of the principles to files on legal persons particularly when they contain some information on individuals.60 Nearly every data protection law in the world applies to the processing of personal information of both public and private bodies. This includes those in the region. The 2018 Algerian Data Protection Law, passed in 2018, has a provision that explicitly states that it applies to both the private sector and public bodies.61 In Qatar, the Protection of the Privacy of Personal Data Law states that the Act applies to “personal data upon e-processing thereof, when such Personal Data are received, collected, and mined in any other way in anticipation of e-processing the same".62 Similarly, the long existing data protection laws in Morocco63 and Tunisia also explicitly apply to public and private bodies.64 A clear definition of its scope of application will ensure legal certainty and accountability particularly in relation to public institutions when processing individual data. Therefore, the provision should be drafted in a way that clearly states that the law applies both to the private and public sector. 2. Discriminatory Application on Grounds of Citizenship Article 3 of the Draft Act states that it applies to “Iranian citizens (individuals and corporations), public or private, whether their private data is being processed inside or outside Iran, and to foreign citizens (individuals and corporations), public or private, only if their data is processed by Iranian processors and controllers". This provision is in violation of the principle of non-discrimination as it makes a distinction between data subjects according to their citizenship. The UN HR Committee in General Comment No. 16 states that: United Nations Human Rights Committee, General Comment No. 16: The right to respect of privacy, family, home and correspondence, and protection of honour and reputation (Art. 17), CCPR/C/GC/16, 4 August 1988. 59 Guidelines for the Regulation of Computerized Personal Data Files, G.A. res. 45/95, 14 December 1990, http://www.un.org/documents/ga/res/45/a45r095.htm. 60 61 Algeria Law on the Protection of physical persons for the processing of personal data, 10 June 2018, Art. 4. 62 Qatar, Law No. 13 of 2016 Promulgating the Protection of the Privacy of Personal Data Law, Art. 2. 63 Morocco, Law 09-08 on the protection of individuals with regards the processing of personal data, Art. 2. 64 Tunisia, Law No. 2004-43 of 27 July 2004 on the Protection of Personal Data, Art. 2. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 19 of 58