Personal Data Protection and Safeguarding Draft Act June 2019 V. Conclusion The Personal Data Protection and Safeguarding Draft Act is in clear need of improvements to ensure that Iran is compliant with its international obligations on data protection and privacy, as well as to ensure compliance with the GDPR and other laws to facilitate the transborder flow of personal information. The Draft Act is insufficient to provide those protections, and further endangers free expression and right of access to information under the Iranian constitution. It omits international standards and laws, and leaves data subjects vulnerable to problematic provisions of the Islamic Penal Code and the Computer Crimes Law. The implications of this Draft Act for freedom of expression are numerous. Most significantly, the realities of this law’s enforcement of data localisation towards the centralisation of information and granting of control to Iranian authorities is concerning. Significant omissions and concerns exist about the independence of the Data Protection Commission and oversight bodies in ensuring that due process is applied. Additionally, the lack of clear remedies for violations of the rights of data subjects is a dangerous omission given the dangerous precedent set within the Iranian judiciary for persecution and harassment of individuals practicing their right to freedom of expression. The Draft Act should be sent back to the draft committee with public and expert consultations held prior to reintroduction in Parliament. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 36 of 58