The Government of Iran’s proposals to protect the privacy rights of its citizens in the face of new threats brought by modern technologies, by introducing the Personal Data Protection and Safeguarding Draft Act, are a welcome effort.
Overall, however, the Draft Act is poorly conceived and inconsistent with the international legal obligations of Iran to adequately protect the privacy rights of its citizens: the Draft Act departs from international standards on data protection and threatens the right to freedom of expression. ARTICLE 19 is deeply concerned about the independence of the body in charge of overseeing the application of the Act, as well as the lack of adequate remedies for individuals to counter violations of their rights, and to seek compensation for any damage suffered.
We urge the Iranian government to amend the Draft Act in accordance with the recommendations below and to ensure it complies with international human rights standards and adequately protects the right to privacy for the Iranian people.
Recommendations:
- The Draft Act must be redrafted to fully incorporate the principles set out in international law in the text of the law and in a specific section placed after Section Two that presents the “Definitions”.
- The Draft Act should include a specific provision regulating its material and territorial scope of application. The provision should clearly state that it will apply to all government entities as well as to private bodies. Currently, these rights are not adequately protected by other Iranian legislation. These changes should also be harmonised with the Publication and Free Access to Information Act of 2009.
- Article 3 should be redrafted to bring it into line with the principle of non-discrimination, ensuring that the Bill applies to every individual – not just citizens and foreign citizens whose data are processed in the territory of Iran. In its current formulation, differentiating citizens and foreign citizens, as well as the exclusion of stateless citizens, the Draft Act violates Iran’s international human rights obligations.
- The Draft Act should specifically remove the application of privacy protections to corporations.
- The Introduction should be redrafted in order to recall the right to freedom of expression as enshrined in the Constitution and to mention the Charter of Citizens’ Rights that provides a framework for the protection of the right to freedom of expression, the right of access to information, the right to privacy, and to data protection in Iran. The Draft Act should take into account Iran’s responsibilities as State party to the ICCPR, most notably Articles 17 (the right to privacy) and 19 (the right to freedom of expression).
- Article 12 should be revised in order to include an exemption to processing that is intended to communicate information to the public, ideas, or opinions of general interest—including for journalistic purposes and the purposes of academic, artistic, or literary expression. Article 12 should also include assurances that due process is followed when accessing data without consent by better clarifying what the purpose of preventing or answering threats to order, security, or public safety means. Such terms could also be defined in Article 2 which presents “Definitions” in order not to empower authorities to abuse the rights of individuals, especially in efforts to repress and prosecute human rights defenders, minorities, journalists, bloggers, and activists.
- The Draft Act should also ensure that journalists and other public interest communicators—including non-governmental organisations that are publishing information of public interest—are protected from being forced to reveal the sources of their information.
- Ensure that any rules on the deletion of public information are balanced with freedom of expression and the public interest in accessing information and historical archiving by applying ARTICLE 19’s seven-part test to the “right to be forgotten” in Article 9.
- Remove requirements that all personal data be subject to data localisation.
- Amend Article 12 to include an explicit exemption for personal information relating to public activities of public officials or others acting under public authority or spending public money to reflect the right of information enshrined in the Constitution and the public interest in obtaining information.
- The Draft Act should specifically recognise the public interest provisions granted by the Publication and Free Access to Information Act to public bodies and ensure that the public interest is considered in any request.
- Clarify Article 10 to ensure that persons have full and free access to their personal information held by third parties except in limited instances allowed under international law, most notably ICCPR General Comment No 16. Define what “public classified information” means under Article 10.
- Grant data subjects a right of correction.
- Ensure that the Commission is fully independent from the government and give it binding powers to order stopping of processing, correction, release of personal information to the subject, and other powers.
- Give individuals a specific right to appeal the Commission’s decisions to a court.