Cabinet and is effectively dormant. In its current form, the proposed legislation fails to establish
adequate protections for online privacy or data protection.4 The draft law mandates enforced data
localisation (Article 38), in line with the National Information Network (NIN) project, which
means there are no privacy provisions (as per Article 10 of the CCL) and it is subject to abuse
from the Iranian authorities looking to prosecute journalists, human rights defenders, minorities,
and other vulnerable identities. Other key concerns include the fact that the Draft Act protects
only the data rights of Iranian citizens and fails to explicitly include journalistic, artistic, literary
or other cultural exemptions, or protect the right to information.5
The current legislative data protection and online privacy vacuum means that legal protections
and defences are not available to those arrested or detained for their online activities, or for those
impacted by data and privacy breaches.
Additionally, in October 2019, Iran’s top internet policy-making body, the Supreme Council for
Cyberspace, passed the ‘Valid Identity System in Cyberspace’ resolution, which outlines its
future plans to require all online interactions between two entities to be traceable and conducted
using a valid form of ID. Such a policy threatens to undermine user privacy online, and if
implemented fully would effectively bring an end to online anonymity.6
In light of the above, the rights enunciated under Article 17 cannot be exercised without any
limitations or restrictions other than those provided for in the ICCPR in the Islamic Republic of
Iran.
B. The right of Freedom of Expression, Freedom of Assembly and Freedom of
association (Articles 19, 21, 22) should be exercised without any limitations or
restrictions other than those provided for the Covenant.
While Article 27 of the Constitution ostensibly protects the right to freedom of peaceful
assembly, the guarantee falls short of international standards set out in the International
Covenant on Civil and Political Rights (ICCPR) by requiring that participants are not “in
violation of the fundamental principles of Islam”. There is no clear definition or criteria that
define what constitutes “fundamental principles of Islam”. Under Article 2 of the Law on
Political Crimes, adopted in 2016, participation in an unauthorized assembly, even if it is
peaceful, can effectively be considered a political offence.7 Unauthorised assemblies had
previously been prohibited under the 1981 Law on the Activities of Parties, Populations and
4
See page 27 of “Bills, Bills, Bills — Upcoming Policy Challenges in Iran”, Small Media. 9 April 2019.
https://smallmedia.org.uk/media/articles/files/Filterwatch_BillsBillsBills19.pdf
5
“Iran: Personal Data Protection and Safeguarding Draft Act,” ARTICLE19. 27 June 2019.
https://www.article19.org/resources/iran-dataprotection-draft-act/
6
Small Media, ‘Filterwatch October 2019’, 15 November 2019, available at: https://medium.com/filterwatch/filterwatch-october2019-d671d23e52c
7
The 2016 Law on Political Crimes, available at: https://rc.majlis.ir/fa/law/show/968421
2