Private Law Research

The Attitude of Iranian Law and European Union Law towards Metadata and the Place of Privacy in It

Document Type : Research Paper

Authors

Hossein Khanlari Bahnamiri 1
Mohammad Hossein TAGHIPOUR, 2
, Hamed Aghaaminifashmi, 3

1 Department of Law, Faculty of Humanities, University of Damghan, Damghan, Iran.

2 Department of Private Law, Faculty of Law and Political Science, University of Mazandaran, Babolsar, Iran.

3 PhD student, Department of Private Law, Faculty of Law and Political Science, University of Mazandaran, Babolsar, Iran

https://doi.org/10.22054/jplr.2025.88038.2955
Abstract
One of the current concerns of humanity is the protection of privacy related to metadata. Data is not secure even when processed by the most advanced and powerful companies with financial resources, which makes it more necessary to pay attention to data and metadata in the new era. Metadata is data about data that is created by individuals to achieve a specific goal or function. In fact, metadata is a systematic way that makes information resources accessible and understandable to users. Metadata, such as smartphone metadata, is one of the most important privacy concerns. The concern for citizens of society alike is that metadata, much like data, can reveal sensitive and personal information of a user. In line with the advancement of technology and information technology, the European Union has taken very useful and effective measures to protect the privacy of data and metadata and has pursued the issue of metadata and privacy seriously and in a disciplined manner since 2018, while in Iran this discussion has not been examined in detail and comprehensively; of course, perhaps the risks of violating this privacy have not yet been taken seriously. Therefore, the main question of the research is whether privacy in the field of metadata, as protected in the legal system of the European Union, has been examined in the legal system of Iran? The research method in this article is analytical-comparative, and library resources and online articles and books have been used. The findings show that by examining all Iranian laws regarding the protection of privacy and data, it can be claimed that the discussion of metadata has not been included in these laws at all, and some of the related laws have only addressed data in cyberspace and the importance of privacy. In this regard, although the E-Commerce Law is the best law in providing protection on data privacy issues in Iran, it falls short in respecting important principles of data privacy protection. In fact, the E-Commerce Law, which contains some provisions on data messages, is insufficient in protecting electronic consumers. Iran needs a specific law on the protection of personal data and, of course, metadata. The provisions in the E-Commerce Law do not generally meet some prominent principles of data privacy. For example, it does not fully protect individuals’ personal information and only identifies sensitive personal data such as medical and health data. E-business websites collect information online, but most of them do not have any policy/privacy statement, or at least this policy is not available online, such as the online store Digi Kala. The E-Commerce Law constitutes the primary law in Iran that contains some provisions (Articles 59-61) on the protection of personal data. However, for such a law, the protection of personal data is limited to a specific context, namely, in the context of electronic consumers who deal with online commerce, and there is no mention or attempt to frame the rules on metadata and privacy in this law, which is the most relevant law in Iran in the field of data and privacy. However, regarding privacy and metadata in the European Union, it can be said that the e-Privacy and Communications Regulation is located alongside the European Union Data Protection Law, which are two relatively separate and, of course, complementary laws in the field of metadata and privacy. In fact, the e-Privacy and Communications Regulation implements a European directive, also known as the “e-Privacy Directive”. This institution recognizes that widespread public access to mobile digital networks and the Internet creates new opportunities for businesses and users, but also new risks to their privacy. The European Union is replacing the current Privacy Act with a new Privacy Regulation to align with the EU version of the Data Protection Act. Among the features of this directive are: ensuring the security of electronic communications services, ensuring the confidentiality of communications regarding traffic data, requiring the anonymity of traffic data, requiring full billing by Internet service providers, requiring consent for the processing of users’ static data, and other such matters. As a result, in EU law, electronic communications and metadata privacy laws have a very advanced, comprehensive and enforceable framework, and are being developed with three approaches: (1) service-oriented, (2) data-oriented, and (3) value-oriented, and with respect to the principles governing these approaches such as the principles of transparency, trust, non-discrimination, ownership and control, security, minimum access, informed consent, which create the right of access, the right to rectification, the right to be forgotten (deleted), the right to restriction of processing, the right to data portability, and the right to object for individuals. Although each approach has its strengths and weaknesses, the focus of all three approaches has been on protecting citizens' privacy from metadata. This issue has been clearly addressed in European Union law, but the Iranian legal system, apart from the issuance of an executive directive to improve the protection of user privacy and the method of collecting, processing, and maintaining user information in open space systems and platforms, which was developed with a service-oriented approach, has not addressed much about the importance of metadata and privacy in the new era, and the existing laws are still in their early stages and lack executive details and a supervisory Institution. Therefore, it is recommended to develop a comprehensive law similar to the GDPR, establish an independent supervisory body, or require companies to be transparent in their privacy policies, or enact a specific and comprehensive law using the approaches mentioned in European Union laws, especially the General Data Protection Regulation, which guarantees the rights of data subjects.

Keywords

Metadata
European Union
privacy
Iranian law
supervisory institution
Subjects

  1.  

    23-Alexiadis ,e.g. & P. & M. Cave, ‘Regulation and Competition Law in Telecommunications and Other Network Industries’, in: R. Baldwin, M. Cave & M. Lodge (eds.), The Oxford handbook of Regulation, Oxford University Press,(2010).

    24-Beyene, Wondwossen Mulualem . "Metadata and universal access in digital library environments". Library Hi Tech. 35 (2): 210–221,(2017).

    25- Bennett, C.J, ‘In Defence of Privacy: the concept and the regime’, Surveillance & Society , Vol. 8, No. 4, pp. 485-496,(2011).

    26- Breyer P., ‘Telecommunications data retention and human rights: the compatibility of blanket traffic data retention with the ECHR’, European Law Journal, Vol. 11, No. 3.(2014).

    27-G. Greenleaf ‘Sheherezade and the 101 Data Privacy Laws: Origins, Significance and Global Trajectories’, Journal of Law, Information & Science, Vol. 23, No. 1.(2013)

    28-Steiner, Tobias . "Metadaten und OER: Geschichte einer Beziehung (Metadata and OER: [hi]story of a relationship)". Synergie. Fachmagazin für Digitalisierung in der Lehre (in German). 04: 54.(2017).

    29-Schnabel,  C., ‘Privacy and Data Protection in Electronic Communications Law’, in C. Koenig, et al. (eds), EC Competition and Telecommunications Law, Kluwer Law International.(2009)

    30-R. Clarke ‘Beyond the OECD guidelines: Privacy protection for the 21st Century’, , www.rogerclarke.com/DV/PP21C.html .(2015).

    31-Rouse, Margaret . "Metadata". WhatIs. TechTarget.(2014)

    32-PARK, SEONUK, A Comparative Analysis of US and EU Data Privacy Laws, Publisher : The Institute for Legal Studies Dong-A University, (83), pp.269-310,(2019).

    33-K. McCullagh, ‘The social, cultural, epistemological and technical basis of the concept of’ ‘private’ data’, PhD thesis University of Manchester.(2015).

    34-Mulligan, D. K., Koopman, C., & Doty, N. Privacy is an essentially contested concept: a multi-dimensional analytic for mapping privacy. Philosophical transactions. Series A, Mathematical, physical, and engineering sciences, 374(2083).(2016).

    35-Munir, Bakar A, Yasin, Mohd SH , Information and Communication Technology Law: State, Internet and Information, Legal and Regulatory Challenges. Sweet and Maxwell Asia, Kuala Lumpur.(2010).

    36-Wolff, Josephine . "Newly Released Documents Show How Government Inflated the Definition of Metadata". Slate Magazine. (2013).

    Translated Persian references

    1.Abdipour, Ebrahim, The approach of legal systems towards the violation of information privacy in virtual social networks, Issue 3, Comparative Research Journal of Islamic and Western Law.(2015).

    1. Ali Ahmadi, Hossein, Shoqnian, Arash, Respect for privacy in cyberspace, case study: Iran, Journal of Tomorrow's Management, 57, 144-135. (2018).

    3-AlMassi, Ali, Mohammadian Shirmard, Marzieh. Privacy Criteria in Imami Jurisprudence and Iranian Fundamental Law: Application to Private Vehicles. Jurisprudential Studies on Women and Family Law, 2(3), 29-52.(2019).

     4-Ansari, Baqer, Attar, Shima, Data Protection in China, A Comparative Study with the Approach of Data Protection in the United States and the European Union, Journal of Comparative Law Studies, 13(1), 113-91.(2019).

     5-Badini, Hassan, Karami, Hamzeh, A Comparative Study of the Responsibilities of the Data Controller, Controller and Processor under the European Data Protection Regulations and the Bill on the Protection of Personal Data, Journal of Legal Research, 95, 137-158.(2020).

    6-Bakhshaishi Bayqout, Mohamad, Heidari Munawar, Hossein. Privacy in Iranian Law and International Documents. Quarterly Journal of International Police Studies, 8(29), 207-232.(2017).

    1. Banafi, Fereshteh, Protection of the Right to Information Privacy Against Threats from Military Artificial Intelligence, Private Law Research, 12 (45), 149-176.(2003).

    8.Dehkhoda, Ali Akbar. Dehkhoda Dictionary. Volume 6. Second Edition. Tehran University Press.(2018).

    9-Ghannad, Fatemeh, Protection of Personal Data and Privacy in the Context of Electronic Commerce, Journal of Legal Research, 56, 840-809.(2011).

     10-Ghannad, Fatemeh, Aligholi Amireh, The Concept and Importance of Personal Data and Privacy and Types of Its Protection in Cyberspace, Contract Law and New Technologies, Volume 1, Issue 1; From Page 297 to Page 322.(2010).

     11-Ghannad, Fatemeh and Sharif, Elham, Overview of the Protection of Personal Data in the Iranian Legal System and the General Data Protection Regulation of the European Union, Journal of Law of New Technologies, Issue 4(b), Pages 1-12 ,(2011).

    12.Hosseini, Mehdi, and Borzoei, Mohammad Reza, Fundamentals and Jurisprudential Components of Protecting Individuals' Privacy in Cyberspace, Issue 13, Journal of Islamic Human Rights Studies.(2017).

    13.Jafari Langroodi, Mohammad Jafar, Legal Terminology, 13th Edition, Ganj Danesh Publications.(2003).

    14.Katouzian, Naser and Rahimi, Habibollah, Freedom of Thought and Expression, First Edition, University of Tehran Press. (2003).

    15-Latifzadeh, Mahdieh, Qabulif Darafshan, Seyyed Mohammad Mahdi, Mohseni, Saeed, & Abedi, Mohammad. Protection of personal data in European Union law and its feasibility in the Iranian legal system. Quarterly Journal of Public Law Studies, University of Tehran, 53(2), 981-1005. doi: 10.22059/jplsq.2021.324694.2786 , (2012).

    16.Mojahed, Afshin, A Comparative Approach to Privacy, Issue 13, Journal of Comparative Law Research, Justice and Fairness. (2001).

    17-Mousavi Taha, Seyed Javad, Civil Liability Arising from Violation of Privacy in the Iranian Legal System and Its Comparative Study with Statutory Laws, Issue 1, Journal of Social Science Studies.(2001).

    18- Musazadeh, Ebrahim and Mostafazadeh, Fahim, A look at the concept and foundations of the right to privacy in the customary legal system, No. 2, Danesh Haraq Public Journal.(2012).

    19.Safaei, Seyed Hossein and Jafari, Ali, The relationship between freedom of information and privacy, Issue 33, Islamic Law Journal.(2012).

    20.Shoja Sangchouli, Mehrovieh, Children's right to privacy in Iranian statutory law and the Convention on the Rights of the Child, Law and Modern Studies Winter - Issue 1 (2019).

    21-Shojai Karizaki, Marzieh, The position of individuals' privacy in civil law and statutory laws of Iran, Issue 33, Journal of New Achievements in Islamic Sciences Studies.(2019).

    1. Tohidi, Ahmad Reza, Sharifi Kia, Mohammad Ali. The Limits of the Right to Be Forgotten in Cyberspace, Focusing on the Case Law of the Court of Justice of the European Union, Private Law Research, 12 (47); 231-262.(2003).

     23-Zareyan, Davud, Vaheed, Faezeh, A Study of Data Protection Regulatory Law, Media Journal, 118, 47-72. (2019).

    24-Zarkalam, Sattar, Privacy of Internet Communications (Study in Iranian and European Union Law), Journal of Islamic Law Research, 25, 196-173. (2007).

Private Law Research
Volume 14, Issue 53
Winter 2025
Pages 206-246

Main Page

Editorial Boards

Guide for Authors

Contact Us