Iranian newspaper Shargh has published details of a new parliamentary draft to regulate cyberspace. It proposes requiring digital service providers to verify users’ identities and imposing financial and administrative penalties on violators, while redistributing responsibility for internet management among Iranian institutions.
The draft remains under parliamentary consideration
The text remains under consideration and has not reached the parliament’s plenary session. The newspaper said the second version was distributed to several lawmakers on 26 August for their comments. The text was shortened from 20 pages and 11 articles in its first version to 5 pages and 8 articles, while the proposed obligations and penalties for companies and users were tightened.
Lawmaker Hossein Ali Haji Deligani, whom the newspaper identified as having prepared the new version, said the project’s general principles had been approved by a joint committee and that its details remained under consideration. The newspaper, however, cited conflicting accounts from lawmakers about whether the committee had completed its work, leaving the project’s legislative stage unresolved.
Verifying users’ identities and ages
Article 5 considers providing a service before verifying a user’s identity a violation, under the rules of the “Trusted Identity System in Cyberspace”. The draft also links the provision of digital products and services to those under 16 to age verification through the national identity database, without disclosing personal data to the service provider.
The text contains a discrepancy in defining a child’s age: Article 6 uses under 16, while the tables in Article 4 refer to those under 18. The draft allows regulators to impose one or more penalties on violating service providers, including publishing the violation in newspapers, restricting advertising for between 6 months and 3 years, and barring the recruitment of new users for between 5 days and 3 months.
The draft assigns the review of violations to a 3-member panel comprising a judge chosen by the head of the judiciary, one of the deputy heads of the National Cyberspace Center, and an expert nominated by the National Virtual Businesses Union. The panel’s decisions may be challenged before the Administrative Justice Court.
Network neutrality and removal of criminalisation of virtual networks
The new version refers to the “right of access to the network” and “network neutrality”, and bars telecommunications companies from discriminating between data traffic on the basis of content, service, source or destination. It nevertheless exempts the blocking of unauthorised content and services pursuant to decisions by the Committee for Determining Instances of Criminal Content.
The draft does not retain the provision in the first version that explicitly criminalised using and distributing virtual private networks. This only removes explicit criminalisation from the new text and does not settle the legal status of all services that circumvent blocking.
Expanding the powers of the National Cyberspace Center
Article 2 expands the powers of the National Cyberspace Center, making it responsible for overseeing the implementation of decisions by the Supreme Cyberspace Council and a command centre for cyber security operations, while requiring executive institutions to implement its directives. It also gives the center observer status on councils, committees and bodies involved in digital decisions.
By contrast, the draft limits the Communications Ministry’s main role to regulating networks and infrastructure, telecommunications operators, cloud services and data centers, while assigning other areas to the central bank, the Securities and Exchange Organization, the Competition Council and specialised institutions. Deputy Communications Minister for Legal Affairs Mohammad Hatami Zadeh said the ministry had objected to provisions in both versions, considering that the new text still contained structural and legal problems.
Deputy Communications Minister Ehsan Jit-Saz also warned that distributing powers among more than 20 institutions could lead to institutional conflicts over jurisdiction. Jit-Saz pointed to what he described as positive elements, including network neutrality, preventing conflicts of interest, allowing appeals against penalties, and opening draft regulations to public comment.
He proposed redrafting the project as a comprehensive government bill after assessing its legal and practical effects, and establishing a digital regulation authority to coordinate among the relevant bodies.
The obligations and penalties in the draft remain unenforceable proposals until discussions are completed and it is approved by parliament, followed by review by the Guardian Council.
