A Comparative Study of the Jurisprudential and Legal Foundations of Personal Data Protection in Iranian Law and the Legal System of the European Union, with Emphasis on the Principle of Human Dignity

Abstract

Digital transformation and the expansion of the processing of identity-related, biometric, financial, medical, and behavioral data have made the protection of personal data one of the fundamental issues of contemporary law. Violations involving such data, in addition to infringing upon privacy, may undermine individuals’ autonomy, freedom of choice, dignity, and right to informational self-determination. Accordingly, the principle of human dignity constitutes a fundamental basis for regulating the limits of the collection, storage, use, and transfer of personal information. The present study aims to comparatively examine the jurisprudential and legal foundations of personal data protection in Iranian law and the legal system of the European Union, with particular emphasis on the principle of human dignity. The study employs a descriptive-analytical and comparative methodology, and the required data were collected through an examination of sources of Imamī jurisprudence, Iranian legislation, the Charter of Fundamental Rights of the European Union, and the General Data Protection Regulation (GDPR). The findings indicate that, within Imamī jurisprudence, principles such as the inherent dignity of the human person, the prohibition of unlawful inquiry and spying, the prohibition of causing harm, respect for individuals’ dignity and reputation, and the requirement of consent provide substantial normative capacity for justifying the protection of personal data. In Iranian law, the Constitution, the Electronic Commerce Law, and the Computer Crimes Law also provide certain forms of protection; however, the fragmentation of regulations, limitations in their scope of application, the absence of an independent supervisory authority, and the lack of a comprehensive accountability mechanism have reduced the effectiveness of these protections. In contrast, the European Union, by recognizing data protection as a fundamental right, has established a coherent legal framework based on transparency, purpose limitation, data minimization, valid consent, accountability, and independent supervision. The findings of the study indicate that the development of a comprehensive personal data protection regime in Iran should be grounded in the capacities of Islamic jurisprudence and the principle of human dignity and, while taking into account the requirements of the domestic legal system, should draw upon the effective mechanisms developed within the European Union.