A Comparative Study of Personal Information Property Rights in Cyberspace in Iranian and Iraqi Law

Abstract

This article examines the ownership of personal data in cyberspace through a comparative lens between Iranian and Iraqi law. It develops a conceptual framework that delineates personal data categories and the threshold for attribution to an identifiable natural person, then maps the operative legal toolkit across constitutional guarantees, e-commerce rules, cybercrime provisions, consumer-protection norms, and evidentiary rules. The findings indicate that neither jurisdiction recognizes an in rem property right in data; instead, both construct an “operational bundle of rights” grounded in lawfulness, consent, purpose limitation, data minimization, and access/rectification/erasure, reinforced by criminal protection of confidentiality, integrity, and availability. Practically, Iran provides more granular protections for “data messages” under its E-Commerce Law, while Iraq offers stronger recognition of the probative value of electronic records and signatures, complemented by consumer-law transparency duties. The paper proposes a hybrid model of “operational ownership” that balances data subjects’ control with investment protection for digital infrastructures, and advances civil, criminal, and procedural enforcement pathways, alongside legislative recommendations to harmonize definitions, clarify stakeholder positions, and enhance compliance certainty in cross-border processing.