Tunisia's proposed ID law threatens hard-won privacy rights

For all of its successes - initiating a peaceful democratic transition, engaging in its collective past to create roadmaps for the future, and hosting the most active and dynamic civil society in the Arab world - Tunisia is introducing a law that can set back one very important right: the right to privacy and dignified livelihood.

Tunisian parliamentarians are set to debate a law to create a new national identity card that threatens to violate citizens' fundamental rights.

The card seeks to completely replace the old ID card, and along with it, introduces a whole host of issues that could deeply undermine the hard-won privacy and free expression rights of Tunisian citizens.

The country's Ministry of the Interior proposed the law earlier this year. The law was first debated by the ministerial council, whereupon it was voted on and recommended to the National Assembly for the Representatives of the People (ARP) for consideration on August 5, 2016.

Now, the proposed law sits before the Commission on Rights Liberties and External Relations, where it will be discussed prior to a gatekeeping vote that could pave the way to a debate in plenary before parliament.

According to various sources, the law will not be debated at the Commission before late January at the earliest. Still, this means that Tunisians could be forced to get new ID cards as early as the end of 2017.

The proposed law indicates that there will be a part of the ID card that contains encrypted data that is inaccessible to its owner

Notably, the Ministry of the Interior did not coordinate with or consult the various components of civil society about the data protection aspects contained in the new biometric ID.

According to Art. 76 of the Personal Data Protection Act of 2004 (Law number 63), the National Authority for Personal Data Protection is recommended to give advisory opinions on all questions related to personal data, including proposed legislation and ministerial decrees. Given the lack of consultation with the Authority, no such opinion was rendered.

The purported purpose of this new ID card, as well as its timing, is unclear. The proposed draft law is set to amend Law No. 27 of 1993 on the national identity card to equip the card with an electronic chip. The chip is rumored to employ the Gemalto system, which is used by some governments today to track and store citizens' health and banking data.

The draft law does not include or even reference any procedural or substantive safeguards on what kind of data will be collected. Most troubling is that the draft law does not mention who has access to the data and how it will be used.

These shortcomings allow for significant abuses of the protection of personal data - especially in a country that has had a documented history of personal data abuse: Ben Ali's Tunisia was a known "police state" that carried out both digital and physical surveillance on its citizens.

Any attempt to decrypt this personal data could be punishable by five years in prison

In addition, the proposed law indicates that there will be a part of the ID card that contains encrypted data that is inaccessible to its owner. Worst of all, any attempt to decrypt said information - even if it is the citizen is attempting to access his or her very own personal data - will be punishable by five years in prison.

The reasons supplied by the Ministry for creating this new ID card are unclear, at best. The proposed project is a costly one that would replicate existing efforts and waste hundreds of thousands of dinars in public funds; the current Tunisian identity card already contains a unique identifier number, a printed thumbprint, and even a bar code that the Ministry has yet to take advantage of in its administrative operations and treatment of personal data. 

The project as a whole is deeply troubling in its human rights implications. In a nutshell, the proposed law does not indicate:

1. What kind of personal data will be stored in the encrypted part of the new identity card;
2. What institution is charged with determining which personal data is to be stored;
3. If personal data is stored, how long it will be stored for;
4. Whether there will be an internal database;
5. Which government authorities, including law enforcement, will have access to said database;
6. Under which legal standards will government authorities access the data;
7. Where such personal data will be stored;
8. What institutions or individuals are granted access to the personal data that is encrypted;
9. Whether foreign governments have access to the personal data;
10. And finally, what security precautions, if any, will be taken to ensure data security.

These unanswered questions open the door to privacy violations. A "black box" ID card could be used to trample on the rights of Tunisians, granting officials access to rich data profiles that could be turned against citizens. But even if that doesn't happen, creating a large database of this type of information would likely attract criminals and hackers seeking to exploit it.

Laws that threaten these rights have no place in Tunisia

The bill severely undermines the privacy of Tunisian citizens and the protection of their personal data; inherently implicating their freedom of movement and their freedom of expression.

The proposed legislation creates a centralised trove of data that is susceptible to breach by malicious actors as well as abuse by public authorities. This, in practice, would violate Article 24 of the Tunisian Constitution, which states, "The state protects the right to privacy and the inviolability of the home, and the confidentiality of correspondence, communications, and personal information".

The bill also creates unnecessary and disproportionate risks to human rights, which threaten to stifle self-expression and deter travel. It is now in the hands of the Tunisian Assembly to defend hard-won civil liberties, and reject the proposed legislation.

The best scenario would see parliament drop the draft bill proposed by the Ministry of the Interior, and continue to focus on advancing civil liberties that guarantee an open and free society.

Laws that threaten these rights have no place in Tunisia.

Wafa Ben Hassine leads Access Now's policy and advocacy efforts in the MENA region. She is an expert in the intersection of digital rights, technological developments, and international human rights law.

Follow her on Twitter: @ousfourtia


Opinions expressed in this article remain those of the author and do not necessarily represent those of The New Arab, its editorial board or staff.