As elections approach, Tunisia must ensure protection of personal data

قراءة هذا المقال باللغة العربية

Following the death of Tunisian President Beji Caid Essebsi, the Independent High Electoral Commission set a new date for the country’s presidential election, which was supposed to take place on November 17.

This decision is a primarily positive one as it respects the provisions of the Constitution, which stipulates that the interim transitional period should not exceed 90 days before the end of October. Nabil Baffoun, the head of the Independent High Electoral Commission expressed himself “the need to respect the provisions of the Constitution.” It should be noted, however, that holding the elections so soon may mean that important aspects of the proceedings are neglected. 

The current data protection law does not provide adequate safeguards or guarantees for personal data protection that conform with international human rights standards. In order to rectify this, the official data protection authority worked to draft a new, more comprehensive document, the Data Protection Bill. Approved by the Council of Ministries in 2018, the passing of the updated draft law was initially planned to coincide with the entry into force of the General Data Protection Regulation (GDPR) in the European Union on May 25, 2018. More than a year later, the draft is still at square one. The Data Protection Bill was previously  delayed due to push-back from civil society and other independent authorities who highlighted significant deficiencies contained in the bill that could curtail fundamental freedoms, such as the right to freedom of expression and the right to access information. Below, we provide a comprehensive timeline of events to track where the bill is today.

What happened so far?

Learn more

➠ Data Protection Act, 2004 – New Constitution, 2014

In the years of dictatorship before the 2011 revolution, former president Zine el Abidine Ben Ali’s regime infamously censored online content and surveilled online activity. Law enforcement authorities actively targeted bloggers, journalists, and activists.

Paradoxically, it was under this regime in 2004 when the government of Tunisia adopted the Organic Law No. 63 of 27 July 2004 on the protection of personal data. This law established the National Authority for the Protection of Personal Data (INPDP), which was tasked with overseeing the enforcement of the legal framework on data protection in 2009. However, there was a notable discrepancy between the law and its application – according to the statistics from the INPDP covering the years  2009-2015, the law was rarely respected by data processors.

In 2014, three years after  the revolutionary overthrow of the former President Ben Ali, the Tunisian Republic enacted the new Tunisian Constitution that broadened the right to data protection by adding the right to privacy as a fundamental right that is protected by the state under article 24.

➠ Civil Society Concerns, 2018

On  March 8th, 2018, the Council of Ministers formally ratified the draft Basic Law on the Protection of Personal Data and officially referred it to the Commission on Rights and Liberties, a specialized parliamentary commission that considers legislation that has the potential to impact or interfere with individual liberties. 

The Tunisian Access to Information Authority (Instance Nationale d’Accès à l’information, INAI) published a report/statement/press release that raised serious concerns about the Bill: there was no clear distinction made between public and private data. INAI stressed the importance of distinguishing between the personal data of individuals related to their private lives and those relating to public life or to the management of public affairs, which must remain subject to the principle of access to information. The draft law, they wrote, violates the principles of transparency and access to information guaranteed by the Tunisian Constitution (Article 32 of the Tunisian Constitution). Consequently, Tunisian civil society published a joint statement raising concerns about the bill and joining their voices to the INAI.  

➠ Data Protection Bill In Light Of Access To Information, 2018-2019

In order to shed light on some of the bill’s deficiencies and to identify possible solutions, Access Now and UNESCO held an event calledThe data protection bill in light of access to information” in November, 2018. The event brought together  multiple stakeholders – including members of Tunisian civil society, members of parliament, the heads of independent bodies and expert speakers from neighboring countries to participate in a high-level discussion on the status of personal data protection in Tunisia. Speakers stressed the importance of achieving joint cooperation between elements of civil society and independent bodies, including the INPDP and INAI, for the protection of citizens’ rights in Tunisia

➠ Setbacks in drafting the Data Protection Bill

In 2018, the Commission on Rights and Liberties (CRL), organized hearing sessions allowing for public and civil society input on the draft bill. Various civil society organizations took part in these sessions including Article 19, UTICA (the national trade union), and Access Now, among many others. Every year, new members of the CRL are elected and unfortunately the newly elected CRL did not take the results of these sessions into account. 

In a very discouraging move, when starting the discussion about the bill, the CRL seemed to only consider INPDP’s comments. In fact, the INPDP submitted their recommendations independently, ignoring prior community consultations with the public and civil society organizations.  

Not making recommendations public

To make matters worse, the CRL and the DPA have refused to make the INPDP recommendations public. Until this day, all efforts that Access Now has made to request access to the recommendations or express concerns about the process have been dismissed. 

The INPDP was created in 2004 to protect the right to privacy for individuals. In addition, the 2014 constitution defines the institution as an independent body that is accountable to the principles of transparency and accountability where the latter relies on civic engagement. Following from this, the INPDP should work in collaboration with civil society organizations. Given the situation today, the entire legislative process for the much needed Data Protection Bill raises deep concerns with the way the INPDP currently operates. 

What’s next?

The CRL has not presented a clear plan for the next stages of passing the bill, nor have they specified if there will be more hearing sessions with civil society. In fact, it has been more than a year since the CRL held public hearings about the data protection bill. It is now clear that it will not pass before the upcoming elections in the fall, as to date they have only voted on four articles of the bill. Tunisians urgently need a new, updated law that reflects the changes to new technologies, as the current law does not provide adequate safeguards or effective guarantees for personal data protection. 

➠ Impact on the 2019 elections

Tunisia’s Freedom House Status is free based on the peaceful transition of power following the national elections in 2011 and 2014. Free and fair elections are integral to a democratic society. For Tunisia to undergo an election season without the guarantee of basic fundamental freedoms, such as the right to privacy and data protection, constitutes a threat to democracy. We saw  the consequences of personal data harvesting with the attempts to affect the 2016 U.S election in the Cambridge Analytica Scandal. It is therefore crucial for Tunisia to have safeguards related to the data protection of all Tunisians.

In an already tense political landscape, the personal data of Tunisians is sure to be taken advantage of in ways that are not difficult to predict — spamming users with political messaging via SMS and email, using personal information to target messaging in an unfair way, and facilitating a free-for-all situation for data brokers and thieves.

Updating the Data Protection Bill needs to be a number one priority for the government and on the Parliament’s agenda. There is a serious risk to the democratic process in Tunisia by not voting immediately on a new Data Protection Bill, which should be informed by civil society recommendations. In addition to the threat posed to the democracic process, not having guaranteed safeguards has implications for Tunisia’s unstable economic future and will affect the decision of companies coming to work in the country. In this context, Access Now expresses its concern about the draft law on the protection of personal data and its failure to present it as a priority among the proposed bills. It is essential to implement a strong legal framework capable of providing the necessary protection to prevent the abuse of personal data.