Tunisia’s new ID card: a looming disaster for personal data

Tunisian parliamentarians are set to debate a law to create a new national identity card that threatens to violate citizens’ fundamental rights. The card seeks to completely replace the old ID card, and along with it, introduces a whole host of issues that could deeply undermine the hard-won privacy and free expression rights of Tunisian citizens.

The country’s Ministry of the Interior first proposed the law earlier this year. It is set to amend Law No. 27 of 1993 on the national identity card, to render the card equipped with an electronic chip.

In July, the proposal was passed by the ministerial council, headed then by former Prime Minister Habib Essid. In August, the council recommended the law to the National Assembly for the Representatives of the People (ARP) for consideration. Now, it sits before the Commission on Rights, Liberties, and External Relations, where it will be discussed prior to a gate-keeping vote that could open the pathway for debate in plenary among all of Parliament. This means we could see a new card as early as the end of 2017.

That’s deeply troubling for those of us who care about human rights. The proposal does not indicate (1) what kind of personal data will be stored in the encrypted part of the new identity card; (2) what institution will determine what personal data will be stored; and 3.) if the data are stored, how long it will be stored for.

These unanswered questions open the door to privacy violations. A “black box” ID card could be used to trample on the rights of Tunisians, granting officials access to rich data profiles that could be turned against citizens. But even if that doesn’t happen, creating a large database of this type of information would likely attract criminals and hackers seeking to exploit it. That’s not safe.

Access Now, along with several local partners, has mobilized to submit an open statement detailing the problems with the proposed law (in English, en Francais). The Tunisian League for Human Rights, iWatch, Nawaat, and the Tunisian Forum on Social and Economic Rights, have all signed the statement, and will deliver it to Mr. Mohamed Ennaceur, Chair of the National Assembly.

As we write in the letter,

…The bill highly undermines the privacy of Tunisian citizens, the protection of their personal data, their freedom of movement, and their freedom of expression. The proposed legislation creates a centralized trove of data that is susceptible to breach by malicious actors as well as abuse by public authorities. This, in practice, would violate Article 24 of the Tunisian Constitution, which states: “The state protects the right to privacy and the inviolability of the home, and the confidentiality of correspondence, communications, and personal information.”

We encourage civil society and individuals in Tunisia to oppose this measure, and to speak out now against the bill in the following ways:

  1. Contact the ARP Chair to express your opposition to the proposed law.
  2. Look up your local representatives in the ARP and talk to them.
  3. Contact Access Now if you would like to sign the statement with an institutional affiliation.

We also urge the ARP to reject the amending legislation without equivocation. Its leadership on this issue is crucial for defending people’s privacy, ensuring adequate judicial review, and upholding the Tunisian constitution. The National Assembly must stand up for the fundamental rights of all Tunisians in the digital age. Laws that threaten these rights have no place in Tunisia.