Review of the Legal Framework of Personal Data Protection and Ensuring Conformity with Article 24 of Tunisian Constitution (TN0004)

In accordance with the provisions of Part II of the Constitution « Rights and freedoms », in particular the provisions of article 24, that admits the State commitment to personal data protection, and article 32 that enshrine the right to information access, and in respect to article 49 that states that the rights and freedoms guaranteed by the Constitution should be explicated by laws, the current data protection act and related legislation will be amended, so that it can meet international standards, especially in the ICT field.

4: Legal framework of personal data protection

Commitment Text: In accordance with the provisions of Part II of the Constitution “Rights and freedoms“, in particular the provisions of article 24, that admits the State commitment to personal data protection, and article 32 that enshrine the right to information access, and in respect to article 49 that states that the rights and freedoms guaranteed by the Constitution should be explicated by laws, the current data protection act and related legislation will be amended, so that it can meet international standards, especially in the ICT field.

Responsible Institution(s): The Ministry of Justice (The National Authority for Personal Data Protection)

Start Date: July 2014 End Date: June 2016

Commitment aim

This commitment sought to review the legal framework on personal data protection to make sure it complies with Article 24 of the Tunisian Constitution of 2014. Article 24 protects personal data. The commitment is particularly relevant because, before the 2011 revolution, the regime used censorship and surveillance to identify and silence dissident voices.

Status

Midterm: Not started

The Ministry of Justice (MoJ) did not make any progress on preparing amendments to the 2004 law to meet international standards on data protection. The role of the National Authority for Personal Data Protection (NAPDP) in this commitment was unclear during the first nine months of implementation. NAPDP’s leadership and some of its technical team^{[Note 15: Adhadhi Nidhal, “Chawki Gaddes as a New President of the NAPDP,” News, Tunisie Telecom, 5 May 2015, http://bit.ly/1PV9ypb.]} changed in 2015, following the formation of a new government.^{[Note 16: Khaled Sellami, Head of the OGP Focal Point, interview with the IRM researcher, 23 November 2015. ]}

End of term: Not started

According to the OGP’s points of contact,^{[Note 17: Interview with OGP focal point team members, Rim Garnaoui and Chiraz Ben Tahar, 9 September 2016.]} there was no further progress on the implementation of this commitment. The representative of Al Bawsala declared that there is no government will to amend the existing 2004 law or to introduce a new one.^{[Note 18: Interview with Al Bawsala representative, 1 February 2017.]} However, the National Authority for Protection of Personal Data (INPDP) is leading an initiative to amend the law.

Did it open government?

Access to information: Did not change

Public accountability: Did not change

Tunisia has had a Data Protection Act since 2004, but a new legal framework would strengthen the protection of citizens’ personal data. With an increasing number of Internet users in Tunisia (about 5.5 million out of a population of 11 million),^{[Note 19: Internet Live Stats, “Tunisia Internet Users,” http://www.internetlivestats.com/internet-users/tunisia/.}

] personal data protection could be an important factor to enable digital activism and better access to information.

The lack of progress on enacting the new legislation means that the commitment has not had an impact on access to information and public accountability.

Carried forward?

This commitment was not included in the second action plan. The IRM researcher suggests clearly articulating any amendments to the existing law. What specific changes the amendments would introduce, and how they would change the status quo regarding personal data protection, should both be made clear to the public.