للقراءة بالعربية / Read in Arabic
For more than five years, the Tunisian authorities have been deliberating over a new biometric ID law in Tunisia. Currently, every Tunisian over the age of 18 must carry an ID card. With the new bill, every Tunisian over the age of 15 would also have to give their fingerprints and face photo to the Ministry of Interior, gathering the sensitive information of an entire population in a single place for the purpose of identification and “electronic administration.”
With an outdated data protection law and no adequate privacy safeguards, the new biometric ID carries serious risks and threats to the right to privacy and other fundamental rights in Tunisia.
What is the biometric ID bill and why you should care
In August 2016, The Tunisian Ministry of Interior (MoI) introduced a new draft law that would replace the current identity cards with chip-enabled biometric ID cards. While the project did not see the light back then, the MoI announced on January 17, 2022 that it will resume its work on the biometric ID bill.
The national ID card is a mandatory document in Tunisia for all citizens over the age of 18 (according to Law N° 1993-27) and not having it constitutes an infringement of the law. As a consequence, all Tunisians would be obliged to provide their biometric data, including fingerprints, to the state to obtain or renew their paper ID card. According to MoI’s officials, a biometric database will be created for the purpose of avoiding the replication of a stolen or lost card.
The ministry has not indicated whether it is working on a new law and despite holding a consultation with civil society organizations, it has not publicly or privately shared the draft law yet. Previous iterations of the bill have raised serious concerns due to ambiguous provisions and lack of transparency. For instance, none of the earlier drafts provided information on where the biometric data will be stored and for how long, who can have access to it, and how the database will be secured. Access Now and Tunisian civil society have repeatedly raised these questions in recent years, and the Tunisian authorities have not provided any answers.
Similarly, the rationale the ministry cites behind rolling out this costly system remains unclear. The ministry now wants to combine both the biometric ID and biometric passport under the argument that it has to fulfill Tunisia’s international commitments, namely under the International Civil Aviation Organization (Doc 9303), to introduce machine-readable travel documents equipped with a chip containing biometric data by 2024. But it should not be necessary for Tunisians to hold a biometric ID to get a biometric passport.
In addition to being disproportionate to the needs stated by Tunisian officials, the biometric ID puts the privacy and security of Tunisians’ personal information at a great risk. The biometric data that will be stored on the card chip and the database, i.e fingerprints and face photos, is sensitive personal data which requires a higher threshold of protection and justification. Yet, the bill fails to outline any legal or technical measures on how to ensure its protection. Unlike other data, biometric data cannot be modified if it is leaked or stolen, nor can the damage be redressed. This is why Access Now is calling for a moratorium on the deployment and use of biometric ID systems.
This is further aggravated by the insufficiency of data protection safeguards in Tunisia. The data protection law of 2004 is outdated and does not address the specificity of the biometric data, in addition to the fact that it is not in compliance with Tunisia’s international commitments on data protection, especially the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) ratified by Tunisia in 2017. Moreover, the Tunisian IT infrastructure has been targeted numerous times for cyberattacks, most recently the Tunisian Central Bank. The ICT ministry even issued a statement afterward warning public and private financial institutions about the threat of ransomware attacks, a danger in the central bank attack.
All of these factors mentioned above, show the dangers of implementing the biometric ID bill in Tunisia as is, both legally and on the grounds of security. The bill risks creating 360 degree profiling and surveillance of citizens by government actors with access to the databases. Such a digital ecosystem would be hugely detrimental to the fundamental right to privacy of Tunisians.
Public consultations and dialogue with civil society and relevant national institutions and experts are a necessary safeguard to ensure that this legislation, which is directly linked to the right to privacy and personal data protection, enshrines fundamental human rights principles and aligns with the 2014 Constitution which states in article 24 that “the state protects the right to privacy and the inviolability of the home, and the confidentiality of correspondence, communications, and personal information.”
There is also a lack of transparency regarding the budget allocated for the project. The ministry said in March 2021 that the cost is estimated at 45 million Tunisian Dinars, allocated since 2015. Questioned by Access Now in a workshop in February 2022, the Ministry said it is now approximately 60 million, but this amount has not been allocated in the state budget of 2022. This further undermines the feasibility of the project and raises the question whether the ministry will make compromises so that the project is implemented despite the lack of resources, deepening our concerns about the threat it poses to privacy and personal data protection in Tunisia.
How did we get here?
Since its inception in 2016, Tunisia’s biometric ID bill has gone through a number of changes and resurfaced in different drafts, but it is yet to see the light.
What didn’t change over the years, however, is the vigilance and determination of civil society to defend the right to privacy and other fundamental rights in Tunisia.
Here’s a look at the history of the bill:
Where we go next and how you can help
For years, Access Now together with our partners in Tunisia have warned against this dangerous bill. While the ministry of interior insists on rolling out the biometric ID in Tunisia, the question remains: How does replacing the current ID serve the public interest, especially without proper safeguards for our privacy and digital security?
Such a proposal should not pass under Tunisia’s exceptional circumstances and in the absence of transparency and meaningful consultation with civil society. Given the serious risks and threats to fundamental rights in Tunisia, we call on the Ministry of Interior to urgently withdraw the bill.
As cyber attacks targeting Tunisian institutions are on the rise, it’s high time for the Tunisian authorities to prioritize the adoption of a robust data protection legal framework that would ensure adequate protection of Tunisians’ privacy.
Access Now remains ready to engage with the Tunisian authorities and relevant stakeholders to advance the protection of personal data in Tunisia and beyond.