On Tuesday, May 16, 2017, the Tunisian Parliament affirmed its commitment to the protection of personal data by unanimously ratifying the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), and its Additional Protocol 181. Convention 108 is the world’s only international, legally binding data protection treaty.
The Convention was first drafted in 1981 to ensure that all processing of personal data within the Council of Europe was consistent with Article 8 of the European Convention on Human Rights, which guarantees “the right to respect for private life, family life, home, and correspondence.” Article 24 of the Tunisian Constitution reads almost identically, guaranteeing “the right to privacy and the inviolability of the home, and the confidentiality of correspondence, communications, and personal information.”
Tunisia first requested to be invited to the Convention in early July 2015. The Council then formally invited Tunisia to sign it in December 2015. As of today, Tunisia is one of seven non-European countries to sign the Convention, and one of three ratifying it.
In a country where both private and public entities exercise rampant disregard for citizens’ personal data, it is profoundly reassuring to see the Convention ratified. Despite the national data protection authority’s repeated calls for compliance, both private and public entities continue to abuse the personal data of Tunisians — for example, supermarkets regularly engage in the trade of customer data, and telecommunication companies have no issue selling mobile users’ personal information. The government is also pushing to install video-surveillance cameras at every corner, in the name of fighting terrorism and furthering national security. Earlier this year the Ministry of Interior announced that it would install more than 1,200 video-surveillance cameras in more than 400 locations in the city of Tunis alone, and that it plans to plant many more across the whole of the country.
Convention 108 is good for more than protecting Tunisians’ privacy. It has positive economic implications, too. In adopting Convention 108, the Council of Europe has indicated that all its members, including all E.U. states, will not allow the transfer of any data to a state that does not guarantee a certain level of data protection. Given that the E.U. is Tunisia’s largest trade partner, not ratifying the Convention would have meant that the country would lose a significant number of investments coming from the E.U., adding to Tunisia’s economic woes. Additionally, the ratification of the Convention would prove helpful if Tunisia were to seek an adequacy decision from the E.U.
An adequacy decision is a mechanism that simplifies the transfer of personal data from the E.U. to another country. It is provided by the E.U. Commission, on the basis of the E.U. data protection law — currently the Directive from 1995 which will be replaced by the General Data Protection Regulation (GDPR) starting in May 2018.
The next step, now, is for Tunisia to ensure the Convention is fully and effectively implemented by reforming its domestic data protection laws to adhere to best practice guidelines outlined in Convention 108. Another large project involves reforming the legal framework outlining the functionality of the Tunisian data protection authority, the National Instance for the Protection of Personal Data. Since its creation in 2004, the DPA has faced significant limitations to its modality of work; it is housed under the Ministry of Justice, and its members are chosen by various public administrations. In order to better effectuate its work, the DPA must be truly independent – both administratively and financially.
Only then will Tunisia be able to uphold the values of both Convention 108 and Article 24 of its own national constitution guaranteeing citizen privacy.