Privacy enshrined in Constitution: Yes, Tunisia updated its 1959 Constitution to include the right to personal data protection in 2002. The 2014 Constitution protects the right to privacy under Article 24.
DPA legislation: The Organic Act No. 2004-63, was passed in 2004 and established the Tunisian data protection authority, the Instance nationale de protection des données à caractère personnel (INPDP). At that time, it made Tunisia one of the most progressive regimes for personal data protection in the world.
However, under the authoritarian rule of Ben Ali, few, if any of these rights, were actually realised by the people. Although the Tunisian Jasmine Revolution of 2011 brought democratic reforms, it wasn’t until 2015 that data processors began to regularly declare their personal data processing to the INPDP, which, up until that time, had neither been functioning as an independent body, nor was it sanctioning violators of the Organic Act.
Although Tunisia enacted a new constitution in 2014, the old data protection regime remains. However, in 2007 Law and Decree No. 2007-3004 of 27 November 2007 Laying Down the Conditions and Procedures for the Declaration and Authorisation of the Processing of Personal Data was also promulgated.
During a 2018 conference, Chawki Gaddes, the president of the INPDP, emphasised the importance of modernising the law toward greater effectiveness, and to reflect new social and technological realities as well as Tunisia’s new political environment that values democracy and human rights. Given that Tunisia has signed the Council of Europe’s Convention 108, the updated Tunisian data protection law will likely reflect the principles therein.
Under Organic Act No. 2004-63, data subjects, their heirs, or their guardians have the right to:
- access all personal data concerning them;
- correct, complete, rectify, update, modify, clarify, or delete when the data is inaccurate, equivocal, or when its processing is prohibited;
- object, at any time, to the processing of personal data concerning them for valid, legitimate and serious reasons, except where the treatment is planned by law or is required by the nature of the obligation; and
- prevent personal data from being shared with third parties for advertising purposes.
However, it is important to note that organisations with a “public personality” (such as police stations, tribunals, and universities) are not bound by the obligations that generally apply to personal data processors in Tunisia. Public organisations are not required to declare data processing and therefore the rights of individuals to their data are limited in their interactions with these entities.
