Tunisian internet service providers (ISPs) fail to protect customers' privacy, ImpACT International and Access Now reported today in a joint oral statement at the 45th Session of the United Nations Human Rights Council (UNHRC). Tunisian ISPs retain and share the personal data of internet users without their knowledge or explicit consent.

Political and human rights activists are at significant risk of being identified and targeted for their online and offline activity

The two organisations warned that this leaves internet users, especially political and human rights activists, at significant risk of being identified and targeted for their online and offline activity, identity theft and other abuses of their right to privacy. Users’ personal information then can be exploited by state and non-state actors that retain and share personal data with third parties

"The largest roadblock to internet service providers’ compliance with the right to privacy is simply that the current law in Tunisia does not provide adequate guarantees for consumers and is not enforced," the statement read. “In addition, the minimal right to compensation for victims of data breaches gives these companies discretion to adopt vague privacy policies, without a clear statement on their official websites.”

ImpACT International for Human Rights Policies and Access Now concluded their statement by calling on the Human Rights Council and its member states to urge the Tunisian government to adopt a new data protection law that upholds human rights. They also called on the HRC to ensure that the Council of Europe’s Convention No. 108 on data protection —to which Tunisia is a 2007 signatory —is fully and effectively implemented.

In July, ImpACT and Access Now released a joint study titled “Privacy Violated” as part of a series of studies focusing on ISPs across the Middle East and North Africa. Each evaluates the extent to which customers' right to privacy is protected.

The Tunisian study found that seven of the country’s main internet service providers—Tunisie Telecom, Ooredoo, TOPNET, Orange Tunisia, GlobalNet, HexaByte Tunisia and BEE — violate basic principles of customer data protection.