The Rights and Freedoms Committee at the Assembly of People’s Representatives (ARP) reviewed the draft opinion on the proposed organic law on personal data protection.
The draft contains 123 articles across 6 titles, covering general provisions, principles for personal data processing, the rights of data subjects, data processing systems, the personal data protection authority, penalties and final and transitional provisions.
The aim of the law is to establish a modern legislative framework aligned with international standards and Tunisia’s commitments regarding human rights and personal data protection.
According to the bill’s sponsors, the amendment responds to an institutional gap, citing the limited role of the Personal Data Protection Authority. They also warned about the absence of clear articles for handling sensitive sectors such as the press, surveillance cameras, artificial intelligence and the protection of data transferred abroad.
The draft proposes the creation of a Data Protection Officer role and obliges public institutions to obtain declarations and authorizations for any personal data processing.
Regarding sanctions, the new approach favors financial penalties, some of which have been increased, and suggests the creation of a dedicated sanctions department.
At the session’s opening, Thabet Abed, chairman of the commission, stressed the law’s importance in protecting privacy and personal data, especially amid the growing influence of algorithms, surveillance technologies and AI on administrative and economic decisions.
He emphasized that the presented project includes notable advancements, particularly the regulation of the use of artificial intelligence, the establishment of the right not to be subject to a solely automated decision, the introduction of an impact assessment for high-risk processing, the regulation of health data processing, as well as the regulation of visual surveillance.
According to him, these provisions reflect an awareness of current digital challenges.
He also noted that the proposed law raises the question of the competent authority’s capacity to handle the expected volume of requests, as well as the question of the intended economic model: a model based on a logic of compliance and governance, or a model based on administrative authorization, which could influence investment and innovation.
The members of the Rights and Freedoms Committee then began examining the articles of the first title of the bill, relating to general provisions.
It should be noted that this Tunisian approach demonstrates a willingness to protect privacy and establishes a legal framework to ensure the protection and secure and transparent processing of personal data.
