UN Human Rights Committee holds that the Mauritius ID Card Scheme is in violation of the ‘right to privacy’ under Article 17, ICCPR

23 July 2021

In a highly significant decision published on 22 July 2021, the UN Human Rights Committee has determined that the Mauritius ID card scheme is in violation of Article 17 of the International Covenant on Civil and Political Rights (ICCPR).  The decision has widespread international relevance given that there are over 100 ID cards schemes in existence and the amount and sensitivity of information included is increasing and getting ever more complex.

Dr Maharajah Madhewoo, a citizen of Mauritius, has challenged the collection and retention of sensitive personal data, including fingerprints, DNA, medical records and general biometric data, within the compulsory ID card scheme, through all domestic courts, to the Privy Council, and finally to the Human Rights Committee.

The Supreme Court held that the retention of fingerprint information on a national database was unconstitutional.  In response, the State scrapped the database but required the fingerprint data to be retained on the ID card itself, a manifestly worse provision given that there was clear evidence that it could be easily hacked with simple devices available on the internet, without the holder either knowing or having contact.  In addition, domestic statutes allowed for the executive to expand the categories of data which could be collected and retained including DNA and biometric data, and perhaps most worryingly, Ministers indicated that they wished to expand the scheme to become a “multi-application Smart card” dealing with pensions, social security benefits and health records.

Dr Madhewoo sought to draw a sharp distinction between the legality and proportionality of a scheme which contained basic information such as name and address, dates of birth and gender, and one which contained sensitive personal and biometric data and controlled access to other records.

The HRC agreed with Dr Madhewoo that the scheme disproportionately interferes with his right to respect for privacy under Article 17, and does not achieve its legitimate objective of combating identity fraud, and must be rectified.

The State of Mauritius now has 180 days to indicate how it will comply with the decision, and provide Dr Madhewoo with an effective remedy.

Dr Madhewoo was represented by Pete Weatherby QC, and Sanjeev Teeluckdharry, instructed by advocate Erickson Mooneapillay, Port Louis, Mauritius.  Erickson is also Director of the leading NGO: ‘Dis-Moi – Human Rights Indian Ocean’.

The decision can be accessed here.  The written arguments included a tour d’horizon of international privacy law relating to ID cards.