Mauritius: Storing biometric data on identity cards violates privacy

The UN Human Rights Committee has determined that Mauritius’ 2013 National Identity Card Act violated its citizens’ privacy rights due to having no insufficient guarantees that fingerprints and other biometric data stored on the identity card would be be securely protected. 

The Committee’s decision follows after a Mauritius national (M.M) filed a complaint stating that the country’s identity card contravened his privacy right under Mauritius’s Constitution and the International Covenant on Civil and Political Rights.

First launched in 1985, to prevent fake names and information being used in the application for the card, the authority amended the legislation in 2009 with additional biometric data requirements and increased penalties for non-compliance. Subsequently a new smart identity card was launched in 2013 to replace the previous card. 

In addition to containing printed information such as name, gender and date of birth, it also contains a microchip storing data including fingerprints that can be read by an e-reader. 

M.M refused to apply for the new smart ID Card and first took to the Mauritius government to court, however the Supreme Court ruled that despite there being evidence of biometric data retention being insecure, the ID card requirements had been made “in the interests of public order.”

M.M then turned to the U.N Human Rights Committee who found the right to privacy was violated.

“It is of paramount importance that any biometric identity scheme by any country is accompanied by robust safeguards to protect the right to privacy of individuals,” said Photini Pazartzis, Chair of the Committee.

“We regret that Mauritius did not provide enough information about such measures and look forward to receiving clarification in the framework of the implementation phase,” she added.