Council of Ministers Retracts Biometric Data Requirement in Mauritius

Mauritius recently navigated a complex legal and public debate surrounding mandatory SIM card registration, particularly concerning the collection of biometric data. Initiated by the Information and Communication Technologies Authority (ICTA) through the Information and Communication Technologies (Registration of SIM) Regulations 2023, the drive aimed to enhance national security and combat illicit activities by linking SIM cards to verified user identities, including photographs. However, the regulations faced significant legal challenges and public outcry, raising profound concerns about data privacy, constitutional rights, and the potential for state surveillance. This culminated in the Council of Ministers' decision on December 27, 2024, to retract the biometric data requirement, mandating mobile operators to delete all previously collected photos, marking a pivotal moment for digital rights in the jurisdiction.

The landscape of telecommunications regulation in Mauritius has seen a significant, albeit contentious, evolution with the recent implementation and subsequent retraction of mandatory SIM card registration requirements. Driven by the Information and Communication Technologies Authority (ICTA), the initial regulatory framework, primarily the Information and Communication Technologies (Registration of SIM) Regulations 2023, sought to establish a comprehensive database of SIM card users. The stated objective was to bolster national security, curb criminal activities such as drug trafficking and fraud, and ensure accountability in the digital sphere.

However, this initiative quickly became a focal point of intense public and legal scrutiny. Concerns over the collection of sensitive personal and biometric data, coupled with apprehension regarding potential infringements on privacy rights, led to widespread debate and judicial challenges. The Mauritian experience, therefore, serves as a compelling case study in the delicate balance that governments must strike between legitimate security imperatives and the fundamental rights of citizens in an increasingly digital world. This article examines the legal framework that underpinned the SIM registration drive, the controversies it engendered, and the ultimate decision to retract key biometric data requirements, highlighting the enduring importance of robust data protection and civil liberties.

The legal foundation for SIM card regulation in Mauritius is primarily rooted in the Information and Communication Technologies Act 2001, which empowers the ICTA to regulate the information and communication technologies sector. Under this overarching legislation, the Information and Communication Technologies (Registration of SIM) Regulations 2023 were enacted, coming into force on October 31, 2023. These regulations superseded previous iterations, including the Information and Communication Technologies (Registration of SIM) Regulations 2021, which had seen their effective date postponed.

The 2023 Regulations mandated that all existing SIM card holders in Mauritius, including citizens, non-citizens, public and corporate bodies, diplomatic missions, and tourists, re-register their SIMs by April 30, 2024, a deadline later extended by the Supreme Court to May 13, 2024, due to ongoing legal challenges. Failure to comply would result in the automatic deactivation of unregistered SIM cards. The requirements for registration were stringent, demanding personal details, proof of address (such as a recent utility bill), and crucially, a coloured photograph or 'selfie' to be verified against the individual's National Identity Card or passport photo. This comprehensive data collection was justified by the ICTA as a measure stemming from recommendations of the 2018 Lam Shang Leen Report on Drug Trafficking, aimed at combating fraud, identity theft, and other criminal activities facilitated by unregistered or fraudulently obtained SIM cards.

The implementation of the Information and Communication Technologies (Registration of SIM) Regulations 2023 immediately sparked significant legal and public opposition, primarily centered on concerns regarding data privacy and the constitutionality of collecting biometric data. Critics, including prominent legal professionals and civil society groups, argued that the mandatory submission of photographs and selfies constituted an infringement on the fundamental right to privacy. These concerns were amplified by previous rulings of the Mauritian Supreme Court, notably in cases such as *Madhewoo v. The State of Mauritius* and *Jugnauth's case*, which had declared the indefinite storage of biometric data (specifically fingerprints) collected for national identity cards by the state as unconstitutional.

Legal challenges, including one lodged by attorney Pazhany Rangasamy, contended that the SIM registration exercise was a 'colourable device' designed to circumvent these earlier judicial prohibitions by outsourcing the collection and storage of biometric data to telecommunications companies, which could then be accessed by government agencies like the ICTA. The adequacy of the Data Protection Act 2017 (DPA 2017) in safeguarding this sensitive information was also questioned, with critics pointing to a perceived lack of transparency regarding data processing, storage duration, access protocols, and protection measures by mobile operators.

In a significant development that underscored the weight of these concerns, the Mauritian Council of Ministers, on December 27, 2024, approved a decision to retract the controversial biometric data requirement. This decision effectively replaced the 2023 SIM registration rules with fresh 2024 regulations, which notably mandated mobile operators to delete all previously stored photographs. This retraction represents a substantial victory for privacy advocates and a recognition by the government of the constitutional and data protection issues raised. It highlights the judiciary's role in upholding civil liberties against state initiatives, even those justified by national security, and signals a recalibration of the balance between security measures and individual rights in Mauritius.

The journey of SIM card regulation in Mauritius, from its ambitious implementation to the subsequent retraction of its most contentious provisions, offers critical lessons for legal practitioners and policymakers alike. The initial drive, underpinned by the Information and Communication Technologies (Registration of SIM) Regulations 2023, reflected a global trend towards enhanced digital identity verification for security purposes. However, the robust legal challenges and public discourse that ensued underscored the paramount importance of constitutional rights, particularly the right to privacy, and the stringent requirements of data protection legislation like the Data Protection Act 2017.

The Council of Ministers' decision to revoke the biometric data collection requirement and mandate the deletion of previously stored photos is a landmark outcome. It reaffirms the principle that security measures, while necessary, must be proportionate, legally sound, and respectful of fundamental human rights. For practitioners, this case highlights the ongoing need for vigilance in scrutinising regulatory instruments that impact personal data and privacy. It also underscores the critical role of judicial review in ensuring that legislative and regulatory actions align with constitutional principles. Moving forward, stakeholders should closely monitor any new regulations concerning digital identity and telecommunications, ensuring that future frameworks are developed with greater transparency, public consultation, and robust safeguards to prevent similar infringements on civil liberties.