Décret-loi n° 2022-54 du 13 septembre 2022 relatif à la lutte contre les infractions se rapportant aux systèmes d'information et de communication (Decree-Law No. 2022-54 of 13 September 2022 on combating offences relating to information and communication systems)

Decree-Law No. 2022-54 of 13 September 2022, issued by President Kais Saied and published in the Journal Officiel de la République Tunisienne (JORT) No. 103 of 13 September 2022, is Tunisia's principal cybercrime instrument. Its stated purpose is to lay down provisions for preventing and punishing offences relating to information and communication systems and for the collection of related electronic evidence, and to support international cooperation in this field. It replaced earlier, narrower provisions and now serves as the central text invoked in cyber-related prosecutions. The decree-law contains both classic substantive cyber-offences and a controversial content-and-evidence regime. On the substantive side it addresses unauthorised access to and interference with information systems and data, and offences committed through information and communication networks. Its most consequential and widely criticised provision is Article 24, which punishes by up to five years' imprisonment and a fine of 50,000 dinars anyone who knowingly uses communication networks and information systems to produce, promote, publish, send or draft false news, false data, rumours, or false or falsified documents attributed to others, with the aim of harming others, defaming, damaging reputation, inciting violence, or harming public safety or national defence. Penalties are doubled where the targeted person is a public official. On the procedural side the decree-law establishes a powerful electronic-evidence and surveillance framework. Article 6 requires telecommunications operators and service providers to retain users' identity data, traffic data and metadata for a minimum period (reported at two years) and to make it available to the authorities. Upon judicial authorisation, the authorities may seize devices, track individuals and intercept communications to gather electronic evidence. These investigative powers are exercised through the public prosecutor and investigating judges within the ordinary criminal justice system. Because it combines broad criminalisation of online expression (notably the “false news” offence) with extensive data-retention and interception powers, the decree-law has a pronounced digital-rights dimension and has been heavily criticised by international and Tunisian human rights organisations, including Human Rights Watch, Amnesty International, ARTICLE 19, the ICJ and Access Now, who report its use against journalists, lawyers, activists and other critics and have called for its repeal. It nonetheless remains in force and is Tunisia's operative cybercrime framework, alongside Organic Law No. 2004-63 on personal data protection.

1. 1Central cybercrime decree-law setting out offences relating to information and communication systems and rules for collecting electronic evidence (JORT No. 103, 13 Sept 2022)
2. 2Criminalises unauthorised access to and interference with information systems and data, and offences committed via ICT networks
3. 3Article 24: up to 5 years' imprisonment and a 50,000-dinar fine for knowingly producing or disseminating false news/data or falsified documents to harm others, defame, incite violence or harm public safety/national defence; penalties doubled where the victim is a public official
4. 4Article 6: mandatory retention by operators/providers of identity, traffic and metadata (reported minimum two years) and disclosure to authorities
5. 5Authorises, on judicial order, seizure of devices, tracking of individuals and interception of communications to gather electronic evidence
6. 6Strong digital-rights impact; criticised by HRW, Amnesty International, ARTICLE 19, ICJ and Access Now and reportedly used against journalists and critics