Co-author: Doha Khalil

The use of the Internet as an essential and critical tool for facilitating accessible communication, education, and commerce has become relatively widespread. Digital rights (or lack thereof) are a concern in Lebanon, particularly in terms of people’s ability to access the Internet, government censorship and surveillance of online activity, and the level of protection afforded to users.

Access to the Internet and personal data protection in Lebanon have always been subject to debate and violation, by state and non-state actors. Following the socio-political and economic crises triggered in 2019, violations have surged, mainly due to the currency devaluation that made Internet access less affordable for citizens and residents alike.

Lebanon’s legal framework regulating the Internet is fragile. The country’s current data protection law, Law No. 81 of 2018 on Electronic Transactions and Personal Data, includes provisions designed to protect personal data, yet only to a certain extent. There is scant attention paid to the importance of personal data protection by the Lebanese legislature; combining the regulation of electronic transactions with personal data protection shows that the legislature sees personal data solely through the lens of economic opportunity—even the law’s very title, after all, includes the phrase “personal data” as opposed to “personal data protection”.

In addition, the existing law is not enforced properly. Six years after the law’s adoption, Lebanon’s Ministry of Economy and Trade, which is responsible for its implementation, has yet to issue directives on how to submit personal data processing requests. This lack of action on the part of the ministry undermines the object and purpose of the law.

The law has several provisions that allow public entities to access personal data without providing any clear criteria on personal data can be accessed. For example, the Ministry of Telecommunications can collect any data it wants with the help of the only two Lebanese telecommunications providers, Alfa and Touch (both of which are owned by the government), and share this data with other government entities without users’ consent. The law concentrates power in the executive branch and fails to provide many standards and safeguards adopted in international data protection legislation. The law fails to protect citizens’ and residents’ personal data.

Weak Telecommunications Infrastructure

In 2004, just nine percent of the Lebanese population used the Internet. This number increased dramatically over the following years. In January 2012, the number of Internet users was 2.79 million of Lebanon’s total population. This number increased by 25.6% to 3.50 million users as of January 2013, and grew progressively until January 2019, when it reached 5.36 million users.

According to We Are Social’s Digital 2022: Global Overview Report, which provides an overview of the adoption and use of connected devices and services worldwide, the total population in Lebanon reached 6.73 million as of February 2022, while the number of mobile cellular connections hit 4.60 million—indicating that 68.3% of the population used mobile devices. The number of Internet users documented at the time was 6.01 million, or 89.3% of the population, and the number of active social media users was 5.06 million, making up 75.2% of the population. Updated numbers covering 2023 are yet to be published. A decrease in these numbers is expected due to the severe currency devaluation that reached 100% in January 2023, which resulted in a surge of Internet subscription fees and continuous cuts to Internet services, without any compensation provided to users ever.

Access to the Internet is closely linked to digital rights, such as the right to privacy, and is essential to exercising the right to access information—a key factor for promoting transparency and accountability—which allows the public to engage in the public and political discourse. Digital rights should cover a multitude of issues objectively, including, but not limited to, respecting intellectual property rights, protecting personal information, and preventing online harassment and discrimination.

Lebanon’s telecommunications infrastructure is considered weak, and constrains access, despite increased demand for fixed and mobile services. Investment in this sector has been hindered by the ongoing economic and monetary crises, and by extensive damage to infrastructure due to the lack of maintenance. Additionally, Lebanon has been ranked as the fifth most expensive country in terms of communications services in the Middle East and North Africa (MENA) region,  according to Cable.co.uk, a telecommunications comparison site.

As residents of Lebanon face significant obstacles in their attempts to use the Internet, especially during one of the world’s worst economic and monetary crises. This also means that all other human rights  indirectly linked to the right to Internet access are also undermined (or, at the very least, seriously challenging to exercise in today’s highly digitized world).

Insufficient Protection of Personal Data

Protecting personal data is an essential human entitlement enshrined in various international human rights documents. Privacy is central to the protection of human dignity and promotes and strengthens other rights, including freedom of speech, access to information, and the freedom of assembly.

The protection of personal data is evident in the Lebanese constitution. The preamble of the constitution binds the country to the Universal Declaration of Human Rights (UDHR), which as per the Lebanese Constitutional Court’s jurisprudence, gives the provisions of the UDHR constitutional value within the Lebanese legal system. Article 8 guarantees individual liberty, and Article 13 guarantees the right to freedom of expression and the right to access information, indirectly protecting citizens’ right to privacy through all means of communication. Yet, these constitutional guarantees are undermined through laws that offer people minimal protection.

Law No. 140 of 1999 on protecting the secrecy of communications stipulates the right to confidentiality of both internal and external communications, by all means, wired and wireless. Although the law aims to maintain the right to the privacy of correspondence carried out through any means of communication, as affirmed through Article 1, Article 2 states that “the interception of correspondence must take place by judicial order” in “cases of extreme necessity”, without  defining these terms or providing any criteria to limit the courts’ discretion, leaving it up to courts to decide whether to allow an interception or not; in a highly politicized and polarized judiciary, this threatens the protection of communication and personal data.

Meanwhile, Law No. 81 of 2018 does not provide for deterring sanctions or penalties against those who do not comply with its provisions. This creates a lack of motivation for public and private entities alike to prioritizing personal data protection. Also problematic is the ambiguity of specific provisions in the law. For example, the law does not clearly define what constitutes sensitive personal data, which may lead to uncertainty for entities that handle such data.

Aside from the aforementioned laws and overt prioritization of economic opportunity over personal data protection, the Lebanese parliament displays a blatant disregard for the importance of protecting personal data. The Parliamentary Elections Law obliges the Ministry of Interior and Municipalities to publish the sensitive personal data of all voters, such as their full name, mother’s name, date of birth, district, and personal status number—a gross violation of Lebanese voters’ right to privacy.

In a digitised world in which access to the Internet has become an essential tool in the daily lives of individuals and entities. Comprehensive and efficient digital rights infrastructure and legal framework must be put in place to protect users’ personal data.

Protecting personal data is a right that should be prioritized, and users accessing the Internet in Lebanon should proceed cautiously. While some specific laws and regulations do exist to regulate the processing of personal data rather than safeguarding it, the risk of personal data breaches remains high due to the country’s lack of quick and reliable Internet infrastructure. Ultimately, Lebanon’s weak regulations do not conform with international standards and best practices pertaining to digital rights, especially those enshrined within the European General Data Protection Regulation.