A Guide to Litigating Identity Systems DATA SHARING 58. The absence of a data protection framework limiting the extent to which private and public actors can access identity system data makes an identity system incompatible with privacy rights and democratic values. a) The Mauritian Supreme Court finds that the indefinite storage of fingerprint data used by the Mauritian national identity system was impermissible because of the ease of access to fingerprint data by a wide range of actors with little judicial oversight.240 Actors capable of accessing the data under the Mauritian Data Protection Act included law enforcement, artists, healthcare providers, financial firms, and lawyers.241 While the court identifies the storage of fingerprint data as satisfying the initial requirements of a public order exception to the Mauritian Constitution’s protection against searches,242 the storage practice does not satisfy the limitation of the exception requiring the practice be “reasonably justifiable in a democratic society.”243 b) The Jamaican Supreme Court also takes issue with data-sharing provisions included within the national identity system in Jamaica, which at the time of the decision did not have a complementary standalone data protection law.244 Justice Sykes finds that provisions of the identity system legislation that allowed for third-party access to the system database were unconstitutional because of a lack of safeguards.245 Justice Sykes suggests that data must be relevant and not excessive in relation to the purpose for which it is stored and data must not be stored 240 Madhewoo, 2015 SCJ 177 at 32–33. 241 Madhewoo, 2015 SCJ 177 at 32. 242 Madhewoo, 2015 SCJ 177 at 29. 243 Madhewoo, 2015 SCJ 177 at 34. 244 Opinion of Justice Sykes, ¶ 3. 245 Opinion of Justice Sykes, ¶ 247(B)(115). 56