ARTICLE 19 welcomes the adoption by the UN Human Rights Council (HRC) of a resolution that significantly advances States’ commitments to protect the right to privacy in the digital age. For the first time, the resolution affirms that State’s surveillance practices should be justified according to the principles of legality, necessity and proportionality. Progress on this and other standards in the resolution reflect many of ARTICLE 19’s new Global principles on privacy and freedom of expression.
“This resolution reinforces that privacy is essential to the meaningful exercise of the right to freedom of expression. This is crucial for investigative journalists, human rights defenders, and whistleblowers, who require secure communications to expose wrongdoing and inform the public, and who need privacy to protect themselves and their sources,” said Thomas Hughes, Executive Director of ARTICLE 19.
“Almost four years after the Snowden revelations, States are finally agreeing with the public that privacy violations must be subject to the same scrutiny as other rights violations. This resolution is the clearest articulation yet that sweeping surveillance practices that are neither necessary or proportionate are against international human rights law.”
“The resolution must now be translated into action. Governments must end mass surveillance, end interference with our secure communications, and ensure businesses do the same”, Hughes added.
The resolution on “the right to privacy in the digital age” (A/HRC/34/L.7/Rev.1) was adopted by consensus on 23 March 2017 at the 34th Session of the UN Human Rights Council. The resolution was led by Brazil and Germany, with a core group of Austria, Lichtenstein, Mexico, and Switzerland, and was supported by 66 cosponsoring States.
Importantly, the resolution calls for the convening of an expert workshop on the right to privacy in the digital age, to include a focus on the role of businesses, and a further report of the UN High Commissioner for Human Rights, to be presented to the 39th Session of the HRC in September 2018. Both will enable substantive contributions from across disciplines and stakeholder groups to further elaborate applicable norms to the right to privacy, and challenges of implementation.
The resolution builds upon one previous HRC resolution and decision and three UN General Assembly resolutions of the same title, all following the global debate on the human rights implications of States’ mass surveillance practices provoked by the Snowden revelations in 2013.
Importantly, the present HRC resolution stresses, for the first time, that:
“States should ensure that any interference with the right to privacy is consistent with the principles of legality, necessity and proportionality”
It is significant that the 47-seat Human Rights Council, which includes among its current membership the United Kingdom and the United States of America, reached consensus on the need for States to justify interferences with the right to privacy in accordance with the principles of legality, necessity and proportionality.
Though previous resolutions on the right to privacy in the digital age were all adopted by consensus, differing views between States had until now prevented the articulation of this principle so clearly. This is a significant step forward, bringing HRC resolution standards into line with the views of the Human Rights Committee, the treaty body of experts monitoring States’ compliance with the right to privacy as protected in the International Covenant on Civil and Political Rights, as well as the conclusions and recommendations of the UN Special Rapporteurs on the right to freedom of opinion and expression, on the right to privacy, and on the promotion and protection of human rights while countering terrorism.
The requirement for States to justify the necessity and proportionality of privacy interferences is particularly relevant to considering whether States’ practices of mass surveillance are compatible with international human rights law. ARTICLE 19 has long argued, with many others, that such indiscriminate practices undertaken without specific, individualised, or reasonable suspicion are inherently unnecessary and disproportionate, and have a chilling effect on freedom of expression. Though the resolution does not go as far as reaching a conclusion on this issue, consensus on the applicable principles represents notable progress in that direction.
The resolution also makes a number of other normative advances, and strengthens elements from previous UN resolutions:
- Anonymity and encryption: for the first time, the HRC emphasises that technical solutions to secure the confidentiality of digital communications, including measures for encryption and anonymity, are important for all people’s enjoyment of human rights, including to freedom of expression, and that States must not interfere with the use of such technical solutions. This expands on the HRC’s affirmation of this principle in relation to journalists and the protection of their sources in 2016, and aligns with the recommendations of the UN Special Rapporteur on the right to freedom of expression.
- Metadata: the resolution strengthens references made previously to metadata or communications data, now noting that its aggregation “can reveal personal information that can be no less sensitive than the actual content of communications and can give an insight into an individual’s behaviour, social relationships, private preferences and identity”.
- Algorithms and profiling: the resolution raises new concerns on the automatic processing of personal data, inclusive of metadata, for “individual profiling may lead to discrimination or decisions that otherwise have the potential to affect the enjoyment of human rights”. These concerns reflect how privacy-invasive automatic processing can be in the rapidly developing context of ‘big data’ and automated (algorithmic) decision-making, and how these human-built processes may reproduce societal prejudices and lead to discrimination.
- Role of business enterprises: the resolution reiterates the responsibilities of business enterprises to respect human rights, including the rights to privacy and freedom of expression online, developing language on principles of data protection. Though not new elements, it repeats previous language that States must refrain from requiring business enterprises to take steps that unjustifiably interfere with the right to privacy, including when requesting the disclosure of personal information. The human rights principles applying to the relationship between States and business enterprises, in particular to protect privacy and freedom of expression online, should be considered in greater depth at the expert workshop.
ARTICLE 19 is grateful to Brazil, Germany and the core group for their open collaboration with civil society throughout the process leading to the adoption of this resolution. We look forward to working with all States at the UN to elaborate these principles further, including at the forthcoming expert workshop, and will work at all levels, to ensure that States implement these principles in law, policy, and practice.
Download the draft resolution, as adopted, here
Read ARTICLE 19’s Global Principles on Privacy and Freedom of Expression