Surveillance and human rights Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression*
https://undocs.org/A/HRC/41/35 28 May 2019
Extract from the report: The General Assembly has condemned unlawful or arbitrary surveillance and interception of communications as “highly intrusive acts”that interfere with fundamental human rights (see General Assembly resolutions 68/167 and 71/199). However, unlawful surveillance continues without evident constraint.
New focus in the United Nations on surveillance practices
65.The Human Rights Council has created,to real benefit, several working groups with mandates to address key themes on implementation of international human rights norms. The Council or its special procedures may consider a new mechanism to provide the kind of attention to specific cases that individual mandate holders may be unable to sustain and evaluate. A new working group, a cross-mandate task force, or a mandated plan of action could devote specific attention to claims that national surveillance practices –which touch on many areas of human rights law and thus many mandates of special procedures –interfere with fundamental human rights.
Recommendations
66. For States:
(a)States should impose an immediate moratorium on the export, sale, transfer, use or servicing of privately developed surveillance tools until a human rights-compliant safeguards regime is in place;
(b)States that purchase or use surveillance technologies (“purchasing States”) should ensure that domestic laws permit their use only in accordance with the human rights standards of legality, necessity and legitimacy of objectives, and establish legal mechanisms of redress consistent with their obligation to provide victims of surveillance-related abuses with an effective remedy;
(c)Purchasing States should also establish mechanisms that ensure public or community approval, oversight and control of the purchase of surveillance technologies;
(d)States that export or permit the export of surveillance technologies (“exporting States”) should ensure that the relevant government agencies solicit public input and conduct multi-stakeholder consultations when they are processing applications for export licences. All records pertaining to export licences should be stored and made available to the greatest extent possible. They should also establish safe harbours for security research and exempt encryption items from export control restrictions;
(e)Exporting States should join the Wassenaar Arrangement and abide by its rules and standards to the extent that these are consistent with international human rights law;
(f)States participating in the Wassenaar Arrangement should develop a framework by which the licensing of any technology would be conditional upon a national human rights review and companies’compliance with the Guiding Principles on Business and Human Rights. Such a framework could be developed through a specially established human rights working group. Additionally, they should set clear and enforceable guidelines on transparency and accountability with respect to licensing decisions, surveillance-related human rights abuses and the treatment of digital vulnerabilities.
67. For companies:
(a)Private surveillance companies should publicly affirm their responsibility to respect freedom of expression, privacy and related human rights, and integrate human rights due diligence processes from the earliest stages of product development and throughout their operations. These processes should establish human rights by design, regular consultations with civil society (particularly groups at risk of surveillance), and robust transparency reporting on business activities that have an impact on human rights;
(b)Companies should also put in place robust safeguards to ensure that any use of their products or services is compliant with human rights standards. These safeguards include contractual clauses that prohibit the customization, targeting, servicing or other use that violates international human rights law, technical design features to flag, prevent or mitigate misuse, and human rights audits and verification processes;
(c)When companies detect misuses of their products and services to commit human rights abuses, they should promptly report them to the relevant domestic, regional or international oversight bodies. They should also establish effective grievance and remedial mechanisms that enable victims of surveillance-related human rights abuses to submit complaints and seek redress.
68. For the United Nations: the Organization, particularly the Human Rights Council, should create a working group or cross-mandate task force to monitor and provide recommendations on trends in, and individual cases of, human rights abuses facilitated by digital surveillance.
69.For all stakeholders: States, the private sector, civil society and other relevant stakeholders should establish co-regulatory initiatives that develop rights-based standards of conduct for the private surveillance industry and implement these standards through independent audits, and learning and policy initiatives.