U.N. Special Rapporteur Report on Mass Digital Surveillance and Article 17 of the ICCPR

58. States’ obligations under article 17 of the International Covenant on Civil and Political Rights include the obligation to respect the privacy and security of digital communications. This implies in principle that individuals have the right to share information and ideas with one another without interference by the State, secure in the knowledge that their communication will reach and be read by the intended recipients alone. Measures that interfere with this right must by authorized by domestic law that is accessible and precise and that conforms with the requirements of the Covenant. They must also pursue a legitimate aim and meet the tests of necessity and proportionality. 59. The prevention and suppression of terrorism is a public interest imperative of the highest importance and may in principle form the basis of an arguable justification for mass surveillance of the Internet. However, the technical reach of the programmes currently in operation is so wide that they could be compatible with article 17 of the Covenant only if relevant States are in a position to justify as proportionate the systematic interference with the Internet privacy rights of a potentially unlimited number of innocent people located in any part of the world. Bulk access technology is indiscriminately corrosive of online privacy and impinges on the very essence of the right guaranteed by article 17. In the absence of a formal derogation from States’ obligations under the Covenant, these programmes pose a direct and ongoing challenge to an established norm of international law. 60. The Special Rapporteur concurs with the High Commissioner for Human Rights that there is an urgent need for States using this technology to revise and update national legislation to ensure consistency with international human rights law. Not only is this a requirement of article 17, but it also provides an  important opportunity for informed debate that can raise public awareness and enable individuals to make informed choices. Where the privacy rights of the  entire digital community are at stake, nothing short of detailed and explicit primary legislation should suffice. Appropriate restrictions should be imposed on the use that can be made of captured data, requiring relevant public authorities to provide a legal basis for the reuse of personal information. 61. States should establish strong and independent oversight bodies that are adequately resourced and mandated to conduct ex ante review, considering  applications for authorization not only against the requirements of domestic law, but also against the necessity and proportionality requirements of the Covenant. In addition, individuals should have the right to seek an effective remedy for any alleged violation of their online privacy rights. This requires a means by which affected individuals can submit a complaint to an independent mechanism that is capable of conducting a thorough and impartial review, with access to all relevant material and attended by adequate due process guarantees. Accountability mechanisms can take a variety of forms, but must have the power to order a binding remedy. States should not impose standing requirements that undermine the right to an effective remedy. 62. The Special Rapporteur concurs with the High Commissioner for Human Rights that where States penetrate infrastructure located outside their territorial jurisdiction, they remain bound by their obligations under the Covenant. Moreover, article 26 of the Covenant prohibits discrimination on  grounds of, inter alia, nationality and citizenship. The Special Rapporteur thus considers that States are legally obliged to afford the same privacy protection  for nationals and non-nationals and for those within and outside their jurisdiction. Asymmetrical privacy protection regimes are a clear violation of  the requirements of the Covenant. 63. The Special Rapporteur calls upon all States that currently operate mass digital surveillance technology to provide a detailed and evidence-based public justification for the systematic interference with the privacy rights of the online community by reference to the requirements of article 17 of the Covenant. States should be transparent about the nature and extent of their Internet penetration, its methodology and its justification, and should provide a detailed public account of the tangible benefits that accrue from its use. 64. The Special Rapporteur concurs with his predecessor (see A/HRC/13/37, para. 19) and with the former Special Rapporteur on the promotion and protection of the right to freedom of expression and opinion (see A/HRC/23/40, para. 98) that the Human Rights Committee should develop and adopt a new general comment on the right to online privacy, which would reflect developments in the surveillance of digital communications that have taken place since general comment 16 was adopted in 1988.