30 Dictating the Internet: Data (Convention 108) – the most comprehensive existing international instrument on personal data protection which is open to accession by any State.80 The modernization of Convention 108 (now ‘Convention 108+’) in May 2018 included many elements of the GDPR, and its revision was a welcome effort to combat new challenges presented by developing ICTs.81 However, time is required to assess the impacts of implementation of both the GDPR and Convention 108+.82 vii. Extraterritoriality A fundamental challenge that has arisen in respect of human rights protection in the online sphere is a jurisdictional one. While enforcement of human rights obligations has traditionally been given effect through the apparatus of States, cyberspace operates across and beyond such territorial boundaries. International human rights law, however, similarly applies across and beyond boundaries in obliging human rights to be protected not only within a State territory but also in territories where States exercise effective control or any place where it may otherwise have jurisdiction.83 The 2014 OHCHR report on privacy online clarified that, within the online sphere, extraterritorial obligations of States pursuant to article 2 of the ICCPR and the principle of non-discrimination apply to violations committed in cyberspace.84 International human rights law has also been clarified to apply to non-State actors such as technological companies.85 The question therefore does not concern the applicability of international human rights standards per se to 80 81 82 83 84 85 Convention 108 was promulgated by the Council of Europe in 1981, but is open to accession by any State. As of October 2018, including 47 European States, Uruguay, Mauritius, Senegal, Tunisia, Morocco, Cape Verde, Argentina, Mexico, and Burkina have requested accession to the Convention. Eleven other countries, or their data protection authorities, are Observers on its Consultative Committee. See A/73/45712, footnote 83. Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, 128th Session of the Committee of Ministers (Elsinore, Denmark, 17-18 May 2018), Available at: https://search.coe.int/cm/Pages/result_details.aspx?ObjectId=09000016807c65bf A/73/45712, para 101. This was affirmed by the Maastricht Principles on Extraterritorial Obligations of States, which clearly defined the scope and nature of State obligations to individually and jointly respect, protect and fulfil economic, social and cultural rights defined beyond their borders. These principles are available at: https://www.fidh.org/IMG/pdf/maastricht-eto-principles-uk_web. pdf; The existence of State obligations ‘diagonally’ to persons in other countries is clarified in articles of the UN Charter, UDHR, ICCPR and ICESCR, as noted by Sarah Joseph, ‘Blame it on the WTO?: A Human Rights Critique’, 2011, under ‘Extraterritorial Human Rights Duties’, Available at: https://www.oxfordscholarship.com/view/10.1093/acprof:oso/9780199565894.001.0001/acprof9780199565894-chapter-9 A/HRC/27/37, paras 31 to 36. Corporate responsibility to respect and protect human rights was affirmed by the UN Guiding Principles on Business and Human Rights: Implementing the United Nations ‘Protect, Respect and Remedy’ Framework, Endorsed by UN Human Rights Council Resolution 17/4 of 16 June 2011, Available at: https://www.ohchr.org/documents/publications/GuidingprinciplesBusinesshr_eN.pdf