International human rights standards ARTICLE 19 Data protection The digital era raises substantial new privacy concerns. The handling of increasingly large amounts of personal data by both state actors and tech companies (and indeed other companies) poses privacy risks. States should therefore enact modern data protection laws which, among other things, require the responsible handling of and prevent inappropriate access to and use of personal data, including by state actors. The rules governing state surveillance should incorporate procedural safeguards, effective oversight, and requirements for authorisation, as well as the possibility of review by independent bodies.17 Laws which automatically compel data sharing with administrative authorities would not, for example, meet this requirement. Requirements that private companies retain personal data or store such data within a country (‘data localisation’ requirements) are also problematic.18 Such requirements create vulnerabilities and make it more likely that data will be subject to unauthorised access. When paired with legal regimes which make it easy for authorities to access personal data, such rules can seriously undermine the right to privacy and, particularly in authoritarian contexts, pose a serious risk to activists, journalists, human rights defenders, and others who may be targeted for exercising fundamental rights. Laws which prohibit anonymous speech, which is protected under human rights law, raise similar problems.19 Requiring internet users to register their real identity or provide personal data poses risks to both freedom of expression and privacy.20 Human rights and the private sector Under international human rights law, states have obligations to avoid perpetrating violations of human rights and to put in place a framework for the protection of rights. They are not necessarily responsible for the acts of third parties, such as private companies, but international human rights law does impose certain responsibilities on states towards such actors. This includes the responsibility to put in place legal frameworks which prohibit human rights abuses by third parties and to take action in response to failures to respect those legal frameworks. Specifically, states should ‘exercise due diligence to prevent, punish, investigate or redress’ harm caused by private actors.21 ____________________________________________ 17 A/HRC/39/29, paras 34–35, 39. Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, 30 March 2017, A/HRC/35/22, para 20. 19 Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, 17 April 2013, A/HRC/23/40, para 23. 20 A/HRC/23/40, paras 23, 68–69. 21 Human Rights Committee, General Comment No. 31, para 8. 18 13