BSR | Human Rights Impact Assessment: Facebook in Myanmar 37 PRIVACY As specified in Article 12 of the UDHR and Article 17 of the ICCPR, no one shall be subjected to arbitrary interference with his or her privacy, family, home or correspondence, nor to attacks upon his or her honor and reputation, and everyone has the right to the protection of the law against such interference or attacks. Risk / Opportunity Severity Factors Management Factors What is the potentially adverse human rights impact that might happen in the future? Scope (How many people could be affected by the harm/opportunity?) Likelihood (How likely is the impact to happen over next five years?) Scale (How serious are the impacts for the victim?) Attribution (How closely is Facebook connected to the impact?) Remediability (Will remedy restore the victim to same or equivalent position?) Content that violates the privacy rights of users (such as ID numbers, personal photos, passwords, phone numbers, etc.) may be posted on the Facebook platform, but not discovered and removed. Scope: There are around 20 million Facebook users in Myanmar, all of whom are at risk of privacy violations, especially given the prevalence of out-of-date Facebook apps. Content intended to out an individual as a member of a designated and recognizable at-risk group may be posted on the Facebook platform, but not discovered and removed. Scale: The consequences for vulnerable populations can be severe, especially if privacy violations lead to violations of their right to life, liberty, and security of person. (See Security risks, above.) A user’s account may be hacked by another user. Remediability: Some access to remedy does exist, such as private content being removed, data being purged, passwords being changed, or apps being updated. However, privacy violations can have permanent impacts—for example, if private information is shared via screenshot and cannot be purged. A system of mass surveillance may return to Myanmar (such as forms of direct access to communications), resulting in a significant increase in government requests for user data. Leverage (How much ability does Facebook have to effect change?) Likelihood: Lack of digital literacy and the existence of political, ethnic, and communal conflict in Myanmar make the likelihood of these risks occurring higher than in many other markets—and many privacy violations, such as the posting of sensitive personal information, are happening today. Attribution: Facebook does not cause or contribute to these violations, but is linked to them via its products and services. Leverage: Facebook has leverage available via efforts to increase digital literacy (e.g., about passwords or maintaining separate accounts), efforts to assist with the updating of apps by users, and public policy efforts to promote proprivacy legal reform in Myanmar.