Freedom House Recommendations FOR POLICYMAKERS Protect privacy and security Strictly regulate the use of surveillance tools and the collection of personal information by government and law enforcement agencies. Government surveillance programs should adhere to the International Principles on the Application of Human Rights to Communications Surveillance, a framework agreed upon by a broad consortium of civil society groups, industry leaders, and scholars for protecting users’ rights. The principles, which state that all communications surveillance must be legal, necessary, and proportionate, should also be applied to open-source intelligence methods such as social media monitoring and biometric surveillance technologies. In the United States, lawmakers should reform or repeal existing surveillance laws and practices, including those under Section 702 of FISA and EO 12333— actions that may be necessary to secure datasharing agreements with other democracies and the European Union. Policymakers should also investigate the extent to which commercial surveillance tools, such as spyware and extraction technology, have been used against Americans. Enact robust data privacy legislation. Governments should enact updated legal frameworks that comprehensively safeguard user information. Individuals should have control over their information, including the right to access it, delete it, and easily transfer it to the providers of their choosing. Companies should be required to limit the collection of consumer data and disclose in plain language how they use it, as well as details on third parties that may access the data and how they are allowed to use it. Companies should be required to notify customers in a timely fashion if their information is compromised. Updated data privacy legislation should also provide a mechanism for independent verification of major foreign and domestic companies’ data-collection practices to ensure compliance with local laws on privacy, nondiscrimination, and consumer protection. In the United States, lawmakers should pass a federal electronic privacy law that provides robust data protections, including for biometric data, and harmonizes rules among the 50 states. The Federal Trade Commission (FTC) and other relevant agencies should be empowered to pursue privacy enforcement using existing authorities. Protect encryption. Policymakers should recognize that robust encryption is fundamental to cybersecurity, commerce, and human rights, and that weakening encryption endangers the lives of activists, journalists, members of marginalized communities, and ordinary users around the world. Governments should refrain from introducing legislation that mandates the introduction of so-called “back doors” or reduces intermediary liability protections for providers of end-to-end encryption services. In the United States, any reforms to Section 230 of the Communications Decency Act should not undermine the ability of intermediaries and service providers to offer robust encryption. Restrict the export of censorship and surveillance technology. Democracies should place strict limits on the sale of technologies that enable monitoring, surveillance, interception, or collection of information and communications—including spyware, extraction technology, and systems whose machine learning, natural language processing, and artificial intelligence capabilities can be misused, and should consider new multilateral export controls. When reviewing export-licensing applications, governments should give extra scrutiny to applications from companies exporting products to countries rated as Not Free or Partly Free by Freedom House. The most frequent abuses of censorship and surveillance occur in countries with these ratings. Businesses exporting technologies that could be used to commit human rights abuses should be required to report annually to the public on the impacts of their exports. Reports should include a list of countries to which they have exported such technologies, potential human rights concerns in each of those countries, a summary of pre-export due diligence undertaken to ensure their products are not misused, human rights violations that have occurred as a result of the use or potential use of their technologies, and efforts to mitigate the harm done and prevent future abuses. Further, government export guidance should urge businesses to adhere to the UN Guiding Principles on Business and Human Rights when exporting dual-use technologies to countries rated Partly Free or Not Free by Freedom House. In the United States, Congress should pass the Foreign Advanced Technology Surveillance Accountability @freedomhouse freedomhouse.org 25