A codicil to our ongoing discussion of the human rights implications of foreign and mass surveillance (see prior posts by Ryan Goodman (here and here), Philip Alston, Jennifer Daskal, and Martin Scheinin, among others). As we’ve reported, in late 2013, with leadership from Germany and Brazil, 56 states sponsored U.N. General Assembly Resolution 68/137 on “The Right to Privacy in the Digital Age.” The Resolution was adopted by consensus on December 18, 2013. The text invokes both the Universal Declaration of Human Rights (UDHR), which proclaims the right to privacy at Article 12 without territorial limit, as well as the ICCPR, whose Article 17 states:
(1) no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation;
(2) everyone has the right to the protection of the law against such interference or attacks.
This set of rights is subject to Article 2(1), which sets forth the ICCPR’s scope of application and governs the extraterritorial reach of the Covenant:
Each State Party to the present Covenant undertakes to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the present Covenant…
As Philip Alston noted on this blog, the Resolution is not the end of a process, but rather the beginning. Indeed, it empowers the U.N. High Commissioner for Human Rights, Navi Pillay, to prepare a major study on the protection and promotion of the right to privacy in the context of
- domestic and extraterritorial surveillance,
- interception of digital communications, and
- the collection of personal data.
Her report will be presented later this year to the Human Rights Council at its 27th session and to the General Assembly at its 69th session; as such, it will serve as the basis for continual debate and discussion going forward.
In February, the Office of the High Commissioner for Human Rights issued a global data call asking U.N. member states and non-governmental organizations to provide her with information on the following topics:
- What measures have been taken at the national level to ensure respect for and protection of the right to privacy, including in the context of digital communication?
- What measures have been taken to prevent violations of the right to privacy, including by ensuring that relevant national legislation complies with the obligations of Member States under international human rights law?
- What specific measures have been taken to ensure that procedures, practices and legislation regarding the surveillance of communications, their interception and the collection of personal data, are coherent with the obligations of Member States under international human rights law?
- What measures have been taken to establish and maintain independent, effective domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability of State surveillance of communications, their interception and collection of personal data?
- Any other information on the protection and promotion of the right to privacy in the context of domestic and extraterritorial surveillance and/or interception of digital communications and collection of personal data.
Submissions are due April 1st and will be posted on the High Commission’s website.
The High Commissioner, Navi Pillay, to a certain degree tipped her hand on her views in a February 2014 speech at an expert’s session on “The Right to Privacy in the Digital Age” in Geneva in which she stated:
While the right to privacy under international human rights law is not absolute, any instance of interference must be subject to a careful and critical assessment of its necessity, legitimacy and proportionality.
A coalition of over 400 international organizations—including Privacy International, the Electronic Frontier Foundation, Access, Human Rights Watch, and Reporters Without Boarders—developed a set of 13 principles on the application of human rights to communications surveillance in connection with a previous session of the U.N. Human Rights Council. The thrust of the principles is that in order to comply with states’ human rights obligations (including the right to privacy and the associated freedoms of thought, of expression, to seek and impart information, and of association (see ICCPR Articles 17-22)), communications surveillance must be
- Prescribed by law with sufficiency clarity so that the public has adequate notice of the program and so that the measures and results can be subject to periodic review,
- Necessary to achieve a legitimate aim,
- Proportionate to the aim pursued,
- Implemented in a way that is free from discrimination on invidious grounds, and
- Subject to oversight.
Also of relevance will be the Reports of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, Frank La Rue. In his 2011 Report, LaRue notes that
[T]he right to privacy can be subject to restrictions or limitations under certain exceptional circumstances. This may include State surveillance measures for the purposes of administration of criminal justice, prevention of crime or combating terrorism.
However, such interference is permissible only if the criteria for permissible limitations under international human rights law are met. Hence, there must be a law that clearly outlines the conditions whereby individuals’ right to privacy can be restricted under exceptional circumstances, and measures encroaching upon this right must be taken on the basis of a specific decision by a State authority expressly empowered by law to do so, usually the judiciary, for the purpose of protecting the rights of others, for example to secure evidence to prevent the commission of a crime, and must respect the principle of proportionality.
In his 2013 Report, LaRue reiterated the framework first developed and advanced by Martin Scheinin, when he was Special Rapporteur on the Promotion and Protection of Human Rights and Fundamental Freedoms while Countering Terrorism, in his prescient 2009 report (see para. 17) on the right to privacy in the fight against terrorism:
28. The framework of article 17 of the ICCPR enables necessary, legitimate and proportionate restrictions to the right to privacy by means of permissible limitations. …
29. In this regard, the Special Rapporteur takes the position that the right to privacy should be subject to the same permissible limitations test as the right to freedom of movement, as elucidated in General Comment 27 [on the right to Freedom of Movement, ICCPR Article 12]:
(a) Any restrictions must be provided by the law (paras. 11-12);
(b) The essence of a human right is not subject to restrictions (para. 13);
(c) Restrictions must be necessary in a democratic society (para. 11);
(d) Any discretion exercised when implementing the restrictions must not be unfettered (para. 13);
(e) For a restriction to be permissible, it is not enough that it serves one of the enumerated legitimate aims. It must be necessary for reaching the legitimate aim (para. 14);
(f) Restrictive measures must conform to the principle of proportionality, they must be appropriate to achieve their protective function, they must be the least intrusive instrument amongst those which might achieve the desired result, and they must be proportionate to the interest to be protected (paras. 14-15).
In addition, in explaining the formulation of Article 17 of the ICCPR, the Human Rights Committee in its 1988 General Comment 16 on the Right to Privacy noted:
3. The term “unlawful” means that no interference can take place except in cases envisaged by the law. Interference authorized by States can only take place on the basis of law, which itself must comply with the provisions, aims and objectives of the Covenant.
4. … [T]he expression “arbitrary interference” can also extend to interference provided for under the law. The introduction of the concept of arbitrariness is intended to guarantee that even interference provided for by law should be in accordance with the provisions, aims and objectives of the Covenant and should be, in any event, reasonable in the particular circumstances. …
8. Even with regard to interferences that conform to the Covenant, relevant legislation must specify in detail the precise circumstances in which such interferences may be permitted. A decision to make use of such authorized interference must be made only by the authority designated under the law, and on a case-by-case basis. Compliance with article 17 requires that the integrity and confidentiality of correspondence should be guaranteed de jure and de facto.
This consultative process offers the High Commissioner an opportunity to expand upon her prior remarks and to provide concrete legal and policy guidance to states and civil society. In addition to adding content to the right to privacy and correlative freedoms, the High Commissioner will also be contributing to our understanding of the extraterritoriality of states’ human rights obligations. In particular, given the ongoing debate about extraterritoriality and the reach of Article 2(1), she should focus the question of what it means to be within a state’s “jurisdiction” in the digital age.
Although many prior cases that have addressed extraterritoriality have involved situations in which the individual whose rights are at issue was within the physical control or custody of the state, there are plenty of situations that do not adhere to this classic scenario, as noted by Goodman, Scheinin, and my own research. Rather, individuals may find themselves within a state’s “jurisdiction” when the state has the power to infringe the right in question, regardless of the state’s control of territory or the person. Thus, individuals whose digital correspondence is being collected are clearly within the “power” or “effective control” of the state party, at least in so far as the implicated rights are concerned (e.g., conscience, privacy, speech).
This burgeoning case law demonstrates that the question of whether states’ human rights obligations are applicable when they act on individuals abroad is not a categorical determination, but is rather more in the nature of a sliding scale; states are subject to some human rights obligations even in situations in which the state does not exercise full physical control over offshore territory or an individual, or does not possess the ability to respect or ensure the entire corpus of an individual’s human rights. If the state exercises effective control over the ability of the individual to enjoy a particular right, then the corresponding state obligation applies extraterritorially.
Of course, as the above sources emphasize, the rights to privacy and speech, etc. are not absolute. There will be national security and law enforcement exigencies that justify infringements upon these rights, domestically or internationally, but subject to the limitations identified above: the restrictions must be provided by law, non-arbitrary, proportionate, necessary, the least restrictive means, etc.
In her upcoming report, the High Commissioner should work to translate the concepts of jurisdiction, effective control, and arbitrary interference as developed in the physical world into a standard of virtual control over the right to privacy, and related rights, in the digital world.