Camera

How Existing Human Rights Law Applies to Modern Digital Surveillance

A group of worldwide privacy organizations and advocates have adopted and released a document entitled “The International Principles on the Application of Human Rights to Communications surveillance“.

The document sets out how existing international human rights laws applies in the digital environment and details thirteen principles that must be adhered to by any government in order to comply with current international law.

Importantly, the document addresses the distinction between collection of the content of a communication and the collection of the “communications metadata”, and concludes that the distinction between the two are no longer appropriate; metadata and other non-content data deserves equal protection because it may reveal even more about an individual than the content of the communication itself.

The thirteen principles, based on current international law, outlined in the document are summarized below.

Legality

Any limitation to the right of privacy must be prescribed by a publicly available legislative act, and subject to periodic review.

Legitimate Aim

Laws should only permit surveillance by specified state authorities.

Any surveillance must be conducted to achieve a legitimate aim that corresponds to a predominantly important legal interest that is necessary in a democratic society.

Necessity

Surveillance should not be widespread, but must be restricted only to what is necessary to achieve the legitimate aim.

Surveillance should only be conducted when it is the only method to achieve the legitimate aim, or is the method that is least likely to infringe on the persons human rights.

Adequacy

The surveillance must be able to fulfil the legitimate aim.
Proportionality

Before any state engages in surveillance for the purposes of a criminal investigation it must establish before an independent court that:

  • there is a high degree of probability that a serious crime has been or will be committed;
  • evidence of that crime will be obtained by the surveillance;
  • other less invasive techniques have been exhausted;
  • the information gathered will be limited to that which is relevant to the alleged crime; and
  • the information gathered will only be accessed by the specified authority and used only for the purposes for which permission was granted.

If the surveillance will not put the person at risk of criminal prosecution the state must establish before an independent court that:

  • less invasive investigative techniques have been considered;
  • the information accessed will be confined to what is reasonably relevant and any excess information will be destroyed or returned; and
  • the information gathered will only be accessed by the specified authority and used only for the purposes for which permission was granted.

Competent Judicial Authority

All determinations relating to surveillance should be made by a competent, impartial and independent court which is separate from the authority conducting the surveillance.

Due Process

In the determination of human rights everyone is entitled to a fair and public hearing. The mere risk of flight or destruction of evidence shall never be considered as sufficient to justify retroactive authorization.
User Notification

Users must be notified of a decision authorizing surveillance to enable them to appeal the decision. Delay in notification is justifiable if:

notification would would seriously jeopardize the purpose of the surveillance; or
authorization to delay is granted by the judicial authority; and
the individual is notified within a reasonably practical time period.

Transparency

States must be transparent about the use and scope of surveillance techniques used. States should publish transparency reports detailing the type and nature of surveillance, including the number of surveillance requests approved or rejected, in order for individuals to fully comprehend the scope, nature and application of the laws permitting surveillance.

Public Oversight

Independent oversight mechanisms, which has access to all potentially relevant state information including secret and classified information, must be established. This is to ensure that the state is acting within its lawful authority.

Integrity of Communications and Systems

States should not compel service providers or hardware or software providers to build in surveillance capabilities into their systems; compromising security for the state always compromises general security which would make these systems more vulnerable to attack by unauthorized third parties.

Service providers should not be compelled to collect information purely for state surveillance purposes.

Individuals have the right to express themselves anonymously, and states should not require service providers to identify their users as a precondition
for providing services.

Safeguards for International Cooperation

When concluding multinational mutual legal assistance treaties, states must ensure that when the laws of more than one state applies to the communication then the law which provides the greatest protection to the individual is applied. This prevents states from circumventing their own domestic legal restrictions.

Safeguards Against Illegitimate Access

Legislation criminalizing illegal surveillance by public and private persons, and providing for significant criminal and civil penalties if contravened, must be enacted.

Legal protection must be provided to whistle blowers.

Information obtained in contravention of the principles must be inadmissible as evidence in any proceedings.


This work by Clinton Pavlovic is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.