State Communications Surveillance and Freedom of Opinion and Expression: Conclusions and Recommendations

This text is the final chapter „Conclusions and Recommendations“ of the report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue.

Communications techniques and technologies have evolved significantly, changing the way in which communications surveillance is conducted by States. States must therefore update their understandings and regulation of communications surveillance and modify their practices in order to ensure that individuals’ human rights are respected and protected.

States cannot ensure that individuals are able to freely seek and receive information or express themselves without respecting, protecting and promoting their right to privacy. Privacy and freedom of expression are interlinked and mutually dependent; an infringement upon one can be both the cause and consequence of an infringement upon the other. Without adequate legislation and legal standards to ensure the privacy, security and anonymity of communications, journalists, human rights defenders and whistleblowers, for example, cannot be assured that their communications will not be subject to States’ scrutiny.

In order to meet their human rights obligations, States must ensure that the rights to freedom of expression and privacy are at the heart of their communications surveillance frameworks. To this end, the Special Rapporteur recommends the following:

Updating and strengthening laws and legal standards

Communications surveillance should be regarded as a highly intrusive act that potentially interferes with the rights to freedom of expression and privacy and threatens the foundations of a democratic society. Legislation must stipulate that State surveillance of communications must only occur under the most exceptional circumstances and exclusively under the supervision of an independent judicial authority. Safeguards must be articulated in law relating to the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorize, carry out and supervise them, and the kind of remedy provided by the national law.

Individuals should have a legal right to be notified that they have been subjected to communications surveillance or that their communications data has been accessed by the State. Recognizing that advance or concurrent notification might jeopardize the effectiveness of the surveillance, individuals should nevertheless be notified once surveillance has been completed and have the possibility to seek redress in respect of the use of communications surveillance measures in their aftermath.

Legal frameworks must ensure that communications surveillance measures:

1. Are prescribed by law, meeting a standard of clarity and precision that is sufficient to ensure that individuals have advance notice of and can foresee their application;
2. Are strictly and demonstrably necessary to achieve a legitimate aim; and
3. Adhere to the principle of proportionality, and are not employed when less invasive techniques are available or have not yet been exhausted.

States should criminalize illegal surveillance by public or private actors. Such laws must not be used to target whistleblowers or other individuals seeking to expose human rights violations, nor should they hamper the legitimate oversight of government action by citizens.

The provision of communications data by the private sector to States should be sufficiently regulated to ensure that individuals’ human rights are prioritized at all times. Access to communications data held by domestic corporate actors should only be sought in circumstances where other available less invasive techniques have been exhausted.

The provision of communications data to the State should be monitored by an independent authority, such as a court or oversight mechanism. At the international level, States should enact Mutual Legal Assistance Treaties to regulate access to communications data held by foreign corporate actors.

Surveillance techniques and practices that are employed outside of the rule of law must be brought under legislative control. Their extra-legal usage undermines basic principles of democracy and is likely to have harmful political and social effects.

Facilitating private, secure and anonymous communications

States should refrain from compelling the identification of users as a precondition for access to communications, including online services, cybercafés or mobile telephony.

Individuals should be free to use whatever technology they choose to secure their communications. States should not interfere with the use of encryption technologies, nor compel the provision of encryption keys.

States should not retain or require the retention of particular information purely for surveillance purposes.

Increasing public access to information, understanding and awareness of threats to privacy

States should be completely transparent about the use and scope of communications surveillance techniques and powers. They should publish, at minimum, aggregate information on the number of requests approved and rejected, a disaggregation of the requests by service provider and by investigation and purpose.

States should provide individuals with sufficient information to enable them to fully comprehend the scope, nature and application of the laws permitting communications surveillance. States should enable service providers to publish the procedures they apply when dealing with State communications surveillance, adhere to those procedures, and publish records of State communications surveillance.

States should establish independent oversight mechanisms capable to ensure transparency and accountability of State surveillance of communications.

States should raise public awareness on the uses of new communication technologies in order to support individuals in properly assessing, managing, mitigating and making informed decisions on communications-related risks.

Regulating the commercialization of surveillance technology

States should ensure that communications data collected by corporate actors in the provision of communications services meets the highest standards of data protection.

States must refrain from forcing the private sector to implement measures compromising the privacy, security and anonymity of communications services, including requiring the construction of interception capabilities for State surveillance purposes or prohibiting the use of encryption.

States must take measures to prevent the commercialization of surveillance technologies, paying particular attention to research, development, trade, export and use of these technologies considering their ability to facilitate systematic human rights violations.

Furthering the assessment of relevant international human rights obligations

There is a significant need to advance international understanding on the protection of the right to privacy in light of technological advancements. The Human Rights Committee should consider issuing a new General Comment on the right to privacy, to replace General Comment No. 16 (1988).

Human rights mechanisms should further assess the obligations of private actors developing and supplying surveillance technologies.