Privacy is a fundamental human rights included in a range of international and regional human rights instruments. This right is often framed in general terms within the right to respect for private or family life, protection of the home and non-interference with correspondence. Privacy is not an absolute right and limitations can be introduced provided they meet certain criteria.
The right to privacy is recognised in a wide range of international human rights instruments including:
The UN Special Rapporteur on the right to privacy noted in 2018 that:
“none of the major human rights treaties expressly include protection of personal information as an aspect of the right to privacy. Nonetheless, it is increasingly argued that the principles of data protection are incorporated within the broader right to privacy in these treaties.”
The notion of data protection originates from the right to privacy and both are instrumental in preserving and promoting fundamental values and rights and exercising other rights and freedoms such as free speech or the right to assembly. Data is created whenever we use a computer, a smartphone or even everyday electronic devices with sensors capable of recording information.
In 2013 the UN General Assembly adopted a resolution on the right to privacy in the digital era where it stated that: “the rights held by people offline must also be protected online.” The UN Human Rights Council recognised in 2016 that the right to privacy can enable the enjoyment of other rights and the free development of an individual’s personality and identity and an individual’s ability to participate in political, economic, social and cultural life, and that violations or abuses of the right to privacy might affect the enjoyment of other human rights.
In 2019, the UN Human Rights Council and the General Assembly noted that “violations and abuses of the right to privacy in the digital age may affect all individuals, including with particular effects on women, as well as children and persons in vulnerable situations, or marginalized groups” and called on States “to further develop or maintain, in this regard, preventive measures and remedies for violations and abuses regarding the right to privacy in the digital age that may affect all individuals, including where there are particular effects for women, as well as children and persons in vulnerable situations or marginalized groups.”
In 2014 the UN Special Rapporteur on the right to privacy made reference to strong evidence of a growing reliance by Governments on the private sector to conduct and facilitate digital surveillance. Governments have used both formal legal mechanisms and covert methods to gain access to content as well as to metadata, as the 2013 Snowden leaks revealed.
“Business enterprises should respect human rights. This means, they should avoid infringing on the human rights of others and should address adverse human rights impacts with which they are involved.”
“Companies should assess whether and how their terms of service, or their policies for gathering and sharing customer data, may result in an adverse impact on the human rights of their users. Where enterprises are faced with government demands for access to data that do not comply with international human rights standards, they are expected to seek to honour the principles of human rights to the greatest extent possible…A central part of human rights due diligence as defined by the Guiding Principles is meaningful consultation with affected stakeholders. In the context of information and communications technology companies, this also includes ensuring that users have meaningful transparency about how their data are being gathered, stored, used and potentially shared with others, so that they are able to raise concerns and make informed decisions”.
The UN Special Rapporteur on the right to privacy has expressed concerned not only with the collection of big data but also with firms having the ability to sell or trade it and to link it to other data to produce a complex and detailed picture of a person’s life. Companies that collect consumer’s personal information and resell or share that information with others, the so-called Data brokers, generally do it without consumers’ knowledge and with little or no transparency. Cases of corporations selling or sharing personal data for purposes such as advertising, credit scoring and insurance risk scoring have also been reported. The Cambridge Analytica scandal is the latest example of this.
At the same time, companies have also been negatively impacted by data breach on their websites. Yahoo, for instance, have been subjected to the biggest data breach in history in 2013, where personal information on more than 3 billion user accounts were obtained. Likewise, in 2016, hackers collected 20 years of data on six databases property of the network Adult Friend Finder.
Various measures have been taken at the international level in order to guarantee the right to privacy. In 1990 the UN published its Guidelines concerning computerised personal data files, which stated that information about persons should not be collected or processed in unfair or unlawful ways. More recently in 2017, the UN Secretary General launched the initiative Global Pulse on Big Data. It functions as a network of innovative labs where research on Big Data for Development is designed and coordinated. The platform has developed a set of Privacy Principles intended to help ensure that individuals whose data is used are not adversely affected. The OECD adopted in 2013 an updated version of its Privacy Guidelines that apply to personal data. The EU General Data Protection Regulation, that takes effect on May 25th, 2018, has the purpose of protecting data collected on EU citizens. The legislation is reportedly the most comprehensive and progressive piece of data protection legislation in the world.
Globally, 107 States have legislation in place to secure the protection of data and privacy. Countries such as the United Kingdom, Australia and Canada have an Information Commissioner to ensure compliance with such legislation.
Various multi-stakeholder initiatives in this field are worth mentioning. The project MAPPING, financed by the European Union, is a platform that aims to contribute to the digital transition and to improve the innovation climate in the EU concentrating efforts in privacy, property and internet governance. The Global Network Initiative, bringing together comprises a group of companies, civil society organisations, investors and academics, has the objective to create a collaborative approach to protect and advance freedom of expression and privacy in the ICT sector.
The Electronic Frontier Foundation’s (EFF) 2017 Who has your Back survey evaluates the 26 major US technology companies on their policies related to transparency and privacy. EFF stated in 2017 that:
“The tech industry as a whole has moved towards providing its users with more transparency, but telecommunications companies, which serve as the pipeline for communications and Internet service for millions of Americans, are failing to publicly push back against government overreach”.
Trough the initiative Reform Government Surveillance Coalition, companies in the ICT sector such as Google, Apple, Facebook, Dropbox, Twitter and Linkedin have joined efforts to request that the laws and practices on government surveillance and access to information be reformed.
Adequate data is critical for measuring progress towards the SDGs, as well as progress on human rights. Data from business’ reporting can help fill the gaps in areas where SDG data is still lacking. Enhancing the use of information and communication technology under SDG target 17.8 can also support data gathering efforts considerably. However, data collection and the promotion of technology that could enable distribution and dissemination of personal data can have a significant impact on the right to privacy, as well as the flow of information across state boundaries and between various actors, thus posing great challenges in terms of regulation, misuse of personal information, privacy, discrimination and access to remedy.
DIHR has highlighted the importance of a human rights-based approach to data in the context of the 2030 Agenda. This approach provides guidance on its 6 key principles of privacy, accountability, transparency, self-identification, participation and disaggregation.
What National Action Plans say on Data protection & privacy
Belgium
Section 5
Belgian framework relative to business enterprises and to human rights (Page 12-13)
In order to better identify the principal rights and responsibilities that Belgium engages itself to protect and to respect, the basic analysis concentrates on seven domains considered of the highest priority:
The right to life, liberty, and personal security;
The right to equality and non-discrimination;
The right of labourers;
The right to a clean and healthy environment;
The right to protection of privacy and the private life;
Pillar II baselines: Human rights as a moral and ethical obligation
Scope and content of the obligation to respect human rights [page 30]
For businesses, there are three dimensions to respect for human rights:…
Do not contribute to violations of human rights: A business does not commit violations itself, but acts in a way that facilitates or smooths the way for violations. This may encompass:…
The disclosure of customers’ personal data to an undemocratic regime.
Finland is involved in international work in UN decision-making bodies related to communication technologies (such as WSIS and the World Summit on the Information Society) as well as in other central international organisations (such as the Internet Governance Forum, IGF). The objective of Finland is to reinforce the administrative system of an open and inclusive network so that freedom of speech is ensured in the development of the international information society.
2. The State and Companies
2.2 The State and the protection of privacy [page 23]
The protection of privacy that is particularly related to electronic communications has received plenty of attention in recent public discussion. The right to privacy, the protection of personal data and the protection of confidential messages are fundamental human rights. The extent of data collection related to electronic communications has led to public discussion. Privacy questions related to electronic communications are particularly important in Finland, where the ICT infrastructure enjoys a strong position. This strength has played a significant role in the fact that Finland has been able to attract international ICT investments.
As a follow-up measure, the working group proposes that:
a roundtable discussion be organised on how to ensure the protection of privacy in Finland with the authorities, ICT companies and the civil society. Principal responsible party: Ministry of Transport and Communications, autumn 2014.
II. Business’s Responsibility to Respect Human Rights
The International Framework
5. Employee Representatives [page 43]
… The act on job security [Act of 14 June 2013] has several additional provisions for improving the information given to employees and reinforcing social dialogue in businesses and groups. Works councils must now be consulted on companies’ strategic goals…To prepare this consultation, databases must be created for employee representatives to assemble all useful information that is regularly communicated to works councils. Information must be kept up-to-date and have a forward-looking focus based on data and trends for the next three years. Employee representatives given access to companies’ sensitive and strategic data must comply with strict confidentiality requirements …
III. Access to Remedy
Judicial Mechanisms
1.4. Proceedings
Collective actions [page 51]
… Given the different fields of application mentioned in the bill, collective actions will become a tool allowing plaintiffs to stop or remedy discrimination in the labour field and elsewhere including with respect to the provision of services, accommodation, transport, etc. Collective actions will also be possible in the environmental, health, and personal data protection fields.
Objective 25.12.1: Ensure knowledge of business sector concerning human rights protection mechanisms, including personal data protection and finest standards for strengthening women.
Objective indicator: Presentation of the communicative strategy.
Activity: Elaborating effective communication strategy concerning personal data protection, women strengthening and standards of human rights protection.
Section 2. Current legislative and regulatory framework
Data Protection [page 14]
The office of the data Protection Commissioner (DPC) is responsible for upholding the general principle that individuals should be in a position to control how data relating to them is used. The Commissioner is also responsible for enforcing obligations upon data controllers. Owing to the significant number of multinational tech companies based in Ireland, Ireland’s Data Protection Commissioner has responsibility for oversight of a large amount of data and has been involved in some high profile cases. The government is committed to supporting the data Commissioner in their role and, over recent years, has provided a fourfold increase in the funding for the work of the Commission.
C. Human Rights Associated with the Development of New Technologies
(Existing framework/Measures taken ）
As measures that have already been conducted, when consulted about the information on human rights violations, such as defamation and privacy infringement on the Internet, the Government has advised victims on the methods for requesting the disclosure of the sender’s information and the deletion of the information by providers. In case the victims find it difficult to recover from the damage caused by abusive content, efforts are made to remedy the damage by requesting providers to delete such abusive information. With respect to these initiatives, sufficient attention is paid to take into account gender equality perspectives as well as diversity and inclusiveness.
(Future measures planned）
(a) Address online defamation and privacy infringement, including hate speech
Continue efforts such as requesting providers to delete abusive information in case human rights violations, including defamation and privacy infringement on the Internet, are observed. [Ministry of Internal Affairs and Communications, Ministry of Justice]
(…)
(c) Promote discussion on the use of AI from the perspective of protection of privacy
Continue efforts to promote discussion regarding the use of AI and privacy protection at international conferences and other occasions. [Personal Information Protection Commission; Ministry of Economy, Trade and Industry]
Part II: Specific objectives of the National Action Plan 2020-2022
1. The state duty to protect human rights
(…)
1.15. Protection of human rights in business in the context of new information and communication technologies (ICT), including artificial intelligence (AI)
Context
One of the risk sectors recognised in the NAP2 is the new information and communication technologies, including artificial intelligence. This sector is developing very rapidly worldwide in the context of increasing digitalisation.
In his report to the UN General Assembly in 2018, Mr David Kaye, UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, analysed the topic of artificial intelligence (AI) in more detail. Within this framework, each State is obliged to uphold human rights, including the right to freedom of opinion, freedom of expression and access to information, the right to privacy, the obligation of non-discrimination and the right to an effective remedy.
In Europe, the General Data Protection Regulation (GDPR) has been the main legal instrument regulating the collection and use of data since its introduction in 2018. In Luxembourg, the supervisory authority is the Data Protection National Commission (CNPD) [Commission nationale pour la protection des données].
Objectively verifiable indicators
× GDPR
Verification sources
× European legislation and institutions
× CNPD [Commission nationale pour la protection des données] – UEL [Union des Entreprises Luxembourgeoises] / INDR [Institut National pour le Développement durat et la Responsabilité sociale des entreprises]
Expected results
× Regular consultations with the CNPD [Commission nationale pour la protection des données]
× Increased understanding and awareness of the link between human rights and ICT, including AI
Implementation timeline
Duration of NAP 2
Means of implementation
× CNPD [Commission nationale pour la protection des données]
× UEL [Union des Entreprises Luxembourgeoises] / INDR [Institut National pour le Développement durat et la Responsabilité sociale des entreprises]
× Civil Society, including ALNU [Association Luxembourgeoise Pour les Nations Unies]
The 2020-22 NAP states the second edition of the National Action Plan complements the first NAP. Additional information about the first NAP can be found here.
CHAPTER 1: National Action Plan on Business and Human Rights
1.5. COVID-19 and the NAP (page 11)
‘Additionally, the COVID-19 pandemic has had a major impact on the nature of business in terms of the increasing amount of corporate activity moving to the digital realm, and the rapidly increasing role of freelance work and the gig economy. In light of these rapid changes, it is imperative that human rights are given the same level of importance in the digital economy. It is crucial that the rights of workers in the digital economy are respected, and ethical guidelines concerning data protection and privacy are adhered to.’
Pillar I: The State’s duty to respect human rights
5. Planned changes in national legislation:
Addition of general principles in administrative proceedings:
Rules governing the liability of Internet intermediaries for hate speech and violation of freedom of speech [page 26]
The Ministry of Digital Affairs plans to draft a regulation to counteract restrictions on the freedom of speech, on the one hand, and to block illegal content on the Internet, on the other. Legislative work is being carried out that clarifies the procedure for notice and takedown of the illegal content online, as well as strengthens legal safeguards for freedom of speech in the activities of electronic service providers. These efforts address i.a. issues related to hate speech or incitement to violence, as well as the use of unauthorised technical restrictions on freedom of speech in social media.
Pillar III: Access to Remedy
1. Current situation regarding access to legal remedies
Protection under civil law [page 38]
…By applying these civil-law instruments, those affected can seek judicial protection of their personal interests, as well as claims for damages (personal or property).
According to Article 23 of the Civil Code (CC), the personal interests of a human being, in particular their health, freedom, dignity, freedom of conscience, name or pseudonym, image, privacy of correspondence, inviolability of home, and scientific, artistic, inventive, or improvement achievements are protected by civil law, independent of protection under other regulations. Article 24 § 1 and 2 CC stipulates that any person whose personal interests are threatened by another person’s actions may demand that the actions be ceased unless they are not unlawful. In the case of violation, they may also demand that the person committing the violation perform the actions necessary to remove its effects, in particular that the person make a declaration of the appropriate form and substance. Under the terms of the Civil Code, one can also claim monetary recompense or payment of an appropriate amount of money for the social cause indicated (Article 448 CC). If damage has been caused due to a violation of personal interests, the injured party may demand a remedy in accordance with general principles (Article 415 et seq. CC). The prerequisites for protecting personal interests that must be met together are: the existence of a personal interest, the threat or violation of that interest, and the unlawfulness of the threat or the violation. The first two premises must be proven by the plaintiff seeking protection, while the defendant can defend themselves, demonstrating that they did not act unlawfully. The distribution of the burden of proof is therefore favorable to the plaintiff. The legislator introduced the presumption of unlawfulness of the violation of personal interests (Article 24 § 1 CC). However, claims cannot be made if the perpetrator demonstrates that the occurrence of one of the circumstances rules out the unlawfulness of the action, and they thus indicate the circumstances that justified the violation of a particular personal interest. The provisions of Articles 23 and 24 CC suggest that the protection of personal interests is comprehensive. Its exercise may take on a different character and be pursued through various measures, which may be both non-financial and financial in nature. Non-financial protection measures include: a) – claim for cessation; b) – claim for removal of the effects of a violation; c) – assertion lawsuit; Financial protection measures include: d) – claim for redressing non-financial damage; e) – claim for recompense for property damage; f) – claim for restitution of unjust enrichment; g) –claim for non-performance of an agreement; h) – claim for non-performance of an agreement (contractual liability).
2021-2024 NATIONAL ACTION PLAN
14. Office of Competition and Consumer Protection
‘Whistleblowers’ programme
The changes in the functioning of the ‘Whistleblowers’ programme described above were primarily dictated by the necessity to ensure – mentioned above – full anonymity of the Whistleblowers, as well as the need to focus potential Whistleblowers on providing information that is valuable from the point of view of the Office. It was not possible to provide the aforesaid support in transmitting information via e-mail or the hotline. The WhistleB platform guarantees Whistleblowers the highest level of protection and anonymity. If the notifiers themselves do not provide their data – it is impossible to identify them. Moreover, it should be pointed out that personal data provided by Whistleblowers are not made available to external entities. The connection between the Office of Competition and Consumer Protection, the application and the Whistleblower is encrypted and password-protected. Metadata are automatically removed from the files attached. Therefore, the IP of the notifier’s computer cannot be determined. The provider of the above-mentioned tool does not have access to the content placed on the platform. Access to information is two-step, and only a designated group of persons employed in the Office of Competition and Consumer Protection have access passwords. – page 40-41
Revision of 「Procurement Business Act」 and addition of an article promoting corporate social responsibility on January 2016.
* Article 3-2 (Encouraging Social Responsibility)
The administrator of the Public Procurement Service may reflect social and environmental values such as … consumer protection in the procurement process to encourage corporate social responsibility.
Internet freedom and privacy are among the great global issues of the future. It is fundamental for Sweden that the human rights that apply offline also apply online. Sweden has taken initiatives to strengthen the dialogue with business on internet freedom. As a result of a Swedish initiative, the OECD Guidelines for Multinational Enterprises now call on companies to support human rights on the internet. In addition, Sweden was part of the group of countries that tabled resolutions on internet freedom in the UN Human Rights Council in 2012 and 2014. These resolutions were adopted unanimously. The Stockholm Internet Forum organised by Sweden in 2012, 2013 and 2014 has focused entirely on issues of internet freedom.
Continue promoting international human rights dialogue and cooperation (page 9)
‘Taiwan will continue to carry out human rights consultations and dialogue with the European Union. In the area of digital human rights, as talks with the European Union regarding a GDPR adequacy decision for Taiwan move forward, we will move methodically toward the establishment of an agency tasked with responsibility for promoting the protection of personal information.
In the future, Taiwan will continue seeking to strengthen international human rights dialogue and cooperation with more countries.’
The Data Protection Act 1998, which applies to companies and ensures respect for the privacy of individuals.
New actions planned
The Government will do the following to reinforce its implementation of its commitments under Pillar 1 of the UNGPs:
(v) In line with the UK Cyber Exports Strategy, develop guidance to address the risks posed by exports of information and communications technology that are not subject to export control but which might have impacts on human rights including freedom of expression on line.
The UK 2016 Updated NAP
2. The State Duty to Protect Human Rights
The existing UK legal and policy framework
Examples of wide ranging legislation protecting human rights in the business context include… the Data Protection Act 1998 which applies to companies and ensures respect for the privacy of individuals.
Actions taken [page 9]
To give effect to the UN Guiding Principles, the Government has:
(ix) strengthened international rules relating to digital surveillance, including leading work in the Wassenaar Arrangement to adopt new controls on specific technologies of concern. Specifically new controls were agreed on:
equipment and software for creating and delivering “intrusion software” designed to be covertly installed on devices to extract data. “internet surveillance systems” which can monitor and analyse internet traffic and extract information about individuals and their communications.
3. Government expectations on business
Actions taken to support business implementation of the UNGPs [page 15]
To help businesses to fulfil their responsibility to respect human rights the
The expansion of ‘cyber space’ has brought huge economic and social benefits. However, it also poses risks and new opportunities for hackers, criminals and terrorists. To help mitigate these risks, companies have developed security products and services which defend networks from malicious activity. In many countries, such as the UK, these products are used legitimately, including by law enforcement authorities, in accordance with domestic and international law obligations. However, in some countries which do not adhere to their international human rights obligations, there is a risk that the same products are used in ways that could breach state’s legal obligations, e.g. to restrict freedom of expression or to contribute to internal repression.
Normally, exports that could cause harm, such as arms, are covered by the export-licensing regime. However, many cyber capabilities, products and services are not listed. This problem was recognized by the Cyber Growth Partnership a joint body representing industry, academia and government. The FCO worked with techUK, a technology trade association, and the Institute for Human Rights and Business to produce practical guidance for companies on managing human rights risks.
“Assessing Cyber Security Export Risks: Human Rights and National Security” was published in November 2014. It is the first guidance for this sector in the world, and sets out:
the different sorts of potential harm associated with particular cyber capabilities;
a process to help companies assess country specific risks and to evaluate business partners and re-sellers; and potential mitigation options for avoiding or reducing risks.
Promoting Human Rights in the ICT Sector [page 22]: The impact and importance of business conduct in the ICT sector has grown as social, commercial, educational, and recreational interactions increasingly take place online. State, working with other agencies and stakeholders, will develop a regular mechanism to identify, document, and publicise lessons learned and best practices related to corporate actions that promote and protect human rights online. State will also foster continued engagement among relevant stakeholders to support ongoing dialogue and collaboration on respecting human rights within the ICT sector. Implementing department or agency: State
