What does mass surveillance do to Human Rights?

Elspeth Guild

There is on-going interest and surprise at the extent of mass surveillance which various governments, the US in the form of the NSA, the UK in the form of GCHQ and others, have been carrying out.

The confirmations by both the US and UK governments that everything has been carried out in accordance with their national law has only resulted in profound questions regarding the nature of the laws which permit these activities and whether they actually conform to internationally recognised standards of certainty and accountability which any government act must have in order to qualify as a law.

The Snowden revelations regarding mass surveillance have not only had very substantial political repercussions over 2013 and into 2014, but have also raised profound legal questions as a result. So many of these are issues and questions of great importance for democracies. A former member of the European Parliament commented at a conference in Brussels on April 3, 2014 that every candidate in the May 2014 European Parliament elections is conscious of the chilling effect that mass surveillance has had on them personally.

The fact that every email they have sent, every photo they have forwarded by email, is available to the intelligence service of a foreign country has a chilling effect on freedom of expression. Who can be sure that something which they casually put into a personal email could not be used to contradict one of their election promises, or some photo that they sent could not be used to compromise their probity as representatives? We cannot afford to underestimate the impact of mass surveillance on the correct operation of democracy.

Two interconnected but separate human rights issues arise as regards mass surveillance. The first, which is the most fundamental but the most frequently ignored, is the right of every person to respect for his or her private and family life. The second, which is generally the subject of more substantial political and media noise is the duty of states to protect personal data. Those political actors who have an interest in promoting the legality of mass surveillance usually put forward two arguments. The first is that national and international security is always an exception to both the duty of every state to respect people’s privacy and the duty to protect personal data. This is the most trenchantly defended of arguments as when this one falls away, those actors seeking to justify mass surveillance find themselves on very weak legal ground indeed. The second is that states’ obligations to protect personal data are subject to very different rules and requirements according to the political preferences of different states. Thus as there is no harmonization of the specific rules as to what is acceptable data protection internationally, states which are exercising their national and international security prerogatives only need to fulfil their own national data protection rules.

Before engaging directly with the arguments and examining how political actors dissatisfied with them have responded, let us very briefly clarify the relationship of the right to respect for privacy with that of data protection. The right to respect for a person’s privacy is an overarching international human right. It is found in Article 12 of the UN’s Universal Declaration of Human Rights (1948) and its legal form is found in the UN’s International Covenant on Civil and Political Rights (1966). Any interference with the privacy of a person must first and foremost be subject to the consent of that person. The right to consent or refuse use of personal data belongs to the individual not the state.

Where the state seeks to interfere with that right and to collect and use personal data which constitutes an intrusion into the privacy of the person concerned, such an interference must be justified by the state authorities. First it must be permitted by law and that law must be sufficient clear and public that everyone can know what it is and how to adjust their behaviour accordingly. Any exception permitted by law to a human right must be interpreted narrowly. It must have a legitimate objective and be necessary to achieve that objective only. There must be no alternative, which would be less intrusive into the life of the person which could instead be used. There must be judicial oversight of any state interference and a person affected by an interference must have access to justice to challenge that interference.

Mass surveillance by its very nature is not targeted at any person specifically, thus the possibility to justify the interference with the privacy of any person individually is an exceedingly difficult task. Where such mass, weakly targeted surveillance techniques have been used in Europe, the Human Rights Court has found them inconsistent with the right to respect for privacy. Mass surveillance is by definition arbitrary.

States’ duty to protect data arises from the person’s right to respect for his or her privacy. Where states interfere with people’s privacy, they must fulfil strict rules to justify that interference. This gives rise to the obligation of data protection. The duty to protect personal data arises when personal data is being used by state or private actors and is designed to ensure that the use is consistent with the individual’s right to respect for his or her privacy. It is for this reason that there are many different types of regime of data protection depending on the country one examines. How states go about protecting data is for them to determine: the key is that personal data must be protected because the individual has a right to respect for his or her privacy. The content of the human right to respect for privacy of the person is not variable.

The political struggle

Moving then from the state of human rights to the political struggle regarding mass surveillance, clearly the US authorities are faced with a dilemma in international human rights law, an area of which they have always been rather wary. The 1950s approach to international human rights law was to claim that the instruments do no more than set out 'principles' and are not ‘real’ law in any significant way and are certainly not available for people to rely upon. This political position has been undermined by the development of very precise international obligations, the establishment of Treaty Bodies with jurisdiction to receive and adjudicate on complaints by individuals regarding alleged breaches of their international human rights and the embrace of international human rights law by national courts. The 'principles' approach to international human rights law is no longer tenable. It is a figleaf deployed occasionally by states seeking to act arbitrarily.

As the Snowden revelations rose up the scale of international issues, a number of states, primarily led by the Brazilian and German authorities began to address the issue of how to deal with US mass surveillance and the interception of communciations. There was much discussion about bilateral negotiations and unilateral action (for instance, building new cables which avoid US territory) etc. However, it rapidly became evident that bilateral and unilateral approaches were not going to be satisfactory. In Europe, the fact that the UK authorities were carrying out mass surveillance for their US counterparts and others (the so-called Five Eyes) yet were not only members of the Council of Europe but also of the European Union, was only one example of the problem of unilateral or bilateral approaches. Clearly, only multilateral efforts were likely to bring results, where the weight of the USA and some of its collaborators could be counterbalanced by a loose alliance of other states. As soon as the issue is defined in this way, the obvious venue to commence a response is at the UN General Assembly and the territory on which to prepare the response is international human rights obligations – the prohibition of arbitrary interference with people's privacy.

This is the road which the Brazilian and German authorities have followed. By August 2013, moves were afoot for a resolution of the General Assembly. Five non-governmental organizations were closely linked with the efforts, Access, Amnesty International, Electronic Frontier Foundation, Human Rights Watch and Privacy International also applied pressure for a strongly worded resolution. The Brazilian and German authorities were by no means alone in their efforts to achieve agreement over a UN General Assembly Resolution. Many smaller states, most notably Austria, Hungary, Liechtenstein, Norway and Switzerland but also others, very strongly supported the work from the beginning, even seconding staff to assist with the workload. The matter was assigned to the General Assembly’s Third Committee and it is there that the tense negotiations on the wording of the Resolution took place. A text was adopted on 26 November in the Third Committee and on 18 December 2013 it was adopted without a vote in the General Assembly of the UN.

The Resolution is based on the right to respect for privacy in the Universal Declaration and the ICCPR with specific reference to the prohibition on arbitrary interference. It ties the right to privacy to the right to freedom of expression – if people are subject to mass surveillance they are no longer able to express themselves freely. The preamble to the Resolution insists on the negative impact that surveillance and the interception of communications, including extraterritorial surveillance and interception, on a mass scale, has on the exercise and enjoyment of human rights. The Resolution calls upon states to respect the right to privacy and prevent violations; to review their procedures, practices and legislation regarding the surveillance of communications, their interception and collection of personal data, including mass surveillance, interception and collection with a view to upholding the right to privacy and ensuring the full and effective implementation of all their obligations under international human rights law and to establish or maintain independent, effective domestic oversight mechanisms capable of ensuring the transparency and accountability of a state’s actions.

Most importantly, the Resolution directs the UN High Commissioner for Human Rights to present a report on the protection and promotion of the right to privacy in the context of domestic and extraterritorial surveillance and/or interception of digital communications and collection of personal data, including on a mass scale and to report to the Human Rights Council in its twenty-seventh Session, in September 2014. The current High Commissioner, Navi Pillay, a South African jurist with a very impressive human rights career, was appointed to the post in 2008. She is no stranger to the problem of the right to privacy and mass surveillance, having already spoken on the subject at the Council in September.

The UN Human Rights Council (composed of 47 states elected by the General Assembly) has also already engaged with the issue. The matter was on the agenda of the twenty-fourth Session of the Council held in September 2013. The High Commissioner noted, at that meeting, that the threat which mass surveillance poses to human rights is among the most pressing global human rights situations today. Many state representatives present at that session had regard to the report of UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue on freedom of expression in the internet age (16 May 2011) which had already outlined many dangers of state surveillance and its impact on free speech.

What is perhaps surprising is that the September 2013 meeting of the Human Rights Council received so little press coverage. The meeting was well attended by state representatives and the discussions were incendiary in the condemnation of mass surveillance and interception of communications. Many state representatives attended the meeting with statements of condemnation of mass surveillance and interception of communications already prepared and agreed with neighbouring states on whose behalf they were mandated to speak.

While one might well expect the German representative to present a text on behalf of Austria, Hungary, Liechtenstein, Norway, and Switzerland, it is perhaps less obvious that Pakistan, speaking on behalf of Cuba, Venezuela, Zimbabwe, Uganda, Ecuador, Russia, Indonesia, Bolivia, Iran, and China, would also present an agreed text condemning the practices. While the counter move particularly in respect of this second set of countries is usually to attack them on the basis of their internal practices of surveillance and suggest, if not accuse, them of hypocrisy, the fact of the intervention nonetheless must be noted and the possibility that a group of states with serious disagreements among themselves would choose common ground on this subject.

The next step will be for the High Commissioner for Human Rights to prepare and present her report to the Human Rights Council in September 2014. Undoubtedly, her team will be presented with substantial amounts of information, evidence and legal argument to assist in the writing of the report.

In the meantime, our data continues to be hoovered up in industrial quantities. Private sector actors tell us that it is now cheaper to store data than to delete it – a potentially game-changing factor in the economics of mass surveillance. The compatibility of mass surveillance with human rights is already a matter of urgent concern. It is in all our interests that the UN continues its review of the compatibility of these practices with internationally agreed human rights standards.