The role of international human rights law in the protection of online privacy in the age of surveillance

Abstract

Whilst the political dust on mass surveillance is slowly settling down, what has become apparent is the uncertainty regarding the interpretation and application of the right to privacy norms under Article 17 of the International Covenant on Civil and Political Rights 1966 in the context of cyberspace. Despite the world-wide condemnation of these practices by, inter alia, the United Nations and international human rights organisations, little consensus has been reached on how to bring them in line with international human rights law. This paper proposes that the most pragmatic solution is updating Article 17 by replacing General Comment No.16. There are many issues that require attention. The paper focuses on two fundamental aspects of this process, namely the development of more detailed understanding of what is meant by the right to privacy in the 21st century, and the challenge posed by foreign cyber surveillance to the principle of extraterritorial application of human rights treaties. To that end, the paper identifies that the 'effective control' test, developed by international human rights courts and bodies adopted to determine jurisdiction, is unsuitable in the context of state-sponsored cyber surveillance. The paper considers a number of suggestions made by legal scholars, which hinge on the control of communications, rather than the physical control over areas or individuals. Such a 'virtual control' approach seems in line with the jurisprudence of the European Court of Human Rights, according to which extraterritorial obligations may arise when states exercise authority and control over an individual's human rights, despite not having physical control over that individual. The paper argues that the 'virtual control' test, understood as a remote control over the individual's right to privacy of communications, may help to close the normative gap that state intelligence agencies keenly exploit at the moment.

Human Rights in the Digital Era: The Right to Privacy at Stake

“…With the insufficient existing legal framework, it is challenging to achieve a legally binding treaty. 11 Since Snowden's disclosure of mass surveillance in 2013, the United Nations General Assembly and the United Nations Human Rights Council have passed resolutions on privacy protection in the digital age each year. These resolutions have progressively developed international standards on how to ensure the right to privacy on the Internet, including addressing the risks posed by new and emerging technologies.…”

“…8 It is important to that there were four relevant instruments in this regard: the CoE Convention on data protection, the EC Directive on data protection, (both are legally binding instruments). 9 The third one is the OECD Guidelines Governing Protection of Privacy and Transborder Flows on data 10 , and the last instrument is the UN Guidelines Concerning Computerized Personal Data Files 11 It should be noted that the enforcement mechanisms for the ECHR are more powerful than those for the ICCPR. Unlike the ECHR, the ICCPR lacks proper judicial body to enforce its provisions.…”

“…9 Ibid. 10 (Paris: OECD, 1980) adopted on 23.9.1980 11 (Doc E/CN. 4/1990/72, 20.2.1990/, adopted by the UN General Assembly on 4.12.1990.…”

Human Rights Obligations of the Territorial State in the Cyberspace of Areas Outside Its Effective Control

“…Feasibility depends, among others, 'on the technical wherewithal of the state concerned, the intellectual and financial resources at its disposal, the state's institutional capacity to take measures, and the extent of its control over cyber infrastructure' located in the government-controlled territory. 255 This capacity is to a large extent technical, often referred to as 'virtual power' 256 or 'virtual control', understood as the 'ability to intercept, store, analyse and use communications'. 257 Since governments might have very different relationships with the internet and telecommunications companies that could facilitate surveillance, their capacity to access directly the undersea cables and other carriers of internet and telephonic communications might be different.…”