HUMAN RIGHTS IN CYBERSPACE

State Pronouncements on IHRL in Cyberspace UN GGE 2013 report “State efforts to address the security of ICTs must go hand-in-hand with respect for human rights and fundamental freedoms set forth in the Universal Declaration of Human Rights and other international instruments.” UN GGE 2015 report “[T]he Group identified as of central importance the commitments of States to ... respect for human rights and fundamental freedoms; ...” “States must comply with their obligations under international law to respect and protect human rights and fundamental freedoms” Human Rights Council, 2016 “[T]he same rights that people have offline must also be protected online”

Key Sources of IHRL Relevant for Cyber Global treaties International Covenant on Civil and Political Rights International Covenant on Economic, Social and Cultural Rights Regional treaties American Convention on Human Rights European Convention for the Protection of Human Rights and Fundamental Freedoms Charter of Fundamental Rights of the European Union African Charter on Human and Peoples’ Rights Customary IHRL

Applicability of IHRL Treaties: Bind only Parties Customary: Binds all States Issues Ascertaining customary nature Which sources reflect customary law? E.g., ICCPR, ICESR, UDHR? Extraterritorial applicability?

Types of IHRL obligations Respect State must not violate Negative obligation Example: State must not monitor the communications of an ethnic minority for the purpose of persecuting them Example: State must not direct a hosting service provider to stop offering services to an individual who manages a website that reports on the government’s corruption

Types of IHRL obligations Protect State must take action to protect individuals’ human rights from abuse by third parties Same as “ensure respect” Positive obligation Applies to rights that are exercised/enjoyed in cyberspace Example: State must protect an individual who has been threatened by another individual with physical violence for having expressed protected views online Applies to rights that are abused offline, but facilitated online Example: State must take action to stop the abuse of children for the purposes of producing online pornographic material

Types of IHRL obligations Fulfil State must take measures to ensure individuals can realise their human rights Customary status unclear Example: Convention on the Rights of Persons with Disabilities, Art. 4(1)(g): “promote the availability and use of new technologies, including information and communications technologies ... suitable for persons with disabilities, giving priority to technologies at an affordable cost”

Assessing Whether Cyber Activities Violate IHRL Does State owe individual a human rights law obligation? Where is the individual located? Does person’s cyber-related activity fall within scope of particular human right? E.g., does data about an individual’s location fall within the scope of the right to privacy?

Assessing Whether Cyber Activities Violate IHRL Has State engaged in act that implicates the human right? E.g., is the State processing personal data? Does a lawful limitation or derogation apply? E.g., is personal data processed for maintaining national security?

Applicability of IHRL to Cyber Activities Within State’s territory Extraterritorially: “Power or effective control” Over territory (spacial model) Example: Occupied territory Over individual (personal model) Example: Detained person States that reject extraterritorial application?

Cyber-Specific Scenarios Security services capture a person abroad and read her emails on her phone versus Security services hack into the person’s phone remotely and read her emails A State captures the communications of an individual who lives in that State while the individual is at home The State captures the individual’s communications while he is on holiday abroad

Extraterritoriality in Cyberspace Cyber challenges traditional approach to extraterritoriality Is approach sustainable? Example: Tallinn Manual 2.0 “a few Experts’” approach: if the exercise or enjoyment of a right by an individual is within State’s power or effective control, State owes IHRL obligation Majority view: Not lex lata

Cyber-Relevant Human Rights Examples: Freedom of expression Privacy Freedom of opinion Due process Association and peaceful assembly Protection from defamation

Freedom of Cyber Expression Recognised in various treaties Separate from the freedom of opinion ICCPR definition: “Everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.” ICCPR, Art. 19(2) ACHR, Art. 13 ECHR, Art. 10 ACHPR, Art. 9

Freedom of Cyber Expression Examples: Websites Blogs Online forums Social media posts Skype, Viber, Whatsapp calls Text messages Etc.

Privacy in Cyberspace Recognised in various treaties ICCPR definition: “No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.” ICCPR, Art. 17(1) ACHR, Art. 11 ECHR, Art. 8

Privacy in Cyberspace Scope Confidentiality of communications Personal data Confidentiality: communications must be “delivered to the addressee without being opened or otherwise read” General Comment No. 16, para. 8 Is email metadata part of a communication? Personal data: no generally accepted definition Health-related data clearly qualifies

Privacy In Cyberspace Machine inspection based on algorithms of communications / personal data without human access? Mere collection of communications / personal data for potential future examination? Is the enjoyment of the right dependent on a reasonable expectation of privacy?

Cyber-Specific Human Rights Human right to anonymity? Human right to access the internet? Human right to be forgotten?

Limitations No limitations on absolute rights Examples: freedom from torture, freedom from slavery, right to hold an opinion Limitations are distinct from derogation Requirements for limitations: Legitimate purpose Necessary Proportionate Authorised by law Non-discriminatory Requirements apply to both the obligation to respect and to protect

Requirements for Limitations Legitimate purpose Protection of rights and reputations of others National security Public order Public health or morals Example: monitoring certain online communications in order to counter terrorism Necessary Example: Blocking / sinkholing online communications that incite to genocide

Requirements for Limitations Proportionate “[R]estrictive measures ... the least intrusive instrument amongst those which might achieve their protective function; they must be proportionate to the interest to be protected...” – General Comment No. 27, para. 14. Example: Is it proportionate to engage in mass collection of online communications?

Requirements for Limitations Authorised by law Precise and clear to put affected individuals on notice Does the authorisation need to be set forth in domestic law or does international law suffice? Example: A law that sets forth the legal basis for online surveillance must outline the conditions under which the State may engage in such surveillance

Requirements for Limitations Non-discriminatory Distinctions, exclusions, restrictions, or preferences for the purpose or effect of nullifying or impairing the recognition, enjoyment, or exercise, on an equal footing, of rights and freedoms. Can be based on, e.g.: Race Colour Sex Language Religion Political or other opinion National or social origin Property Birth Example: Disrupting internet services in a region populated by a particular ethnic group

QUESTIONS?