UN Human Rights Report and the Turning Tide Against Mass Spying

The UN High Commissioner on Human Rights has released an excellent report today on the right to privacy in the digital age, blasting the digital mass surveillance that has been taking place, unchecked, by the U.S., the U.K, and other world governments. The report is issued in response to a resolution passed with unanimous approval by the United Nations General Assembly in November 2013. That resolution was introduced by Brazil and Germany and sponsored by more than 50 member states.

This report turns the tide in the privacy debate at the United Nations and opens the door for more substantive scrutiny of states’ surveillance practices and their compliance with international human rights law. The report elaborates on issues EFF has long championed, and which are deeply integrated into our 13 Principles and its legal background paper, which have been signed by more than 400 organizations and 350,000 individuals.

We’ve pulled out some highlights from today’s publication that merit further analysis, but the main point is this: With respect to privacy in the digital age, an interference with an individual’s right to privacy is only permissible under international human rights law if its necessary and proportionate.

Forget The “Haystack”

The report issues a powerful condemnation of the “collect-it-all” justification that an infinitely large “haystack” of personal data must be accumulated in order to find the needles. The report points out that few "needles" that have been uncovered, and that in any event:

Mass or “bulk” surveillance programmes may thus be deemed to be arbitrary, even if they serve a legitimate aim and have been adopted on the basis of an accessible legal regime. In other words, it will not be enough that the measures are targeted to find certain needles in a haystack; the proper measure is the impact of the measures on the haystack, relative to the harm threatened; namely, whether the measure is necessary and proportionate.

The second part of that passage, emphasis added, is critical: it gives guidance that the proper measure of a mass surveillance program is not its effectiveness in a vacuum, but whether the surveillance is both necessary and proportionate.

Metadata Matters

EFF has long called for moving beyond the fallacy that information about communications is somehow inherently less privacy-sensitive than the communications themselves. Information about communications, also called metadata or non-content, can include the location of your cell phone, clickstream data, and search logs, and its collection can be just as invasive as reading your email or listening to your phone calls—and sometimes more so. What is important is not the kind of data collected, but the effect on the privacy of the individual.

The report agrees, debunking the argument that “interception or collection of data about a communication, as opposed to the content of the communication, does not on its own constitute an interference with privacy.” It argues, “From the perspective of the right to privacy, this distinction is not persuasive" The aggregation of information commonly referred to as 'metadata' may give an insight into an individual’s behaviour, social relationships, private preferences and identity that go beyond even that conveyed by accessing the content of a private communication.”

Monitoring Equals Surveillance

Much of the expansive state surveillance revealed in the past year depends on confusion over whether actual "surveillance" has occurred and thus whether human rights obligations apply. Some suggest that if information is merely collected and kept but not looked at by humans, no privacy invasion has occurred. Others argue that computers analyzing all communications in real-time for key words and other selectors is not "surveillance" for purposes of triggering legal protections again, unless the analysis is by human eye. These interpretations are used to give a pass to the mass collection and monitoring of communications, enabling governments to engage in broad dragnet collection where the law only supports narrowly targeted investigation.

The report cited the European Court of Justice on data retention to dispel those interpretations. The report makes clear that:

“any capture of communications data is potentially an interference with privacy and, further, that the collection and retention of communications data amounts to an interference with privacy whether or not those data are subsequently consulted or used. Even the mere possibility of communications