Deep Dive: Updates to the Necessary and Proportionate Principles

July 10 marks one year since EFF and a coalition of hundreds of experts and human rights activists put the finishing touches on the Necessary and Proportionate Principles.

These 13 Principles articulate how international human rights law should be applied to government surveillance. The Principles have since received strong support across the globe, fueled in part by the popular outrage over spying by the NSA, GCHQ and other intelligence agencies highlighted in documents leaked by whistleblower Edward Snowden. National and local activists from Mexico to South Korea to Canada to Brazil have used the Principles to push for stronger protections against governmental digital surveillance. We’ve seen them used in litigation, legislation, administrative work, advocacy campaigns and more, and debated in both regional and international policy venues.   

Today, we are publishing an updated version of the Necessary and Proportionate Principles, incorporating the terrific feedback we have received over the past year. The overriding intention of the changes was to clarify the language to better capture the original intent and, in some places, simplify the language and the structure, remove possible ambiguities, clean up grammar, and reduce redundancy. We have also made one substantive change to the "Notification" section.

The core drafting group for the  project consisted of the Electronic Frontier Foundation, Privacy International, Access, Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic, and the Center for Internet and Society-India, in consultation with Article 19, Open Net Korea, the Association for Progressive Communications and other organizations around the world.

Below we summarize the changes that merit attention: First paragraph and throughout: We added “activities, powers, or authorities” to "laws and regulations" to be sure to capture all acts done by governments. This should leave no doubt that the Principles reach activities such as NSA surveillance conducted under Executive Order 12333 First paragraph: We  added the phrase "clarify” to describe the Principles' intent to reinforce that these principles are not advocating for a change in international human rights law and standards. We argue instead for their proper application given the digital context. The word “clarify” is a common construction to denote that no new law is being contemplated. We also added the formulation “human rights law and standards” to account for proper grammar and syntax. Preamble and throughout: We added "and a number of other human rights" here and similarly elsewhere to be clear that this is not only about the right to privacy but also about fundamental freedoms such as the freedoms of association and expression. Also this phrase signals that the Principles are not about all human rights: since, for example, the right to life doesn’t relate to the Principles.

Scope of application: We added this subsection for clarity and added this sentence to explain: "The Principles and the Preamble are holistic and self-referential – each principle and the preamble should be read and interpreted as one part of a larger framework that, taken together, accomplish a singular goal: ensuring that policies and practices related to Communications Surveillance adhere to international human rights obligations and adequately protect individual human rights such as privacy and freedom of expression." Scope of application: We felt it was important to point out that national security and intelligence fall within the ambit of the Principles, as well as all other governmental functions:  "...including, enforcing law, protecting national security, gathering intelligence, or another governmental function." Scope of application: We sought to clarify the role of privacy sector entities. “Business enterprises bear responsibility for respecting individual privacy and other human rights, particularly given the key role they play in designing, developing, and disseminating technologies; enabling and providing communications; and in facilitating certain State surveillance activities.” Protected information definition:  We moved the definition from the bottom of the paragraph to the top but did not change the content. First paragraph of preamble:  For clarity we added that communications surveillance “interferes” with the right to privacy “among a number of other human rights.” As a result, it “may only” be justified when it is prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.