Expression and Privacy Principles - Defending freedom of ... · Section 1: General principles ... ,...

TheGlobalPrinciplesonProtectionofFreedomofExpressionandPrivacy


ARTICLE19–FreeWordCentre,60FarringdonRd,LondonEC1R3GA–www.article19.org–+442073242500Page2of30

2017



TableofcontentsIntroduction...................................................................................................................................4Preamble........................................................................................................................................6Definitionsofkeyterms.................................................................................................................8Section1:Generalprinciples........................................................................................................11Principle1:Legalframeworkfortheprotectionofrights.................................................................11Principle2:Limitedscopeofpermissiblerestrictions.......................................................................12Principle3:Legitimatepurposeofprivacycausesofaction..............................................................12

Section2:Freedomofexpressionandtherighttoprivacyasmutuallyreinforcingrights.............14Principle4:Communicationssurveillance.........................................................................................14Principle5:Mandatorydataretention..............................................................................................14Principle6:Anonymity,mandatoryuserregistrationandreal-namerequirements........................14Principle7:Encryption.......................................................................................................................15Principle8:Datadisclosurebycompanies........................................................................................16Principle9:Protectionofsources......................................................................................................16Principle10:Searchandseizure........................................................................................................17Principle11:Trans-borderdataflows...............................................................................................17

Section3:Reconcilingtherighttofreedomofexpressionandtherighttoprivacy.......................18Principle12:Publicationofpersonalinformation.............................................................................18Principle13:Publicfigures.................................................................................................................19Principle14:Openjustice..................................................................................................................20

Section4:Reconcilingfreedomofexpression,dataprotectionandprivacy..................................21Principle15:Protectionofpubliclyavailableinformation.................................................................21Principle16:Requeststodeletecontentauthoredandoriginallypublishedbyoneself..................21Principle17:Requeststodeletecontentpublishedbythirdparties................................................22Principle18:Requeststobede-listedfromsearchresults...............................................................22Principle19:Dataprotectionexemptions.........................................................................................24

Section5:Reconcilingtherighttoinformation,dataprotectionandtherighttoprivacy..............25Principle20:Generalprinciplesontherighttoinformation.............................................................25Principle21:Maximumdisclosureofpersonalinformationaboutpublicofficials...........................25Principle22:Officialrecords..............................................................................................................25

Section6:Remediesandsanctions...............................................................................................27Principle23:Generalprinciples.........................................................................................................27Principle24:Criminalpenalties.........................................................................................................27Principle25:Pecuniaryawards..........................................................................................................27Principle26:Priorrestraint,superinjunctions,mandatorypre-moderationandnoticepriortopublication.........................................................................................................................................28Principle27:Interiminjunctions........................................................................................................28Principle28:Blockinginjunctions......................................................................................................29Principle29:Intermediaryliabilityandcontentremoval..................................................................29Principle30:BlanketprohibitionsonInternetaccessongroundsofprivacyprotection..................29

Background..................................................................................................................................30



IntroductionFreedomofexpressionandprivacyaremutuallyreinforcingrights–allthemoresointhedigitalage.Bothareessentialfoundationsforopenanddemocraticsocieties,andamongthebasicconditionsforits progress, and for each individual’s self-fulfilment. For democracy, accountability and goodgovernance to thrive, freedom of expression and opinion must be respected and protected. Thesameistrueoftherighttoprivacy,whichalsoactsasapowerfulbulwarkagainststateandcorporatepowerinthemodernage.Whilefreedomofexpressionisfundamentaltodiverseculturalexpression,creativityandinnovationas well as the development of one’s personality through self-expression, the right to privacy isessential toensuring individuals’ autonomy, facilitating thedevelopmentof their senseof self andenablingthemtoforgerelationshipswithothers.Privacy is also a pre-requisite to the meaningful exercise of freedom of expression, particularlyonline. Without privacy, individuals lack the space to think and speak without intrusion and todevelop their own voice.Without freedom of expression, individualswould be unable to developtheirsenseofself.Attheheartoftheprotectionoftheserightsliestherespectfor,andprotectionof,humandignityandindividuals’abilitytolivefreelyandengagewithoneanother.Atthesametime,oneperson’srighttofreedomofexpressionmayimpingeonsomeoneelse’srighttoprivacyandviceversa.Thistensionisexacerbatedbydigitaltechnologies.Whilsttheyhavebeencentral to the facilitationof theexerciseof freedomofexpressionand the sharingof information,digitaltechnologieshavealsogreatlyincreasedtheopportunityforviolationsoftherighttoprivacyonascalenotpreviouslyimaginable.Inparticular,digitaltechnologiespresentseriouschallengestothe enforcement of the right to privacy and related rights because personal information can becollectedandmadeavailableacrossbordersonanunprecedentedscaleandatminimalcostforbothcompaniesandstates.Atthesametime,theapplicationofdataprotectionlawsandothermeasuresto protect the right to privacy can have a disproportionate impact on the legitimate exercise offreedomofexpression.ThesePrinciplesweredevelopedinordertoprovideasystematicanalyticalframeworkforassessingthewaysinwhichtherightstofreedomofexpressionandprivacyaremutuallyreinforcing,andfordetermining thepermissible limitswhich canbeplacedon these rightswhere theyare in conflict,bothonandoffline.Inparticular,thePrinciplesseektoensurethatbothofthesefundamentalrightsare effectively respected and protected in the digital age. Aswe demonstrate in these Principles,international law provides a framework to resolve tensions andmaximise the enjoyment of bothrights.ThePrincipleswesetouthereofferaprogressiveinterpretationofinternationallawandbestpractice in individualstates,as reflected, interalia, innational lawsand the judgmentsofnationalcourts.Theyshouldbeinterpretedinthemostfavourablewayforhumanrights.These Principles should neither be taken as foreclosing nor as approving restrictions designed toprotectotherinterests–includingtheprotectionofreputationbydefamationlaws–whichdeserveseparatetreatmentandareaddressedintheirentiretyinaseparatesetofprinciples.It isour intentionandhopethatthesePrincipleswillbeusedbyindividuals,activists,campaigners,legal practitioners, intermediaries, judges, elected representatives, parliamentarians, and public



officials around the world as they seek to respect, protect, and fulfil the rights to freedom ofexpressionandprivacy.



PreambleWe–individualsandorganisations–whoendorseandagreetothesePrinciplesAffirming that the rights to freedom of expression and to privacy are among the essentialfoundationsofanopenanddemocraticsociety,andamongthebasicconditionsforitsprogressandfortheenjoymentofotherhumanrightsandfundamentalfreedoms;Consideringthattheprotectionoftherighttoprivacyisanecessarypre-conditionforthemeaningfulexerciseoftherighttofreedomofexpressionandhumandevelopment;Noting that individualsaremuchmore likely toexpresscontroversialviewpointsorsharesensitiveinformation in the knowledge that their anonymity and the privacy and security of theircommunications are protected, including through the use of anonymity, encryption, and othersecuritytools;Fully aware that the right to freedom of expression is also a necessary component of thedevelopmentofindividuals’personalityandidentity;Considering that the rights to freedom of expression and privacy are therefore often mutuallyreinforcingrights;Takingnote,however,thattherighttofreedomofexpressionandtherighttoprivacymayincertaincircumstancescomeintoconflict,includingwhereprivacyclaimsmaybeusedwithoutjustificationtopreventthedisseminationofinformationaboutindividualsinordertorestrictreportingonmattersofpublicinterestandtoavoidpublicscrutiny,ordeliberatelymisleadothers;Recognisingatthesametimethatthedisseminationofprivateinformationwithoutjustificationmayseriouslyinfringetherighttoprivacy,particularlythatofpersonsinsituationsofvulnerability;Desiring to promote a clear framework for the protection and promotion of both the rights tofreedomofexpressionandprivacywheretheyareinconflict,especiallyonline;Taking into account the relevant provisions of the Universal Declaration of Human Rights, theInternational Covenant on Civil and Political Rights, the African Charter on Human and Peoples’Rights,theAmericanConventiononHumanRights,theEuropeanConventiononHumanRightsandtheEUCharterofFundamentalRightsandFreedoms;Having regard to theUNGuidingPrinciplesonBusinessandHumanRights (RuggiePrinciples), theOECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, theInternational Principles on the Application of Human Rights to Communications Surveillance (TheNecessaryandProportionatePrinciples),theJohannesburgPrinciplesonNationalSecurity,FreedomofExpressionandAccesstoInformation,theGlobalPrinciplesonNationalSecurityandtheRighttoInformation (Tshwane Principles), the Revised Defining Defamation: Principles on the Freedom ofExpressionandtheProtectionofReputation,theManilaPrinciplesonIntermediaryLiabilityandtheJoint Declaration on Freedom of Expression and the Internet of the UN Special Rapporteur onFreedom of Opinion and Expression, OSCE Representative on Freedom of theMedia, OAS Special



RapporteuronFreedomofExpressionandACHPRSpecialRapporteuronFreedomofExpressionandAccesstoInformationon1June2011;Noting that nothing in these Principles should be interpreted as setting a lower threshold for theprotection of the rights to freedom of expression and privacy than that provided by relevantinternationalandregionalinstruments;Bearinginmindthatthedisseminationof,andaccessto,informationisabasicrequirementtofosteraccountabilityandasocietyfreeofcorruption,topromoteaccesstoknowledge,developmentandculture,whichisthecommonheritageofallhumankind,andwhichshouldbecherished,upheld,andmadeaccessibleforthebenefitofall;RecognisingthattheInternetisaglobalresourcewhichshouldbemanagedinthepublicinterestandthat digital technologies have greatly enhanced freedom of expression and access to informationwhilst,atthesametime,posinggreatchallengestotheprotectionofindividuals’righttoprivacyandtotheprotectionofpersonaldata;Concerned about the serious risks big data poses to the right to privacy and to the protection ofpersonaldata,whilenotingthepotentialbenefitsofopeninglargedatasetsforsocietyasawhole;Considering that data protection is essential to ensure that individuals are involved in decisionsconcerning their personal data and to ensure that states and companies that gather and recordpersonal data are transparent about the data they hold; follow fair and lawful processes on thecollection,use, retentionandmaintenanceof securityof thatdata; andensure thatpersonaldatacollectedforonepurposeisnotusedforanother;Aware that data protection legislation can be misused or abused to prevent, end or restrict thelegitimate public dissemination of accurate personal information in order to enable individuals tocontroltheirreputationattheexpenseoffreedomof information,therighttotruthandthewiderpublicinterest;Call on all appropriatebodies at international, regional, national and local levels andonprivateactors,toendorse,promote,respect,andapplythesePrinciplesintheirpoliciesandpractices.Wealso recommend that they give effect to these Principles and engage in their dissemination,acceptance,andimplementationatalllevels.



DefinitionsofkeytermsForthepurposesofthesePrinciples,a) The term confidential informationmeans any information towhich a “dutyof confidence”

applies.Adutyofconfidenceiscreatedwhen:i. Privateinformationhasbeenpassedordisclosedinsuchawaythatthepersonreceiving

the information knew, or ought to have known, that the information was beingimpartedonthebasisofconfidentiality;or

ii. Whenprivateinformationhasbeendisclosedincircumstanceswhereitisreasonableto

expectthattheinformationwillbeheldinconfidence.

Confidential informationmustnotbeusedordisclosedwithout theexplicit consentof theindividualconcerned,absentaspecificlegalbasis,orabsentarobustpublicinterestorlegaljustificationtodoso;

b) Thetermdatacontrollermeansthenaturalorlegalpersonwhich,aloneorjointlywithother

persons, determines the purposes forwhich, and themanner inwhich, any personal dataare,oraretobe,processed;

c) Thetermdataprotectionrightsreferstotherangeofrightsthat individuals(datasubjects)

possessunderdataprotectionlaw.Dataprotectrightsincludebutarenotlimitedtothe:

i. Right to ensure that data is stored and processed lawfully (on the basis of consent orsomeotherlawfulbasislaiddownbylaw),fairlyandsecurely;

ii. Righttoknowwhatpersonaldataisheldaboutthembycontrollers(rightofaccess)andforwhatpurpose;

iii. Righttoseektocorrectthatdatawhenitisinaccurate(rightofrectification);

iv. Right todemand thatdatabedeletedwhen it isno longernecessary for thepermittedpurpose, when it is irrelevant or out-of-date, when consent has been withdrawn andthere isnoother lawfulbasis,whenthedatahasbeenunlawfullyprocessed,orwhenithasbeenmadepublicwithoutjustification(righttoerasure);

v. Righttoreceiveone’spersonaldatafromadatacontrollerforthepurposeofchanginga

service(dataportability);and

vi. Right to object to the processing of data for particular purposes, including for directmarketingandprofiling,wherecertainconditionsapply(righttoobject).



d) The term informed consent in the context of data protectionmeans an individual’s freelygiven agreement (not obtained under duress, coercion, or by fraud), based on adequateknowledgeandunderstandingofinformationrelevanttotheprocessingofhis/herpersonaldata. The individual giving consent must be informed about the purpose of the datacollection,processingoruseofthedata,andtheconsequencesofarefusaltogiveconsentifnecessary or if the individual so requests. The consent must be referenced to a clearlydetermined processing; to the extent sensitive personal data are concerned the consentobtainedmustreferexplicitlytosuchsensitivepersonaldata;

e) The term journalism refers to the function of regularly or professionally engaging in thecollection and dissemination of information to the public via any means of masscommunication. It involves but is not limited to the collection (research, interviews orfreedom of information requests) and production (including writing, data analysis, andverifying material) of information. It can also include editorial, publication or broadcastactivities, and management of standards (including staff training, management, andsupervision);

f) The term personal data means any information relating to an identified or identifiable

natural person; an identifiable natural person is one who can be identified directly orindirectly,inparticularbyreferencetoanidentifierortooneormorefactorsspecifictohisorherphysical,physiological,mental,economic,cultural,orsocialidentity;

g) Thetermprincipleofmaximumdisclosurereferstoapresumptionthatall informationheld

bypublicbodiesshouldbesubjecttodisclosureandthatthispresumptionmaybeovercomeonlyinverylimitedcircumstances;

h) Thetermpublicinterestencompassesmattersinwhichthepublichasaninterestorconcern

ofbeing informed.This includes,but isbynomeans limited to, informationaboutmattersthat affect the functioning of the state, public officials and public figures, politics, publichealth and safety, law enforcement and the administration of justice, the protection ofhumanrights,consumerandsocialinterests,theenvironment,economicissues,theexerciseof power, art and culture, or matters that affect general interests or entail majorconsequences;

i) Thetermpublicfiguremeansanindividualengagedinpubliclife.Itincludesleadersofstates

andelectedrepresentatives,publicofficials,business leaders,people inthepubliceyewhohaveaplatformasaresult(including“celebrities”)orindividualsengagedinapublicinterestactivityorperformingapublicfunction;

j) The term public authority means any natural or legal person exercising administrative

authority, or holding public responsibilities or functions, or providing public services, oroperatingwithsubstantialpublicfundsforpublicmatters;

k) Theterm request tobede-listedmeansaremedythatenables individuals to request tobede-listed from search results produced on the basis of a search termwhich includes theirname.Thisremedyhasbeenderivedfromthe“righttoerasure”underdataprotectionlawbysomeinternationalanddomesticcourtsandissometimesinaccuratelyreferredtoas“therighttobeforgotten”;



l) Thetermrighttotruthmeanstherighttoseek,receiveandimpartinformationabouthumanrights violations. It is a collective right drawing upon history, recent or current events topreventviolationsfromrecurringinthefuture.Itscorollaryisa“dutytoremember”,whichthestatemustassume,inordertoguardagainsttheperversionsofhistorythatgounderthenamesofrevisionismornegationism.Stateshaveacorrespondingobligationtofacilitatetheuncovering of information about human rights violations, whether past or present,particularlywhereviolationshaveoccurredona large,systematicscaleandentiresocietiesneedtocometotermswiththeeventswhichoccurred;

m) The term sensitivepersonaldatameanspersonaldataconsistingof informationrelating to

thedatasubjectwithregardtoracialorethnicorigin;politicalopinions;religiousbeliefsorother beliefs of a similar nature; trade union membership and membership in otherassociations; physical ormental health or condition; sexual life, sexual orientation, genderidentityorexpression;geneticdata;biometricdataforthepurposeofuniquelyidentifyinganaturalperson;thecommissionorallegedcommissionbythedatasubjectofanyoffence;oranyproceedingsforanyoffencecommitted,orallegedtohavebeencommitted,bythedatasubject,thedisposalofsuchproceedingsorthesentenceofanycourtinsuchproceedings;

n) The term search engines refers to software programs that use sophisticated algorithms to

retrieve data, files or documents froma database or network in response to a query. Theinformation retrieved is usually indexed and presented as a series of hyperlinks on awebpage;

o) Thetermsocialmediaplatforms refers toplatformsthedistinctive featureofwhich is that

theyencourageindividualstoconnectandinteractwithotherusersandtosharecontent;p) Thetermsubstantialharmmeansactual,orsubstantialriskof,physicalharm,severemental

distress or anguish, loss of, or detriment to, employment. Mere embarrassment ordiscomfort and potential loss of business or job prospects are not sufficient to qualify assubstantialharm;

q) Thetermwebhostingprovidersorhostsreferstobodies(typicallycompanies)thatrentwebserverspacetoenabletheircustomerstosetuptheirownwebsites;

r) Thetermpersons insituationsofvulnerability isusedtodescribepersonswhoseparticular

social location in society more broadly and within the community renders them at aparticularly high risk of physical or emotional harm. Persons in situations of vulnerabilityinclude, but are not limited to, children, elderly, persons with disabilities, the recentlybereaved, the seriously ill or persons who face discrimination based on their gender, orsexualorientationorgenderidentity.



Section1:Generalprinciples

Principle1:LegalframeworkfortheprotectionofrightsStatesshouldensure that the right to freedomofopinionandexpression, the right to informationand the right to privacy are enshrined in domestic constitutional provisions or their equivalent, inaccordancewith internationalhumanrights law.Domestic legislationshould includethateveryonehas:

a) Therighttofreedomofexpression,whichincludesthefreedomtoseek,receiveandimpart

informationandideasofallkinds,regardlessoffrontiers,eitherorally,inwritingorinprint,intheformofart,orthroughanyothermediaorotherplatformsofhisorherchoice.Therighttofreedomofexpressionincludestherighttooffend,criticise,commentortalkaboutothers, including on aspects of their private life,which are either private or known to thepublic,withouttheirconsent;

b) TherighttoholdanopinionwithoutinterferenceorlimitationsasdefinedunderPrinciple2;c) The right to information, which includes the right of everyone to seek, receive, use, and

impartinformationheldbyoronbehalfofpublicauthorities,ortowhichpublicauthoritiesareentitledbylawtohaveaccess,andinformationheldbyprivatebodiesexercisingpublicfunctionsandrequiredfortheexerciseorprotectionofanyrightorfundamentalfreedom;

d) The right toprivacy,which includes the rightof individuals to respect for theirprivateand

family life, home, and communications and the right to the protection of the law againstarbitraryorunlawfulinterferenceorattacksagainstthem.Therighttoprivatelifeextendstoaspectsrelatingtopersonalidentity,suchasaperson’sname,images,orphysicalandmoralintegrity;itisprimarilyintendedtoensurethedevelopment,withoutoutsideinterference,ofthepersonalityofeachindividualinhis/herrelationswithotherhumanbeings;1

e) The right to personal data protection, whichmay be derived from, and be related to, the

righttoprivacy;andwhichregulatesthewayinwhichinformationaboutindividuals,whichmaybeeitherprivateorpublic,iscollected,processed,storedandretainedelectronicallybyboth public and private bodies. Personal data must be processed lawfully and fairly forspecified purposes and on the basis of the informed consent of the person concerned, orsomeotherlegitimatebasislaiddownbylaw.Withoutprejudicetotheapplicabilityofdataprotection rights under this Principle, personal informationmay be processedwithout theconsentof the individual if the information is publicly available. Everyone shouldhave therightofaccesstodataheldbythirdparties(datacontrollers)concerninghimorher,andtherighttohaveitrectifiedordeleted,subjecttolegitimateexceptions.

1ThisprovisionshouldnotbeusedtopreventstatesprovidingfullprotectionofrightsasprovidedforbyArticle18oftheInternationalCovenantonCivilandPoliticalRights.



Principle2:Limitedscopeofpermissiblerestrictions2.1. Statesshouldensurethatdomesticconstitutionalorlegalprovisionsclearlysetoutthescope

of permissible restrictions on the rights and freedoms set forth in these Principles. Statesshouldprovidethatsuchrestrictionsmayonlybejustifiediftheyare:

a) Providedbylaw:anyrestrictionmusthaveaformalbasis in law,whichisaccessibleand

formulatedwithsufficientprecisiontoenableindividualstoforeseewhetheraparticularactionisinbreachofthelawandtoassessthelikelyconsequencesofanybreach;

b) In pursuit of a legitimate aim: any restrictionmust be shown by the state to have thegenuinepurposeanddemonstrableeffectofprotectingalegitimateaimrecognisedunderinternationallaw,whichincludestherightsandfreedomofothers;

c) Necessaryandproportionateinpursuanceofalegitimateaim:anyrestrictionisnecessary

andproportionateinademocraticsocietyif it istheleastrestrictivemeansavailableforprotectingthatinterest;and

d) Restrictions on the right to hold an opinion (as provided for in Principle 1b) are neverpermitted.

2.2. States should ensure that domestic legislation provides for sufficient safeguards and

remedies against abuse, including prompt, full and effective scrutiny, by an independentcourt,tribunalorotherindependentadjudicatorybodyofthevalidityoftherestriction.

2.3. Statesmust notmerely abstain from interferingwith the rights and freedoms set forth in

these Principles, they also have positive obligations to protect them, including frominterferencebythirdparties.

2.4. PrivateactorsshouldrespecttherightsandfreedomssetforthinthesePrinciples,including

thelimitedscopeofpermissiblerestrictionsonthemasprovidedherein.Principle3:LegitimatepurposeofprivacycausesofactionStatesshouldrecogniseandgiveeffecttothefollowing:a) Lawsprovidingforprivacyoffencesand/ortortsmayconstitutelegitimaterestrictionsonthe

right to freedomofexpression if theyare sufficiently clearandnarrowlydefinedand theirgenuine purpose and demonstrable effect is to protect individuals from unlawfulinterferences in, or attacks on, their right to private and family life, home andcommunications;

b) Lawsprotecting individualsfromsubstantialharm, includingbutnot limitedtoharassment,

threats of violence, the malicious disclosure or distribution of private sexual content(includingphotographsorfilms),ormaliciousdisclosureofsensitivepersonalinformationorpersonal information other than a person’s name or other identifier without consent canconstitutea legitimaterestrictionontherighttofreedomofexpressionprovided thattheyarenarrowlydrawn,containsufficientdefencesfortheprotectionoffreedomofexpressionanddonotimposedisproportionatesanctions;



c) Lawsprovidingforprivacyoffencesand/ortortscannotbejustifiediftheirpurposeismerelytoprotectindividualsagainstharmtoareputationwhichtheyeitherdonothaveordonotmerit.Inparticular,privacyoffencesortortscannotbejustifiediftheirpurposeoreffectistopreventlegitimatecriticismofpublicfigures,theexposureofcorruption,officialwrongdoing,ortoprotectthereputationofheadsofstateorotherpublicofficialsorpublicfigures;

d) Lawsprovidingforprivacyoffencesortortscannotbejustifiedonthegroundsthattheyhelp

maintain public order, national security, or friendly relations with foreign states orgovernments.



Section2:FreedomofexpressionandtherighttoprivacyasmutuallyreinforcingrightsPrinciple4:Communicationssurveillance4.1. The indiscriminateanduntargetedcollection, storageandanalysisofdigitaland traditional

communications or communications data without specific, individual reasonable suspicion(“masssurveillance”)bystateandnon-stateactorsimpingesontheveryessenceoftherighttoprivacy. Italsohasachillingeffectontheexerciseoftherighttofreedomofexpressionand the right to hold and form an opinion by searching and accessing and disseminatinginformationonline.Assuch,masssurveillanceisalwaysadisproportionateinterferencewiththerightstoprivacyandfreedomofexpression.

4.2. States should ensure that their legislation, practices, and procedures regarding the

surveillanceofcommunicationscomplywith the InternationalPrincipleson theApplicationofHumanRightstoOnlineCommunicationsSurveillance.

Principle5:MandatorydataretentionMandatory retention laws – requiring Internet and telecommunications service providers tocontinuously collect and preserve the content of users’ communications, communications data aswellasinformationaboutusers’onlineactivitiesandidentity–significantlyinterferewiththerightsto freedomof expression andprivacy. States should ensure that their data retention regimes andschemes fully comply with standards set forth in these Principles taking into consideration thefollowing:

a) General and indiscriminatemandatory retentionmeasuresareadisproportionate restriction

ontherightstoprivacyandfreedomofexpressionandshouldbeabolished;andb) Targeted retention measures should only be imposed where they are necessary for the

purpose of fighting serious crime, where the categories of data to be retained and theretentionperiod is limitedtowhat isstrictlynecessary,andwheretheyareaccompaniedbysafeguardsagainstabuse.

Principle6:Anonymity,mandatoryuserregistrationandreal-namerequirements6.1. Everyone should have a right to exercise his/her right to freedom of expression

anonymously,whichincludesthroughanonymousspeech,toreadanonymouslyortoaccessinformationinonlineandphysicalenvironmentsanonymously.

6.2. Thereshouldbeapresumptioninfavourofexercisingthisright.Statesshouldrepeal:

a) Blanket prohibitions on anonymity as these are unnecessary and disproportionaterestrictionsontherightstoprivacyandfreedomofexpression;

b) Laws, regulations and policies requiring the registration of real names or otheridentifiableinformationorimposingtheregistrationofdevicesandconnectionsasapre-



requisiteforaccesstotheInternetorInternetservices,astheseconstituteaviolationoftherightstofreedomofexpressionandprivacy.

6.3. Service providers should ensure that their users can communicate anonymously, and thus

refrain from imposing real-name policies or requiring the registration of other identifiableinformation on their platforms, as such requirements severely undermine the rights tofreedomofexpressionandprivacy.

Principle7:Encryption7.1. Everyoneshouldhavearighttousesecurecommunicationtools,inparticularanyhardware

andsoftwareencryptionproductsandothercryptographicmethodsoftheirchoice.7.2. States should recognise in their legislation and practices that encryption is a basic

requirementfortheprotectionoftheconfidentialityandintegrityofinformationandthat,assuch, it is essential to the protection of the rights to privacy and freedom of expressiononline.

7.3. States and companies should promote end-to-end encryption of communications as the

basic standard for the protection of the right to privacy online. They should also promoteprivacybydesignintechnicalstandardsandcompanyproducts.

7.4. States should promote digital literacy (the set of enabling skills that are required to use

digital technology) in the use of encryption tools and promote the use of open sourcesoftware,includingbyensuringthatitisregularlyandindependentlymaintainedandauditedforvulnerabilities,includingbycivilsocietyexperts.

7.5. States should refrain fromadopting or repeal all legislation that prohibits individuals from

using encryption or prohibits companies from including encryption in their systems andproducts.

7.6. States should refrain from adopting measures requiring or promoting technical

vulnerabilities (“backdoors”) to be installed in hardware and/or software encryptionproductsasadisproportionaterestrictionontherighttoprivacyandadisproportionateformofcompelledexpression.

7.7. States should repeal or refrain from adopting laws requiring the disclosure of decryption

keys. Court-ordered decryption of encrypted data or devices (as opposed to disclosure ofdecryption keys)may only be permissible when it results from transparent and publiclyaccessiblelawsappliedsolelyonatargeted,case-by-casebasistoindividualsresponsiblefortheencryptionandonlywhensubjecttojudicialwarrantandrespectfordueprocessrightsofindividuals,includingtherightagainstself-incrimination.

7.8. Statesshouldrefrainfromadoptinglawsestablishingkeyescrowsystems.7.9. Statesshouldliftimport/exportrestrictionsonencryptionhardwareandsoftware.



Principle8:Datadisclosurebycompanies8.1. Serviceprovidersshouldonlyberequiredtodisclosepersonalinformationabouttheirusers

subjecttoacourtorder,whichmustbeinlinewiththerequirementsof legality, legitimateaim,necessity,andproportionalityunderinternationalhumanrightslaw.

8.2. Serviceprovidersshouldnotifytheirusersthataccesstotheirpersonaldatahasbeensought

by state authorities or third parties except in cases where non-disclosure has beenspecificallyorderedbyacourtforalimitedperiodoftimebecausedisclosurewouldcreatearealriskofharmtoanotherindividualorwouldallowindividualsuspectstodestroyevidenceandseriouslyjeopardiseaninvestigation.

8.3. Service providers should publish transparency reports with specific information about all

requestsand/orordersfordisclosureofpersonaldatatheyreceivefromstates,courts,andprivateparties.Thisshouldalsoincludeinformationaboutactionstakenbythecompanyonsuchrequestsororders.

8.4. ConsistentwithPrinciple8.3,statesshouldrepeal laws,regulationsandpoliciesprohibiting

serviceprovidersfrompublishingtransparencyreportsondatarequestsorcommunicationssurveillance.

Principle9:Protectionofsources9.1. The right to freedom of expression implies that everyone who obtains information from

confidentialsourceswithaviewtoexercisingajournalisticactivityhas,subjecttoPrinciples9.2a)andb),adutynottodisclosetheidentityoftheirconfidentialsourcesandarightnottoberequiredtodoso.

9.2. Statesshouldprovidefortheprotectionoftheconfidentialityofsources intheir legislation

andensurethat:

a) Any restriction on the right to protection of sources complies with the three-part testunderinternationalhumanrightslaw,assetoutinPrinciple2;

b) Theconfidentialityofsourcesshouldonlybeliftedinexceptionalcircumstancesandonlyby a court order,which complieswith the requirements of a legitimate aim, necessity,andproportionality.Thesameprotectionsshouldapplytoaccesstojournalisticmaterial;

c) Therightnottodisclosetheidentityofsourcesandtheprotectionofjournalisticmaterialrequires that the privacy and security of the communications of anyone engaged injournalisticactivity,includingaccesstotheircommunicationsdataandmetadata,mustbeprotected.Circumventions,suchassecretsurveillanceoranalysisofcommunicationsdatanotauthorisedbyjudicialauthoritiesaccordingtoclearandnarrowlegalrules,mustnotbeusedtounderminesourceconfidentiality;and

d) Any court order under 9.2 b) and c) must only be granted after a fair hearing wheresufficient notice has been given to the journalist in question, except in genuineemergencies.



Principle10:SearchandseizureAccessto,andsearchandseizureof,informationrepresentsasignificantinterferencewiththerighttoprivacyandfreedomofexpression.Statesshouldtakeimmediatestepstoensurethatmeasuresregulatingaccessto,searchandseizureof,informationfullycomplywiththefollowingconditions:a) Access to, and search and seizure of information is only justified if themeasures strictly

complywiththerequirementsoflegality,legitimateaim,necessity,andproportionality;b) Searchofindividuals’homeorworkplace,onlineaccounts,remotedatastorage,collectionof

metadataandanyseizureofinformationmayonlybecompatiblewiththerightstofreedomof expression and privacy if ordered by a court and if strictly compliant with therequirements of legality, legitimate aim, necessity, and proportionality under internationalhumanrightslaw;

c) Indeterminingwhetherthesearchorseizureofinformationisnecessaryandproportionate,

special weight must be given to the confidentiality of sources, journalistic material, andprivilegedinformationinappropriatecases;and

d) Generalsearchandseizurewarrants,whicharenotnarrowlydrawnandbasedonreasonable

suspicionareinherentlydisproportionate.Principle11:Trans-borderdataflows11.1. The meaningful exercise of the right to freedom of expression requires that the right to

privacyandpersonaldataprotectionbestronglyprotected,includinginlegalagreementsfordata flows. In order to ensure a consistent level of protection of personal data, the dataprotectionprinciples set forth inSection1andSection2mustalsoapply todata transfersbetweencompaniesandstates.

11.2. In data transfer agreements, states should ensure that the applicable law is the one

providingthehighestprotectionforpersonaldata.Thelevelofdataprotectionapplicabletoanindividual’spersonaldatamustnotbeloweredbecauseofthedatabeingtransferred.

11.3. Allstatesshouldadoptdataprotectionlaws.Anydatalocalisationlawsshouldensurestrong

privacyprotectionsandincludelimitsonaccessanddataretentionassetoutinPrinciples5and8.



Section3:ReconcilingtherighttofreedomofexpressionandtherighttoprivacyPrinciple12:PublicationofpersonalinformationNationallegalsystemsshouldmakeitclear,eitherexplicitlyorthroughauthoritativeinterpretation,that in the context of the publication of personal information in the newsmedia (including printpressandbroadcasting)andotherplatforms:a) When seeking to reconcile the right to freedom of expression and the right to privacy,

particularlyincasesinvolvingthepublicationofpersonalinformation,publicauthorities,thecourtsorotherindependentadjudicatorybodiesshouldgiveregardtoallthecircumstancesofthecase,includingthefollowingfactors:i. Theextenttowhichthepublicationatissuecontributestoadebateofpublicinterest

asdefinedintheKeyDefinitions;

ii. Thedegreeofnotorietyorvulnerabilityofthepersonaffected;

iii. The subject covered by the publication and the extent of the private nature of theinformationatissue;

iv. Thepriorconductofthepersonconcerned;

v. Content,form,andconsequencesofthepublication,includingthesarcastic,humorousor satirical tone used by the author of the publication and the extent towhich theharmsufferedasaresultofthepublicationofprivateinformationhasinterferedwithhisorherprivatelifesoastounderminehisorherpersonalintegrity;

vi. Theway inwhich the informationwas obtained andwhether this is consistentwithPrinciples12b)and12c);

vii. The intent of the individual or entity disseminating the information at issue, and inparticularwhetheritwasmalicious;and

viii. Theextent towhich the individualwhoseprivacy isat issue isapublic figure,asperPrinciple13.

b) Where the published material includes photographs, video footage or sound recordings,

regardshouldbehadtothecircumstancesinwhichthematerialswereobtained,including,interalia:i. Whethertheindividualconcernedvoluntarilytook,orconsentedtothetaking,useor

disseminationofthephotograph,videofootageorsoundrecording;

ii. Whether the individual consented to the use, disclosure or dissemination of thematerial;



iii. Whether the material was obtained without the individual’s knowledge or wasobtainedbysubterfugeorotherillicitmeans;

iv. The nature and seriousness of the intrusion bearing inmind that images and soundrecordings are particularly sensitive personal information, as they reveal a person’suniquecharacteristics;and

v. Anymeasurestakentominimisetheintrusionintotheindividual’sprivacy.

c) The use of privacy-invasive investigating techniques, such as hidden cameras, drones,“hacking”,undercover reportingor subterfuge, for thepurposesof journalism, shouldonlybepermittedincircumstanceswhere:

i. Thereisanoverridingpublicinterestinthedisseminationoftheinformationsoughtor

discovered;

ii. Suchinformationcouldnotbeobtainedbyanyotherlessprivacy-intrusivemeans;and

iii. Effortshavebeenmadetoaddressprivacyconcernsby,interalia,blurringthefaceofthe individual/s concerned, editing out information of a private nature or otherwiseminimisingtheintrusionintotheindividual/s’privacy.

Principle13:Publicfigures13.1. National legal systems should make it clear, either explicitly or through authoritative

interpretation,thatopenandfreedebateonmattersofpublicinterestisattheverycoreofademocratic society. Public figures, especially heads of state, elected representatives,individuals with a role in public life, exercising a public function or otherwise engaged inpublic activities, inevitably and knowingly lay themselves open to close scrutiny by bothjournalistsandthepublic.Theythereforehavealowerexpectationofprivacythanordinaryindividualsorlesserpublicofficialsinrelationtomattersofpublicinterest.

13.2. Thepublicinterestmayextendtoaspectsoftheirprivatelifeasitrelatesto,oraffects,their

publicrolebutdoesnotincludepurelyprivatemattersinwhichtheinterestofmembersofthepublicis,ifany,merelysalaciousorsensational.

13.3 Aperson(“celebrity”)whodoesnotcarryoutapublicfunctionmaystillbeconsideredtobe

apublic figureforthepurposesofPrinciple13, if theyareapublic figurebyvirtueoftheirnotoriety;or if theydrawbenefit frombeing in thepubliceyeandareable todisseminatetheirviewsthroughthemediaasaresultoftheirbeinginthepubliceye.

13.4. The more significant a public figure is, especially in relation to their being an elected

representativeortoexercisinganypublicfunction,themoretheyshouldbesubjectto,andtolerant of, the highest levels of scrutiny in accordance with the principles of democraticpluralism.



Principle14:Openjustice14.1. States should guarantee in their national legislation, and protect and promote in their

practices, the principle of open justice or publicity of all judicial actions. This principledemands that thepublic havea right to know the identityof theparties involved in courtproceedings, including suspects in criminal investigations, defendants and witnesses incriminal proceedings, and private parties in civil proceedings; it also implies that courthearingsmustbeheldinpublicandthatfilming,recording,broadcasting,usingsocialmedia,andthetakingofphotographsshouldbepermittedduringcourtproceedings.

14.2. RestrictionsonPrinciple14.1,includinganonymityorders,hearingsheldinprivateandbans

onthefilming,broadcasting,theuseofsocialmediaortakingofphotographsincertaintypesofproceedings,shouldonlybepermittedbyanindependentcourtandcanonlybejustifiedinexceptionalcircumstances,including:

a) Wheretheneedtoprotectvictims,witnesses,defendantsortheirclosefamilymembers

from a real and substantial risk of physical violence or other tangible harm clearlyoutweighsthefreeexpressionrightsofindividualstoreportoncourtproceedings;

b) Where the need to protect the welfare of children or other persons in situations ofvulnerability, including their right to privacy, outweighs the public interest in openjustice;

c) Where identifying one of the parties would inevitably lead to the unjustified ordisproportionatedisclosureofconfidentialinformation;

d) Where publicity would defeat the object of the hearing, bearing in mind that thesensibilitiesofthepartiesinvolvedarenobasisforexclusionofthepublicfromjudicialproceedings;

e) Where the subject matter of the case involves discussion of justifiably confidentialinformation of one of the parties and a public hearing would undermine thatconfidentiality;and

f) Where this is requiredby the interestsof justice, forexample topreventprejudice tojudicialproceedings.

14.3. Video recording of court proceedings should comply with data protection principles and

shouldtakeplacesoasnottodisturbthehearing.14.4. Thefactthatthepublicmaymisinterpretoractinappropriatelyasaresultofcourtreporting,

however accurate, cannot justify a ban on publication of such reports by the press or thepublicatlarge.

14.5 Incircumstanceswheresomedegreeofconfidentiality is required, it ispreferable–where

possible – to achieve this through contestable orders (“reporting restrictions”) made onnoticetothemedia,ratherthanbyholdinghearingsincamera.



Section4:Reconcilingfreedomofexpression,dataprotectionandprivacyPrinciple15:Protectionofpubliclyavailableinformation15.1. Once information becomes publicly available, the presumption is that it must remain

accessible in the public domain indefinitely. The presumption in this Principle does notextinguishanyclaimforbreachoftherighttoprivacyortheapplicationofdataprotectionprinciples.

15.2. Notwithstanding Principle 15.1, access to publicly available informationmay be restricted

subjecttothestrictthree-parttestlaiddowninPrinciple2.15.3. Thereshouldbeapresumptionthatpersonal informationpublishedbyan individualabout

themselvesonpublicplatforms,includingonsocialmediaplatformsinwhichprivacysettingshavebeenset topublic,mayeasilybecomepubliclyavailableandthat there is thereforeacorrespondinglylowexpectationofprivacyinrespectofsuchinformation.

15.4. Companies should have an obligation to make privacy protections clear and easily

understandableandensurethatindividualsaregivenadequatecontrolovertheinformationthey want tomake public and the information they want to keep private or limited to adefinedgrouponline.Companiesshouldnotchangeprivacysettingsunlessitistoprovideahigherprotectionofprivacyandtheyshouldproactivelyinformtheirusersofanychangestoprivacysettings.

Principle16:Requeststodeletecontentauthoredandoriginallypublishedbyoneself16.1. Thereshouldbeapresumptionthattherighttofreedomofexpressionincludestherightnot

to speak, to changeone’s opinion and to delete, or to request a hosting provider or thirdpartytodelete,contentauthoredandoriginallypublishedbyoneself,includingonline.

16.2. Principle16.1doesnotapplytocontentauthoredbyothersandhostedorpublishedbythird

partiesaboutoneself.16.3. Indecidingwhetherarequestforthedeletionofcontentauthoredandoriginallypublished

by oneself should be granted by hosts and third parties, regard should be had to thefollowingfactors:

a) Whethertherequesthasbeenmadebyachild,orayoungperson;

b) Whethertherequesthasbeenmadebyapersoninasituationofvulnerability;

c) Whethertherequesthasbeenmadebysomeonewhowasachild,ayoungpersonora

personinasituationofvulnerabilityatthetimethecontentinquestionwasauthoredorpublished;

d) Whetherthecontentrepresentsthatperson’sownauthorship;



e) Whetherthepersonmakingtherequestisapublicfigureorwasatthetimethecontent

wasauthoredorpublished;

f) Whetherthecontentatissueisinthepublicinterest;and

g) Whether it is necessary and proportionate to remove the content taking intoconsiderationallthecircumstancesofthecase.

Principle17:Requeststodeletecontentpublishedbythirdparties17.1. Hosts and third parties should not be required to delete or otherwise remove content

containing personal information published by third parties on the basis of national dataprotectionlawsortheso-called“righttobeforgotten”.

17.2. Hostsmayonlyberequiredtodeletecontentcontainingpersonalinformationpublishedby

third parties where the publication of the information by a third party constituted anunlawfulact,suchasitrelatedtoprivacyoffencesoroffencessuchasharassment,threatsofviolence or malicious disclosure or distribution of personal information or private sexualcontent(suchasphotographsorfilms).Indeterminingwhetherarequestforthedeletionofcontentcontainingprivateinformationpublishedbythirdpartiesshouldbegranted,regardshouldbehadtoPrinciple17andthefactorssetoutinPrinciples12and13.

17.3. AnydeletionorremovalofcontentonanybasismustcomplywiththeManilaPrincipleson

IntermediaryLiability.Principle18:Requeststobede-listedfromsearchresults18.1. To the extent that a so-called “right to be forgotten” is recognised in some jurisdictions,

states should ensure that any such “right” is limited to the right of individuals under dataprotection law to request search engines to delist inaccurate or out-of-date search resultsproducedonthebasisofasearchfortheirname.

18.2. Asamatterofprinciple,de-listingrequestsshouldbesubjecttoultimateadjudicationbythe

courtsorindependentadjudicatorybodieswithrelevantexpertiseinfreedomofexpressionanddataprotectionlaw.Asthesametime,searchenginesaremorelikelytobethefirstportofcallforsuchrequests.Therefore,itisvitalthatbothpartieshavetherightofappealtoanindependentandimpartialcourtoradjudicatorybodyindisputedcases.

18.3. Indeterminingwhetherornottograntade-listingrequest,thecourtsorotherindependent

adjudicatory bodies should address themselves to the following non-exhaustive list offactors:

a) Whethertheinformationispersonalinformation;

b) Whethertheclaimantorplaintiffhadareasonableexpectationofprivacywithrespectto

the information, having regard to his or her prior conduct,whether consent hadbeengiven,andthepriorexistenceoftheinformationinthepublicdomain;



c) Whethertheinformationisinthepublicinterest,asdefinedintheKeyDefinitions;

d) Whethertheinformationatissuepertainstoapublicfigure,assetforthinPrinciple13;

e) Whethertheinformationispartofthepublicrecord,inparticularwhetherthematerialat issue has been published or recorded for journalistic, artistic, literary, or academicpurposesorhasbeenpublishedbythegovernmentindischargeofalegalobligationtomakepersonaldatapubliclyavailable;

f) In caseswhere the information at issue is of a public natureor has beenmadepublic

with the consent of the claimant or plaintiff, whether the claimant or plaintiff hasdemonstratedsubstantialharmasa resultof theavailabilityof searchresults linkedtotheirname;

g) Howrecenttheinformationisandwhetheritretainspublicinterestvalue,havingregard

to the fact that themore recent the information, themore likely it is to be of publicinterest value, and that certain types of information may retain public interest valueindefinitely;

h) Whether alternative remedies, such as seeking voluntary deletion of the content from

any third party publisher, a right to reply or a defamation claim would be moreappropriate;andwhethersuchremediesshouldhavebeenexhaustedfirstorinstead;

i) Whethergrantingarequesttobede-listedisaproportionaterestrictionontherightto

freedomofexpression,havingregardtoallthecircumstancesofthecase.18.4. De-listingordersmustbelimitedinscopetothedomainnamecorrespondingtothecountry

wheretherightisrecognisedandwheretheindividualconcernedhasestablishedsubstantialdamage.

18.5. Anyde-listingofcontentonthebasisofnationaldataprotectionlawsmustapplytheManila

PrinciplesonIntermediaryLiabilityandincludethefollowingproceduralsafeguards:

a) Datapublishersshouldbenotifiedandhavearighttochallengede-listingrequests;

b) Data publishers and search engines should have a right of appeal against de-listingorders.

18.6. Consistent with Principles 24 and 25 below, states should refrain from imposing large

punitive fines merely for failure to comply with a de-listing request as this is likely toconstitute a disproportionate restriction on freedom of expression, due to the inherentchillingeffectofsuchmeasures.

18.7. RelevantInternetserviceproviders,publicbodiesandthecourtsshouldpublishtransparency

reports about thenumberandnatureofde-listing requests, aswell as statistics about thenumberofrequestswhicharegrantedorrejected.

18.8 Wherede-listinghasoccurred,intheinterestsoftransparencythisshouldbemadeclearin

thepresentationofthesearchresults.



Principle19:Dataprotectionexemptions19.1. States should ensure that the enforcement of data protection rights, as defined for the

purpose of these Principles, includes broad exemptions or limitations for the exercise offreedomofexpression.

19.2. At a minimum, there must be exemptions from the application of, and/or limitations

embeddedin,dataprotectionlawsfortheprotectionofjournalistic,literary,academic,andartisticpurposesand for thedischargeofany legalobligationtomake informationpubliclyavailable, such as the maintenance of archives for historical or other public interestpurposes, or under right to information laws; and such exemptions or limitationsmust beinterpretedbroadly so as to givemeaningful effect to the rights to freedomof expressionandtoinformation.



Section5:Reconcilingtherighttoinformation,dataprotectionandtherighttoprivacyPrinciple20:Generalprinciplesontherighttoinformation20.1. Public bodies, as well as private bodies carrying out public functions, delivering public

services, managing public resources or utilising public funds should apply the principle ofmaximum disclosure when dealing with right to information requests or proactivelypublishinginformationabouttheiractivities.

20.2. The scope of exceptions to the right to information, including the right to privacy and

protection of personal data, must be limited and subject to strict “harm” and “publicinterest”tests.

20.3. Public bodies must proactively disclose government data, including through the use of

accessible formats and anonymised datasets (“open data”), subject to safeguards for theprotection of the right to privacy, of the right to personal data protection (as set forth inPrinciple1),andofconfidentialsources(underPrinciple9).

Principle21:Maximumdisclosureofpersonalinformationaboutpublicofficials21.1. Statesshouldenableintheirlegislationandpracticesthatpersonalinformationaboutpublic

officialscanandshouldbedisclosedifit:

a) Relates to those individuals’ official capacities or is required for the exercise orprotectionofanyrightorfundamentalfreedom;and

b) Relatestoapublicofficial’semployment,suchashisorherperformance,salary,assets,andconflictsofinterest.

21.2. Consistentwith Principle 13, personal data,whichmay include private information, about

publicofficials shouldbedisclosedwhere the informationat issue is in thepublic interest.Thepublicinterest(assetforthintheKeyDefinitions)indisclosingtheinformationmustbeparticularlystrongwhentheinformationisofapurelyprivateorhighlysensitivenature.

Principle22:Officialrecords22.1. Stateauthoritiesmayholdpersonalinformationaboutprivatecitizensincourtrecords,social

programme records, public registers, professional records, archives, public subsidies forbusiness purposes, and records of beneficial ownership in companies. In determiningwhether tomake those recordspublicor (partially)anonymised,governments shouldhaveregardto:

a) Thefreeflowofinformation;

b) Transparencyandaccountability;



c) Otheraspectsofthepublicinterest,suchasopenjusticeandanti-corruption;

d) Naturalpersons’rightstoprivacy;

e) Legalpersons’legitimaterightsto,andinterestsin,confidentiality;

f) Accountabilityforfairhandlingofinformation;

g) Publicsafetyandsecurity;and

h) Discriminationagainstminoritiesandotherpersonsinsituationsofvulnerability.

22.2. Thereshouldbeapresumptionthat:

a) Court records should be made public where anonymity orders or other reportingrestrictionscanadequatelyprotecttherighttoprivacyortoafairtrialwherethecourtdeemsitnecessary;

b) Healthrecords,becauseoftheirinherentlysensitivenature,shouldnotbemadepublicunlessthere isastrongcountervailingpublic interest inpublishingsuch information inindividualcases;and

c) Publicrecordsaboutchildren,whethermedicalorpertainingtosocialprogrammes,andpublicrecordsaboutvictimsofsexual, institutional,orothertypesofcriminalviolenceshouldnotbemadepublicotherthaninananonymisedformat.

22.3. In determining whether, under Principle 22.1 or 22.2, it would be fair for personalinformation held in such records to bemade publicly available, the relevant independentauthoritiesshouldhaveregardtothefollowingfactors:a) Howtheinformationwasobtained;

b) Thesubject’slikelyexpectationregardingdisclosureofinformation;

c) Theeffectofthedisclosureonthedatasubject, inparticularwhetherheorshewould

suffersubstantialharmasaresultofthedisclosure;

d) Whetherthepartyexpresslyrefusedconsenttothedisclosureoftheinformation;

e) Thecontentoftheinformation;and

f) Thepublicinterest(asdefinedinKeyDefinitions)intheinformation.22.4. When personal information is made publicly available in data form, including in public

databases,thereshouldbenorestrictionsonthere-useofsuchdataforthepurposesoftheexerciseoffreedomofexpression,includingjournalistic,artistic,andliterarypurposes.



Section6:RemediesandsanctionsPrinciple23:Generalprinciples23.1. States should ensure that redress mechanisms for alleged privacy or data protection

violationsshouldbeeasytouse,quickandeffective,andcomplywithdueprocessstandards.Self-regulatory or voluntary redress mechanisms, alternative dispute resolution schemes,such as ombudspersons, and non-pecuniary remedies should be made available andaccessibleinadditiontoeffectivecourtaction.

23.2. Anysanctions imposedby thecourtsorother independentadjudicatorybodies inorder to

protecttherighttoprivacymustbeproportionatetotheharmsuffered.23.3. The courts or other independent adjudicatory bodies should address themselves to the

question of whether the remedy being sought is the most appropriate to deal with thebreach of privacy or data protection whilst fully respecting the right to freedom ofexpression.

23.4. Thecourtsorotherindependentadjudicatorybodiesshouldconsiderwhethernon-pecuniary

remedies, including an apology, retraction, correction or declaration, or a combination ofthese, is or are amore proportionate remedy for dealing with privacy or data protectionviolationsthancivilorcriminalsanctions.

23.5. IncasesrelatingtotheInternet,thecourtsorotherindependentadjudicatorybodiesshould

considerwhether thecasehasa realandsubstantialconnectionwith thecountry inwhichthe court is based and whether the claimant can establish that he or she has sufferedsubstantialharminthatjurisdiction.

Principle24:CriminalpenaltiesStates should ensure in their domestic legislation and practices that criminal penalties, includingimprisonment and punitive fines, are proportionate to the seriousness of the infringement of therighttoprivacyordataprotection,and,ifusedatall,shouldberestrictedtothemostseriouscaseswherethereiswilfuldisregardoftherightsofothersorgrossnegligence.Principle25:Pecuniaryawards25.1. In assessing thequantumofpecuniary awards forbreachesof the right toprivacyordata

protection, courts should take into account the potential chilling effect on freedom ofexpression. In particular, they should ensure that pecuniary awards are neverdisproportionate to the harm suffered and take into account any available non-pecuniaryremedies.

25.2. States should ensure in their domestic legislation and practices that the circumstances in

which punitive damagesmay be awardedmust be strictly limited to circumstanceswherethereisawilfuldisregard(includinggrossnegligence)oftherightsorothers.



25.3. Afixedceilingtothequantumofsuchpunitivedamagesmustbeappliedinprivacyordataprotectioncaseswherethereisnon-materialharm,andmustberelatedtotheabilitytopayofthepartybeingpunished.

Principle26:Priorrestraint,superinjunctions,mandatorypre-moderationandnoticepriortopublicationStatesshouldrecogniseinlegislationandinpracticethat:a) Asamatterofprinciple,priorrestraintisnevercompatiblewiththeprotectionoftherightto

freedomofexpression,evenonthegroundsofprotectingprivacy;

b) Interimnon-disclosureorderscontainingaprohibitiononreporting the factofproceedings(i.e. super-injunctions), including the existence of the injunction and any details containedwithin it, should be considered a disproportionate restriction on the right to freedom ofexpression;

c) Alegalrequirementtogivenoticetoanindividualwhoserighttoprivacymightbeengagedpriortopublication,soastoenablehimorhertoseekaninjunctionisincompatiblewiththeprotectionoftherighttofreedomofexpression;and

d) A legal requirement to pre-moderate user-generated content constitutes a form of prior-restraintandassuchisincompatiblewiththerighttofreedomofexpression.

Principle27:Interiminjunctions27.1. Insofar as interim injunctions prohibiting the publication or further publication of private

information (i.e. interim non-disclosure orders) may be permitted by law in certainjurisdictions,statesshouldensurethatsuchinjunctionsshouldonlybepermittedbyorderofacourtinthemostexceptionalcaseswhereallofthefollowingconditionsaremet:

a) Theapplicantcanshowthatheorshewouldsufferirreparabledamagewhichcouldnot

becompensatedbysubsequentremediesshouldpublicationorfurtherpublicationtakeplace;

b) Thecourt is satisfied that theapplicant is likely toestablishata later fullhearing (seePrinciple27.3below)thatpublicationorfurtherpublicationshouldnotbeallowed;

c) Thecourthashadparticularregardtotheimpactonfreedomofexpression,andwherethe proceedings relate to journalistic, literary or artisticmaterial, the extent towhichthematerialhasorisabouttobecomeavailabletothepublicortheextenttowhichitis,orwouldbeinthepublicinterestforthematerialtobepublished;and

d) Thecourthashadregardto theprotectionof therightssetout inPrinciple1andhascarefullyappliedthethree-parttestsetoutinPrinciple2tothefactsofthecase.

27.2. Advance notice of an application for an interim non-disclosure order must be given to

respondentsandanynon-partieswhichhaveanexistinginterestintheinformationsoughttobe protected by the order. Failure to provide advance notice can only be justified by



compellingreasons,includingwherethereisarealprospectthatwerearespondentornon-partytobenotifiedtheywouldtakestepstodefeattheorder’spurpose.

27.3. Permanentinjunctionsshouldneverbeobtainedwithoutafullandfairhearingofthemerits

ofthecase.Permanentinjunctionsshouldbelimitedinapplicationtothespecificstatementsfoundtobeinbreachoftherighttoprivacyandtothespecificpeoplefoundtohavebeenresponsibleforthepublicationofthosestatements.

Principle28:BlockinginjunctionsStatesshouldensureintheirlegislationandpracticethat:a) Filtering, blocking, removal and other technical or legal limits on access to content – as

serious restrictionson freedomofexpression– canonlybe justified if they strictly complywiththethree-parttestunderinternationallaw(assetforthinPrinciple2);and

b) Wholesale blocking of the Internet or of online services, platforms, or applications for thepurposesofprotectingtherighttoprivacyareadisproportionaterestrictiononfreedomofexpression.

Principle29:Intermediaryliabilityandcontentremoval29.1. States should ensure in their legislation and practices that intermediaries which provide

services – such as, for example, those providing Internet access, or searching for, or thetransmitting,hostingor cachingof information– should inprinciplebe immune frombothcivil and criminal liability for privacy-infringing content disseminated by third parties usingthoseservices.

29.2. Intermediaries shouldnotbe required tomonitor their servicesactively topreventprivacy

infringements.29.3. Laws governing the liability of intermediaries in respect of privacy-infringing contentmust

containdueprocesssafeguardssufficienttoprotectfreedomofexpressionandtherighttoprivacy. In principle, intermediaries should only be required to remove privacy-infringingcontent if the measure is provided by law and ordered by a court, tribunal or otherindependentadjudicatorybody inaccordancewiththeruleof law.AnyremovalofcontentshouldbeconsistentwiththeManilaPrinciplesonIntermediaryLiability.

29.4. Principle29.1andPrinciple29.3arewithoutprejudicetovoluntaryredressmechanismsthat

Internet intermediariesshouldprovideforprivacyviolationsundertheirtermsofservice inlinewiththeManilaPrinciplesonIntermediaryLiability.

Principle30:BlanketprohibitionsonInternetaccessongroundsofprivacyprotectionStatesshouldrefrainfrommandatingblanketprohibitionsonaccesstotheInternetonthegroundsofprotectionoftherighttoprivacy,asthesearealwaysadisproportionaterestrictionontherighttofreedomofexpression.



BackgroundThesePrinciplesarepartofARTICLE19’sInternationalStandardsSeries,anongoingefforttoelaborateingreaterdetailtheimplicationsofprotectingandpromotingtherighttofreedomofexpressionindifferentthematicareas.These Principles are the result of a process of study, analysis, and drawing on the extensiveexperience andworkofARTICLE19’s regional offices andpartnerorganisations inmany countriesaround the world. An original draft of the Principles prepared in coordination with the SteeringCommittee(consistingofAccessNow;TheCentreforInternetandSociety,India;DerechosDigitales;Electronic Frontier Foundation; KICTANet, Kenya; OpenNet Korea and Tactical Tech) and furtherelaboratedinaseriesofconsultations,organisedbyARTICLE19,withhigh-levelexpertsfromAfrica,LatinAmerica,NorthAmerica,Europe,andAsia:activists, legalpractitioners,academics,andotherexperts ininternationalhumanrights law,freedomofexpression,privacy,anddataprotectionlaw.TheconsultationsincludedoneexpertmeetinginSanFranciscoon28–29March2016andaglobalpublic consultation launched online in 2016. Broader discussions also took place around the draftthat emerged from the meeting and global consultation. The final version of the Principles wasproducedonthebasisoftheseconsultations.ARTICLE 19 appreciates the input and support of all the individuals and organisations thatcontributedtothedevelopmentofthesePrinciples.These Principles were developed as a part of the project supported by a grant from the FordFoundation andthe Foundation Open Society Institute in cooperationwith the ProgramonIndependentJournalismoftheOpenSocietyFoundation.TheFordFoundationandTheFoundationOpenSocietyInstitutedonotnecessarilysharetheopinionsherewithinexpressed.ARTICLE19bearsthesoleresponsibilityforthecontentofthePrinciples.

Expression and Privacy Principles - Defending freedom of ... · Section 1: General principles ... ,...

Documents

Transcript of Expression and Privacy Principles - Defending freedom of ... · Section 1: General principles ... ,...