the press and of artistic expression.98 Infringements of these basic rights are permissible only if they
are proportionate to the danger that they seek to combat.99 Some countries have constitutionalized
the so-called “harm principle”,100 which more generally limits the scope of the criminal law to
conduct that is harmful or imminently dangerous to an interest worthy of protection.101 Many of
the limits placed on state action to secure cyberspace exist and are supported in international law,
which is binding law on States Parties (see section 5 A, below).
It should be born in mind that criminal law generally requires not only a guilty act (“actus reus”) but
a concurrently guilty mental state (“mens rea”) for culpability to attach (see section 1 D, above),.102
Such elements of the crime also must be respected in cybercriminal prosecutions (see section 2 A,
below).
B. Balancing Data Collection with Data Protection
For cyberspace to remain open and free, the same norms, principles and values that are upheld
offline must apply online. Fundamental rights and the rule of law need to be protected in
cyberspace. Data protection is about safeguarding the fundamental right to privacy, a right
enshrined in numerous international and regional instruments. However, according to the United
Nations Conference on Trade and Development (UNCTAD), only 107 countries had privacy laws or
bills in place as of 2014.103 Other countries have privacy laws governing select areas—for example,
children or financial records—but not a comprehensive law.104
Data collection is commonly understood as securing any personal information that is automatically
collected, processed and stored. It is essential that data protection laws restrain and shape data
collection, managing and storage activities conducted by both companies and governments. Past
behavior shows that, unless restrictive rules are in place, both public and private sector entities will
collect, mine and store as much information as possible without necessarily even informing the
public of such activities.105
Our freedoms and prosperity increasingly depend on a robust and innovative internet, which
will continue to flourish if private sector innovation and civil society drive its growth. But freedom
online requires safety and security too. Cyberspace should be protected from incidents, malicious
activities and misuse.
Governments have several tasks vis-à-vis cyberspace:
To safeguard access and openness;
To respect and protect fundamental rights online; and
To maintain the reliability and interoperability of the internet.
As discussed, because the private sector owns and operates significant parts of the infrastructure
creating cyberspace, any initiative addressing data collection and protection should engage with
the private sector.
Page 41 | Chapter 1 | § C. Challenges to Fighting Cybercrime
Table of Contents