A/HRC/39/29 right to freedom of expression, including processing of personal data for journalistic, artistic and academic purposes. 31. Data privacy frameworks should also establish certain obligations of the entities processing personal data. Those requirements encompass organizational aspects, such as the establishment of an internal supervisory mechanism, but also include mandatory actions, such as data breach notifications and privacy impact assessments. In an increasingly complex technological environment, such assessments assume a key role in preventing and mitigating privacy harms. 40 Moreover, requirements related to the design of products and services, such as privacy by design41 and privacy by default,42 are essential tools for safeguarding the right to privacy. 32. In a globalized world, transfers of data, including large amounts of personal data are commonplace and necessary for the operation of many services. States must ensure that such transfers do not amount to or facilitate undue interference with the right to privacy. At the same time, strict data localization requirements that oblige all data processing entities to store all personal data within the country at issue should be avoided (see A/HRC/32/38, para. 61). Instead, States should focus on ways to ensure that personal data transferred to another State is protected at least at the level required by international human rights law. 33. States should establish independent oversight bodies for the processing of personal data. Such bodies are essential for safeguarding the human rights of the individual against excessive practices of personal data processing. A supervisory authority requires a statutory footing in order to establish clearly its mandate, powers and independence. Such oversight bodies should be provided with the technical, financial and human resources necessary for effective monitoring of the data-processing activities of States and business enterprises, and for enforcing legal requirements in that regard. Moreover, such bodies need to have sufficient legal authority to carry out their functions, including imposing sanctions proportionate to the violations or abuses committed.43 2. Procedural safeguards and oversight for surveillance and communications interception Safeguards 34. While all types of State surveillance-related activities must be conducted on the basis of a law (see A/HRC/27/37, para. 28), the Special Rapporteur on the right to privacy has called attention to the widespread absence of such legislation. It is noteworthy that in many jurisdictions, intelligence and law enforcement agencies are excluded from the provisions of data privacy legislation. Such exceptions should be limited, based on the principles of necessity and proportionality, in order to ensure an adequate level of data privacy in all branches of government. Surveillance-specific legislation should be guided by the following minimum standards. 35. The law must be publicly accessible. Secret rules and secret interpretations of law do not have the necessary qualities of “law” (ibid., para. 29). Laws need to be sufficiently precise. Discretion granted to the executive or a judge and how such discretion may be exercised must be circumscribed with reasonable clarity (see A/69/397, para. 35). 44 To that end, the nature of the offence and the category of persons that may be subjected to surveillance must be described. Vague and overbroad justifications, such as unspecific references to “national security” do not qualify as adequately clear laws. Surveillance must be based on reasonable suspicion and any decision authorizing such surveillance must be 40 41 42 43 44 10 For an in-depth analysis of approaches to privacy impact assessments, see David Wright and Paul de Hert, eds., Privacy Impact Assessment (New York, Springer, 2012). Meaning that privacy protection must be integrated from the outset when designing a system. Requiring that a system applies privacy-respecting settings by default. See, for example, https://ico.org.uk/action-weve-taken/investigation-into-data-analytics-for-politicalpurposes/. See also Roman Zakharov v. Russia, para. 230.