A/HRC/39/29 anonymity tools are widely used around the world, including by human rights defenders, civil society, journalists, whistle-blowers and political dissidents facing persecution and harassment. Weakening them jeopardizes the privacy of all users and exposes them to unlawful interferences not only by States, but also by non-State actors, including criminal networks.27 Such a widespread and indiscriminate impact is not compatible with the principle of proportionality (see A/HRC/29/32, para. 36). Intelligence-sharing 21. Governments across the globe routinely share intelligence on individuals outside any legal framework and without adequate oversight. 28 Intelligence-sharing poses the serious risk that a State may use this approach to circumvent domestic legal constraints by relying on others to obtain and then share information. Such a practice would fail the test of lawfulness and may undermine the essence of the right to privacy (see A/HRC/27/37, para. 30). The threat to human rights protections is particularly acute where intelligence is shared with States with weak rule of law and/or a history of systematically violating human rights. Intelligence received by one State from another may have been obtained in violation of international law, including through torture and other cruel, inhuman or degrading treatment. The human rights risks posed by intelligence-sharing are heightened by the current lack of transparency, accountability and oversight of intelligence-sharing arrangements (see A/69/397, para. 44, CCPR/C/GBR/CO/7, para. 24, and CCPR/C/SWE/CO/7, para. 36). With very few exceptions, legislation has failed to place intelligence-sharing on a proper statutory footing, compliant with the principle of legality under international human rights law. 29 Cross-border access to data held by business enterprises 22. Recently, there have been efforts to create legal mechanisms aimed at facilitating the access of States to personal information stored on the servers of business enterprises abroad. Obtaining evidence in the course of a criminal investigation is without doubt an important and legitimate goal. However, such access can result in weakening or circumventing procedural safeguards, such as the requirement for authorization by an independent body and the establishment of adequate oversight mechanisms. Cross-border requests may also negatively impact individuals’ access to appeals and remedial mechanisms. Particularly concerning is the possibility that States with weak rule of law and/or problematic human rights records could obtain access to sensitive information about individuals without adequate protections against human rights abuses. IV. Responsibilities of States A. State responsibility to respect and duty to protect the right to privacy in the digital age 23. Article 2 (1) of the International Covenant on Civil and Political Rights requires States to “respect and ensure” the rights recognized in the Covenant for all individuals within their territory and subject to their jurisdiction, without discrimination. States parties must refrain from violating the rights recognized in the Covenant, and any restrictions on any of those rights must be permissible under the relevant provisions of the Covenant. 30 27 28 29 30 Amnesty International, “Encryption. A matter of human rights” (March 2016); and Wolfgang Schulz and Joris van Hoboken, “Human rights and encryption”, United Nations Educational, Scientific and Cultural Organization (2016). See www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=17138. See Privacy International, Secret Global Surveillance Networks: Intelligence Sharing between Governments and the Need for Safeguards (April 2018) and www.ohchr.org/Documents/Issues/ DigitalAge/ReportPrivacyinDigitalAge/SRCT.pdf. See submission of Privacy International. See Human Rights Committee, general comment No. 31, para. 6. 7