A/HRC/39/29 victims’ lack of knowledge or proof of undue interference is a frequent obstacle to access to remedies (see A/HRC/27/37, para. 40). For example, State requests to access data held by companies are often accompanied by “gag orders” prohibiting companies from notifying the individuals concerned. States also often fail to notify those affected by other surveillance measures, in particular in mass surveillance cases. Recognizing that advance or concurrent notification might jeopardize the effectiveness of legitimate surveillance measures, individuals should nevertheless be notified once surveillance has been completed (see A/HRC/23/40, para. 82). If that is not possible, the law should generously grant standing to those who may theoretically have been affected by those measures (see A/HRC/13/37, para. 38). Similarly, business enterprises should notify their customers once they become aware of personal data breaches that may have affected their rights. 55. Victims also face new and growing challenges in the context of algorithmic decision-making, where individuals may not be able to access the input data or challenge the findings reached by the algorithm itself or how such findings were used in the decision reached.69 States and business enterprises, in collaboration with other stakeholders, should consider possible mechanisms for addressing this issue, such as the creation of wellresourced expert auditing bodies. 56. The nature of the harm caused by privacy infringements is the source of further challenges. The effect of privacy breaches is difficult to undo and may result in ongoing consequences and further human rights implications. The ease of retaining, sharing, repurposing and fusing data and profiles influences the permanence of digital data, meaning an individual may face new and ongoing risks to their rights into the future.70 57. Privacy harms significantly affect a person’s life, even when there is no quantifiable economic or other impact; the nature of the harm should not prevent victims from seeking redress. For instance, consumer protection organizations could be empowered to seek redress on behalf of victims of corporate privacy abuses. VII. Conclusions and recommendations 58. The international human right framework provides a strong basis for shaping the responses to the manifold challenges arising in the digital age. There is an urgent need for States to fully implement their obligations to respect the right to privacy, as well as their duty to protect the right to privacy, including vis-à-vis corporate abuses. To accomplish that objective, States need to establish an appropriate legal and policy framework, including adequate privacy protection legislation and regulation that incorporate the principles of legality, proportionality and necessity, and establish safeguards, oversight and remedies. 59. Many issues that could not be addressed in the present report require further in-depth study, including the interrelationships of the right to privacy with other human rights, including economic, social and cultural rights; disproportionate or discriminatory impacts of privacy invasions on individuals and/or groups at risk; the effects of big data and machine learning, including for predictive and pre-emptive purposes, on the enjoyment of the right to privacy and other human rights; and the regulation of surveillance technology markets. 60. The nature and forms of remedies that respond effectively to situations where the right to privacy has been violated is another area in which further attention is warranted. As a first step, the types of remedial action that would be appropriate in different situations should be identified in a systematic way. That could be used in the development of further guidance. In undertaking that analysis, due regard should be paid to the guidance and recommendations developed through the accountability and remedy project of the Office of the United Nations High Commissioner for Human 69 70 See submission of the University of Essex Human Rights, Big Data and Technology Project, para. 33. Ibid, para. 7. 15