A/HRC/39/29 instruments.5, 6 Privacy can be considered as the presumption that individuals should have an area of autonomous development, interaction and liberty, a “private sphere” with or without interaction with others, free from State intervention and from excessive unsolicited intervention by other uninvited individuals (see, for example, A/HRC/13/37, para. 11, and A/HRC/23/40, paras. 22 and 42). In the digital environment, informational privacy, covering information that exists or can be derived about a person and her or his life and the decisions based on that information, is of particular importance. 6. The protection of the right to privacy is broad, extending not only to the substantive information contained in communications but equally to metadata as, when analysed and aggregated, such data “may give an insight into an individual’s behaviour, social relationship, private preference and identity that go beyond even that conveyed by accessing the content of a communication” (see A/HRC/27/37, para. 19). The protection of the right to privacy is not limited to private, secluded spaces, such as the home of a person, but extends to public spaces and information that is publicly available (see CCPR/C/COL/CO/7, para. 32). For example, the right to privacy comes into play when a Government is monitoring a public space, such as a marketplace or a train station, thereby observing individuals. Similarly, when information that is publicly available about an individual on social media is collected and analysed, it also implicates the right to privacy. 7 The public sharing of information does not render its substance unprotected.8 7. The right to privacy is not only impacted by the examination or use of information about a person by a human or an algorithm. 9 Even the mere generation and collection of data relating to a person’s identity, family or life already affects the right to privacy, as through those steps an individual loses some control over information that could put his or her privacy at risk (see A/HRC/27/37, para. 20).10 In addition, the mere existence of secret surveillance amounts to an interference with the right to privacy (ibid).11 8. The right to privacy applies equally to everyone. Any differences in its protection on the basis of nationality or any other grounds are inconsistent with the right to equality and non-discrimination contained in article 26 of the International Covenant on Civil and Political Rights. 9. A State party must respect and ensure the rights laid down in the Covenant to anyone within the power or effective control of that State party, even if not situated within its territory. 12 Human rights law applies where a State exercises its power or effective control in relation to digital communications infrastructure, wherever located, for example through direct tapping or penetration of communications infrastructure located outside the territory of that State. Equally, where a State exercises regulatory jurisdiction over a third party that controls a person’s information (for example, a cloud service provider), that State also has to extend human rights protections to those whose privacy would be affected by accessing or using that information (see A/HRC/27/37, para. 34). 5 6 7 8 9 10 11 12 See, for example, article 16 of the Convention on the Rights of the Child; article 14 of the International Convention on the Protection of the Rights of All Migrant Workers and Members of Their Families; and article 22 of the Convention on the Rights of Persons with Disabilities. See, for example, article 10 of the African Charter on the Rights and Welfare of the Child; article 11 of the American Convention on Human Rights; and article 8 of the European Convention on Human Rights. See Privacy International submission for the present report. Anja Seibert-Fohr, “Digital surveillance, metadata and foreign intelligence cooperation: unpacking the international right to privacy”. See Paul Bernal, “Data gathering, surveillance and human rights: recasting the debate”, Journal of Cyber Policy, vol. 1, No. 2 (2016). See also European Court of Human Rights, Rotaru v. Romania, application No. 28341/95, judgment of 4 May 2000 and Kopp v. Switzerland, application No. 23224/94, judgment of 25 March 1998. See also European Court of Human Rights, Roman Zakharov v. Russia, application No. 47143/06, judgment of 4 December 2015. See Human Rights Committee, general comment No. 31 (2004) on the nature of the general legal obligation imposed on States parties to the Covenant, para. 10. 3