A/HRC/39/29 10. According to article 17 of the Covenant, any interference is only permissible if it is neither arbitrary nor unlawful. Human rights mechanisms have consistently interpreted those words as pointing to the overarching principles of legality, necessity and proportionality (see A/HRC/27/37, paras. 21–27).13 In keeping with those principles, States may only interfere with the right to privacy to the extent envisaged by the law and the relevant legislation must specify in detail the precise circumstances in which such interference may be permitted.14 Interference is unlawful and arbitrary not only when it is not provided for by law but also when a law or the particular interference is in conflict with the provisions, aims and objectives of the Covenant.15 A limitation can only be lawful and non-arbitrary if it serves a legitimate purpose (see A/HRC/29/32, para. 33). The limitation must be necessary for reaching that legitimate aim and in proportion to that aim and must be the least intrusive option available. Furthermore, any limitation to the right to privacy must not render the essence of the right meaningless (see A/69/397, para. 51). 11. The right to privacy is central to the enjoyment and exercise of human rights online and offline. It serves as one of the foundations of a democratic society and plays a key role for the realization of a broad spectrum of human rights, ranging from freedom of expression (see A/HRC/23/40 and A/HRC/29/32, para. 15) and freedom of association and assembly (see A/HRC/31/66, paras. 73–78 and A/72/135, paras. 47–50) to the prohibition of discrimination and more.16 Interference with the right to privacy can have a disproportionate impact on certain individuals and/or groups, thus exacerbating inequality and discrimination.17 Overbroad privacy regulations may also amount to undue limitations of other rights, in particular freedom of expression, for example when a disproportionate regulation interferes with legitimate news reporting, artistic expression or scientific research. For lack of space, the interrelationship between the right to privacy and all other human rights, its discriminatory impact on specific individuals and groups, and approaches to protect them cannot be examined in the present report. III. Privacy interferences: trends and concerns A. Increased reliance on personal data by Governments and business enterprises Growing digital footprints 12. Both States and business enterprises collect and use steadily increasing amounts of data related to the private lives of individuals. Immense data streams relating to billions of individuals are being collected by personal computers, smartphones, smartwatches, fitness trackers and other wearables. A rapidly growing number of other interconnected devices and sensors installed in so-called smart homes and smart cities add further data. The range and depth of the information collected and used are vast, from device identifiers, email addresses and phone numbers to biometric, health and financial data and behavioural patterns. Much of this happens without the knowledge of the persons concerned and without meaningful consent. Data sharing and fusion 13. Business enterprises and States continuously exchange and fuse personal data from various sources and databases, with data brokers assuming a key position. As a consequence, individuals find themselves in a position of powerlessness, as it seems almost 13 14 15 16 17 4 See also Human Rights Council resolution 34/7, para. 2. See Human Rights Committee, general comment No. 16 (1988) on the right to privacy, paras. 3 and 8. Ibid, para. 4. See Paul Bernal, “Data gathering, surveillance and human rights: recasting the debate”. See General Assembly resolution 71/199, para. 5 (g); Human Rights Council resolution 34/7, para. 5 (g); and International Network of Civil Liberties Organizations, submission for the present report.