A/HRC/39/29 impossible to keep track of who holds what kind of information about them, let alone to control the many ways in which that information can be used. Biometric data 14. States and business enterprises increasingly deploy systems relying on the collection and use of biometric data, such as DNA, facial geometry, voice, retina or iris patterns and fingerprints. Some countries have created immense centralized databases storing such information for a diverse range of purposes, from national security and criminal investigation to the identification of individuals for purposes of the provision of essential services, such as social and financial services and education. State actors around the world deploy closed-circuit television cameras in cities, train stations or airports that use facial recognition to automatically identify and flag persons. Biometric-based technologies are increasingly used to control migration, both at borders and within countries. The creation of mass databases of biometric data raises significant human rights concerns. Such data is particularly sensitive, as it is by definition inseparably linked to a particular person and that person’s life, and has the potential to be gravely abused. For example, identity theft on the basis of biometrics is extremely difficult to remedy and may seriously affect an individual’s rights. Moreover, biometric data may be used for different purposes from those for which it was collected, including the unlawful tracking and monitoring of individuals. Given those risks, particular attention should be paid to questions of necessity and proportionality in the collection of biometric data. Against that background, it is worrisome that some States are embarking on vast biometric data-based projects without having adequate legal and procedural safeguards in place. Growing analytical power 15. The analytical power of data-driven technology continues to grow exponentially. Big data analytics and artificial intelligence increasingly enable States and business enterprises to obtain fine-grained information about people’s lives, make inferences about their physical and mental characteristics and create detailed personality profiles. Many systems used by Governments and business enterprises are built for that precise purpose — maximizing the amount of information on individuals in order to analyse, profile, assess, categorize and eventually make decisions, often automated, about them. 16. The resulting environment carries risks for individuals and societies that can hardly be overestimated. For example, recent years have seen data breaches of huge scope, exposing the persons concerned to identity theft and the disclosure of intimate information. Illegitimate data collection and analysis have been connected to the targeting of voters. Profiles, “scoring” and “ranking” of individuals can be used for assessing eligibility for health care, other insurance coverage, financial services and beyond. Opaque data-based decisions in high-stakes cases, for example in sentencing procedures and recidivism assessments, may threaten due process. Attempts to identify individuals as potential security threats in the context of predictive policing raise concerns, given the issues surrounding transparency, overbreadth, accountability and the potential for discriminatory outcomes.18 B. State surveillance and communications interception Mass surveillance 17. Many States continue to engage in secret mass surveillance and communications interception, collecting, storing and analysing the data of all users relating to a broad range of means of communication (for example, emails, telephone and video calls, text messages and websites visited). While some States claim that such indiscriminate mass surveillance is necessary to protect national security, this practice is “not permissible under international human rights law, as an individualized necessity and proportionality analysis would not be 18 See Ajay Sandhu, “Data driven policing: highlighting some risks associated with predicting crime”, Human Rights Centre, Essex University. 5