Co mm u ni cat i o n a n d Communication and I n fo rm at i o n Sector Information Sector U n i te d N at i ons United Nations Educational, Scientific and Educational, Scientific and C ultural O rganization Cultural Organization UNESCO Publishing United Nations Educational, Scientific and Cultural Organization UNESCO Publishing United Nations Educational, Scientific and Cultural Organization UNESCO Publishing United Nations Educational, Scientific and Cultural Organization The Changing Legal and Regulatory Ecology Shaping the Internet FREEDOM OF CONNECTION FREEDOM OF EXPRESSION William H. Dutton • Anna Dopatka • Michael Hills • Ginette Law • Victoria Nash Global survey on internet privacy and freedom of expression Toby Mendel • Andrew Puddephatt • Ben Wagner • Dixie Hawtin • Natalia Torres internet privacy and freedom of expression UNESCO SERIES ON INTERNET FREEDOM UNESCO SERIES ON INTERNET FREEDOM Communication and Information Sector United Nations Educational, Scientific and Cultural Organization U NESCO, as enshrined in its Constitution, promotes the “free ow of ideas by word and image”, and has committed itself to enabling a free, open and accessible Internet space as part of promoting comprehensive freedom of expression online and ofine. We hope that this publication will provide UNESCO Member States and other stakeholders, national and international, with a useful reference tool. It is our wish that this publication will contribute to bringing stakeholders together for informed debate on approaches that are conducive to privacy protection without compromising freedom of expression. In the coming years, UNESCO will specically seek to disseminate information about good practices and international collaboration concerning the points of intersection between freedom of expression and privacy. Research on safeguarding the principle of freedom of expression in Internet policy across a range of issues will continue to be part of UNESCO’s normative mandate and technical advice to stakeholders. Jānis Kārkliņš Assistant Director-General for Communication and Information, UNESCO Toby Mendel • Andrew Puddephatt • Ben Wagner • Dixie Hawtin • Natalia Torres Toby Mendel • Andrew Puddephatt • Ben Wagner • Dixie Hawtin • Natalia Torres INTERNET PRIVACY AND FREEDOM OF EXPRESSION UNESCO SEriES ON iNtErNEt FrEEdOm Authors • AndrewPuddephatt,Director,GlobalPartners&Associates • TobyMendel,ExecutiveDirector,CentreforLawandDemocracy • BenWagner,Researcher,EuropeanUniversityInstitute • DixieHawtin,ProjectManager,GlobalPartners&Associates • NataliaTorres,Researcher,CenterforStudiesonFreedomofExpressionandAccess toInformation(CELE)oftheUniversityofPalermo,Argentina Advisory Board • EduardoBertoni,Director,CenterforStudiesonFreedomofExpressionandAccess toInformation(CELE),UniversityofPalermo,Argentina • GamalEid,Director,ArabicNetworkforHumanRightsInformation,Egypt • SinfahTunsarawuth,Independentmedialawyer,Thailand • SunilAbraham,DirectorofCentrefortheInternetandSociety,India • GraceGithaiga,IndependentresearcherandKictanet,Kenya • JoeMcNamee,AdvocacyCoordinator,EuropeanDigitalRights • Katitza Rodriguez, International Rights Director, Electronic Frontier Foundation, UnitedStatesofAmerica • Cynthia Wong, Attorney, Center for Democracy and Technology, United States of America With special thanks to the following who kindly agreed to be interviewed for this publication: GuoLiang,YangWang,CerenUnal,AngPengHwa,ErickIriarteAhon,KatitzaRodriguez, KarenReilly,AliG.Ravi,MoezChackchouk,PrimaveradeFilippi,PeterParycek,Robert Bodle, SameerPadania, Peter Bradwell,UlrikeHöppner,EduardoBertoni,Hong Xue, Monique Fanjoy, Abu Bakar Munir, Joe McNamee, Amr Gharbeia, Jamie Horsley, NepomucenoMalaluan,CynthiaM.Wong,SinfahTunsarawuth,PrimOtvanDaalen,Sunil Abraham,andanumberofanonymousformeremployeesoflargetechnologycompanies. Publishedin2012by theUnitedNationsEducational, ScienticandCulturalOrganization 7,placedeFontenoy,75352Paris07SP,France ©UNESCO2012 Allrightsreserved ISBN978-92-3-104241-6 Thedesignationsemployedandthepresentationofmaterialthroughoutthispublicationdonotimplythe expressionofanyopinionwhatsoeveronthepartofUNESCOconcerningthelegalstatusofanycountry, territory,cityorareaorofitsauthorities,orconcerningthedelimitationofitsfrontiersorboundaries. Theideasandopinionsexpressedinthispublicationarethoseoftheauthors;theyarenotnecessarily thoseofUNESCOanddonotcommittheOrganization. TypesetandprintedbyUNESCO ThispublicationwasrstprintedthankstothecontributionoftheSwedishInternationalDevelopment CooperationAgency(Sida) Printed in France CONTENTS FOREWORD 5 EXECUTIVE SUMMARY 7 1. INTRODUCTION 9 1.1 How has the Internet changed the nature of threats to privacy? What are the main threats in the digital age? 12 1.1.1 New types of personal information 14 1.1.2 Collection and location of personal information 14 1.1.3 New capacities for private actors to analyse personal information 15 1.1.4 New capacities for governments to analyse personal information 17 1.1.5 New opportunities for commercial use of personal data 19 2. GLOBAL OVERVIEW OF CHALLENGES AND OPPORTUNITIES FOR PRIVACY PROTECTION ON THE INTERNET 22 2.1 Key issues 22 2.1.1 Challenges and opportunities for maintaining control over personal data online 22 2.1.2 Initiatives to protect privacy and anonymity online 24 2.1.3 The roles and responsibilities of service providers and intermediaries 26    2.2.1 Cloud computing 29 2.2.2 Search engines 31 2.2.3 Social networks 33       2.3 Threats posed by different mechanisms of surveillance and data collection 39       2.3.3 Deep packet inspection (DPI) 42 2.3.4 Pervasive geo-location technology: an emerging threat to Internet privacy 44 2.3.5 Data processing and facial recognition 45 2.3.6 Internet surveillance technology 47 3. THE GLOBAL LEGAL AND REGULATORY ENVIRONMENT   3.1 International protection for privacy and personal data 52 3.1.1 Privacy 52 3.1.2 Data protection 63 3.2 National protection for privacy 74 3.2.1 China 74 3.2.2 India 78    3.2.4 France 81 3.2.5 Argentina 84 3.2.6 Mexico 85 3.2.7 United States of America 87    3.2.9 South Africa 91 3.3 Corporate initiatives 92   AND FREEDOM OF EXPRESSION 95 4.1 The impact of poor protection for privacy on freedom of expression 95 4.2 Tensions between freedom of expression and privacy 97 4.2.1 The public interest 98                            5.2 Corporate policy and practice 112 5.3 Awareness raising 115 6. USEFUL RESOURCES 117 6.1 General 117    6.3 Arab states 121    6.5 Latin America and the Caribbean 124 6.6 Europe and North America 125 6.7 Gender 127 BIBLIOGRAPHY 129 INTERVIEWS 138   APPENDIX 2: LIST OF FIGURES AND BOXES 142 5 FOREWORD UNESCO,asenshrinedinitsConstitution,promotesthe“freeowofideasbywordand image”,andhascommitteditselftoenablingafree,openandaccessibleInternetspace aspartofpromotingcomprehensivefreedomofexpressiononlineandofine. Asdemonstratedby UNESCO’s2011publicationFreedom of Expression: Freedom of Connection, the Changing Legal and Regulatory Ecology Shaping the Internet,freedom is not the inevitable by-product of technical change, and it must be safeguarded by appropriatelegalandregulatorymeasures.Atatimeofrapidchange,wearefullyaware thatfreedomofexpressiononInternetiscomplex,andthatthismeansworkingtond a balancebetween this rightand other, sometimes conicting,imperatives – suchas nationalsecurity,protectionofauthors’rights,andrespectforprivacy. UNESCO approaches these issues within the framework of the follow-up process to the World Summit of Information Society and our activities in relation to the Internet GovernanceForum. WeknowwellthatwenowliveinaworldwithtwobillionInternetusersandvebillion mobilephoneusers,whoarepostingmillionsofpublicblogs,tweets,images,podcasts, aswellastheirpersonalinformationondailybasis. Inthiscontext,UNESCOhasrecognisedthatprivacy,asafundamentalright,impactson otherrightsandfreedoms,includingfreedomofexpression,associationandbelief.The challengeisthatmechanismstoprotectonlineprivacycansometimesbeusedtoinfringe legitimatefreedomofexpressionin generalandthe democraticrolesofjournalismin particular. Anadditionalchallenge inbalancing these rightson theInternetlies in the discrepancyofthelegalframeworksbetweenonlineandoff-lineterritories,aswellas nationalandinternationaljurisdictions. Withallthisinmind,thispublicationseekstoidentifytherelationshipbetweenfreedom ofexpressionandInternetprivacy,assessingwheretheysupportorcompetewitheach other in different circumstances. The publication maps out the issues in the current regulatorylandscapeofInternetprivacyfromtheviewpointoffreedomofexpression.It providesanoverviewoflegalprotection,self-regulatoryguidelines,normativechallenges, andcasestudiesrelatingtothetopic. Providing up-to-date and sharp information on emerging issues relevant to both developedanddevelopingcountries,wehopethatthispublicationwillprovideUNESCO MemberStatesandotherstakeholders,nationalandinternational,withausefulreference tool.Multiplestakeholders,preferablyindialogue,canusethispublicationintheirown spheres of operation, adapting where appropriate from the range of experiences as recordedinthesepages.Thepublicationalsosuppliesadditionalsourcesofreferencefor interestedreaderstousetofurtherinvestigateeachofthesubjectshighlighted. Itisourwishthatthispublication willcontributetobringingstakeholderstogetherfor informed debate on approaches that are conducive to privacy protection without compromising freedom of expression. In the coming years, UNESCO will specically 6 seek to disseminate information about good practices and international collaboration concerning the points of intersection between freedom of expression and privacy. ResearchonsafeguardingtheprincipleoffreedomofexpressioninInternetpolicyacross arangeofissueswillcontinuetobepartofUNESCO’snormativemandateandtechnical advicetostakeholders. Jānis Kārkliņš Assistant Director-General for Communication and Information UNESCO 7 EXECUTIVE SUMMARY Privacyisafundamentalright,eventhoughitisdifculttodeneexactlywhatthatright entails.Privacycanberegardedas havinga dualaspect –it isconcernedwithwhat informationorsideofourliveswecankeepprivate;andalsowiththewaysinwhichthird partiesdealwiththeinformationthattheyhold–whetheritissafeguarded,shared,who hasaccessandunderwhatconditions. Understandingsofprivacyhavelongbeenshapedbythetechnologies available,with earlyconcernsaboutprivacysurfacingwithnewspapersinthenineteenthcentury.So theInternet,inturn,inevitablyreshapeswhatweunderstandprivacytobeinthemodern world. Therighttoprivacyunderpinsotherrightsandfreedoms,includingfreedomofexpression, associationand belief.Theabilitytocommunicateanonymouslywithoutgovernments knowingouridentity,forinstance,hashistoricallyplayedanimportantroleinsafeguarding free expression and strengthening political accountability, with people more likely to speakoutonissuesofpublicinterestiftheycandosowithoutfearofreprisal.Atthe sametime,therighttoprivacycanalsocompetewiththerighttofreedomofexpression, andinpracticea balancebetweentheserights iscalledfor.Strikingthis balanceisa delicatetask,andnotonethatcaneasilybeanticipatedinadvance.Forthisreasonithas longbeenaconcernofthecourtstomanagethisrelationship. TheInternetpresents signicantnew challengesfor protectingtheright toprivacy.In broadterms,theInternet: • Enablesthecollectionofnewtypesofpersonalinformation–technologicaladvances haveresultedintoolsforcollectingandunderstandingtypesofinformationwhichin thepastwouldhavebeenimpossibleorunfeasible. • Facilitates the collection and location of personal information – each computer, mobilephoneorotherdeviceattachedtotheInternethasauniqueIPaddress,which providesuniqueidentierforeverydeviceandwhichmeansinturnthattheycanbe traced.Theabilitytolocateanydevicecreatessignicantnewprivacychallenges. • Creates new capacities for government and private actors to analyse personal information.Increasedcomputingpowermeansthatvastquantitiesofinformation, once collected,can be cheaplyandefciently stored,consolidated and analysed. Technological advances allow databases of information to be connected together allowingevengreaterquantitiesofdatatobeprocessed. • Createsnewopportunitiesforcommercialuseofpersonaldata.Manyoftheservices providedbythesecompaniesarefreeandtheirbusinessmodelsrelyoncollecting userinformationandusingitformarketingpurposes. • CreatesnewchallengesforregulationgiventhetransnationalnatureoftheInternet. Despitetheemergenceofinternationalbestpracticestandardsfordataprotection, thereisstillmuchprogresstobemadetowardstheharmonisationofnationallaws. Online companies still nd it hard to navigate the complex patchworkofnational 8 privacy laws when operating international Internet services that span national boundaries,withlegalambiguityunderminingprivacyprotection. ArangeofthreatstoprivacywhichhavedevelopedthroughtheInternetareconsideredin moredetailinSection2ofthepaper.Thefollowingissuesareexplored: (1) Theopportunitiesandchallengesformaintainingcontroloverpersonaldataonline. (2) Arangeofinitiativestoprotectprivacyandanonymityonline. (3) Therolesandresponsibilitiesofserviceprovidersandintermediaries. (4) Thespecicchallengesposedbydifferentapplications,communicationsplatforms and businessmodelsincluding cloud computing,searchengines,social networks andotherdifferentdevices. (5) Theproblemsposedbye-governmentandothergovernmentapproaches. (6) Thethreatsposedbydifferentmechanismsofsurveillanceanddatacollectionincluding: Unique Identiers; Cookies (and other associated forms of user identication); Adware;SpywareandMalwareconductcovertdataloggingandsurveillance;Deep packetinspection(DPI);anddataprocessingandfacialrecognitionandsurveillance technology. International legalstandardsonprivacy,andresponsestotheseemergingissues,are exploredinSection3.Thesectionsetsouttheexplicitunderstandingsandprotections fortherighttoprivacyunderinternationalhumanrightslaw.Thesectionthenanalyses keylegislationandregulatoryframeworksthatimpactontheprotectionofprivacyrights onlineattheregionalandnationallevelincountriesacrosstheworld;andfurthermore analysesthestrengthsandweaknessesofself-regulationasaprivacyprotectiontool– whetheritbeusedasacentralmechanism,orsupplementarytolegalprotections. Therightstoprivacyandfreedomofexpressionrelatetoeachotherincomplexways – Section 4 explores these intersections in greater detail. In some ways privacy is a necessarypreconditionforfreedomofexpression–thisisespeciallytrueincountries whereitmaybedangeroustodiscusscertainissues(suchaspolitics,religionorsexuality) openly.Howevertherearealsosignicanttensionsbetweenthetworights,forexample whereanewspaperwishestopublishprivatedetailsaboutaleadingpolitician,perhaps becausethenewspaperbelievesthisisinthepublicinterest.Thesetensionshavecome intofargreaterprominencewiththemassivechangesinfreedomofexpressionbrought aboutbytheInternetandotherdigitalcommunicationssystems. The paper explores international law and the practice of other States, in terms of respecting privacy on the Internet, taking into account potential conicts with other rights,inparticularfreedomofexpression.Section5containsourrecommendationsto statesandcorporationsforbetterpracticebasedonourresearchandconsultations.The recommendationscover: legal andregulatorymeasures(constitutionalmeasures,civil lawprotection,criminallawprotection,dataprotectionsystems),corporatepolicyand practiceandawarenessraising. Finally,Section6providesanoverviewofliterature,backgroundmaterialandtoolson internationalandnationalpolicyandpracticeonprivacyandfreedomofexpressionon theInternet.Thissectionisintendedasaresourceforreaderswhowishtoaccessfurther instruments,toolsandinformation. 9 1. INTRODUCTION Theneed forprivacyis deep-rootedin humanbeings.In itsessentialform, privacyis basedonthenotionofpersonalintegrityanddignity.However,thisisalsohardtodene with any agreedprecision – indifferent contexts it embraces the right to freedom of thoughtandconscience,therighttobealone,therighttocontrolone’sownbody,the righttoprotectyourreputation,therighttoafamilylife,therighttoasexualityofyourown denition.Inadditionthesemeaningsvaryfromcontexttocontext.Despiteitsubiquity thereisnoonedenitionofprivacythatisuniversallyunderstoodinthesameway.Privacy inthemodernworldhastwodimensions–rstly,issuestodowiththeidentityofaperson andsecondly,thewaytheirpersonalinformationishandled. Understandingsofprivacyhavelongbeenshapedbyavailabletechnologies.Atthemost obviouslevelprivacyinvolvesrestrictinginvasionsofphysicalspace,andtheprotection of home and personal possessions, which is why early privacy protections focused upon the inviolability of the home and family life. Concerns about controlling what informationisknownaboutapersoncamewithcommunicationtechnologies.Concerns abouttheerosionofprivacyarenotnew–infact,itmightbearguedtheyarefeatureof thetwentiethcentury.WarrenandBrandeis’ seminalpaper on“TheRight toPrivacy” in 1890, draftedata time when newspapers were printing pictures of peopleforthe rsttime,denedtherightasthe“righttobeleftalone”.Theirdenition–drivenbyan emergingtechnologyasisoftenthecasewithprivacy–wasconcernedwithprotecting the“inviolatepersonality”andencompassingsuchvaluesasindividualdignity,personal autonomyandindependence. 1 Thegrowthofmodernmassmediaandtheadvertising industry’sfocusonunderstandingconsumers’wantsledMyronBrentontoarguethatwe arelivinginthe“ageofthegoldshbowl”,whereprivatelivesaremadepublicproperty bythemanipulationandexchangeofpersonaldata. 2 Thereisatensionbetweentherighttofreedomofexpression–inparticularthemedia’s exerciseoftheright–andtherighttoprivacy.Freedomofexpression,whetherexercised byindividualsorbythemedia,andtheabilitytoexerciseit,isanessentialfeatureofany open,liberalanddemocraticsociety.Itisonlythroughexercisingfreeexpressionthat societies cansustainreal democraticaccountability.Howeverthe right tofreedom of expressionisnotunlimitedanditcanbequaliedtoprotecttherightsandfreedomsof others.Itisadelicatebalancetodecidewheretheboundarybetweenfreeexpression andprivacyliesbutonethecourtsareusedtonegotiating. Latterly,privacywasalsodenedastherightofpeopletodeterminewhen,howandto whatextentinformationabout themiscommunicatedto others 3 asaresponseto the growingprocessingpowerofcomputers.Privacy,accordingtoWestin“istheclaimof individuals,groups,orinstitutionstodetermineforthemselveswhen,how,andtowhat extentinformationaboutthemiscommunicatedtoothers [Itis]thedesireofpeopleto 1 Bloustein, E. (1964) Privacy as an aspect of human dignity: an answer to Dean Prosser 39 NYU L Rev 962 2 Brenton, M (1964) The Privacy Invaders 3 Westin AF (1967) Privacy and Freedom New York: Atheneum, page 7 [...]... experts and civil society alike that a substantial expansion in the use of strong encryption technologies among Internet users would have a highly positive impact on privacy and anonymity on the Internet (III) Corporate initiatives promoting freedom of expression and privacy: the Global Network Initiative Separately from citizen’s initiatives, one of the most prominent self-regulatory initiatives among Internet. .. transnational environment is a major challenge for policy makers In broad terms, the Internet: • Enables the collection of new types of personal information • Facilitates (and economically demands) the collection and location of personal information • Creates new capacities for government and private actors to analyse personal information • Creates new opportunities for commercial use of personal data... protections for users 2.2.4 Mobile phones, smartphones and the mobile Internet The explosion of the use of the mobile Internet in the 21st century has contributed to many of the existing concerns about privacy and data protection on mobile phone networks In comparison with fixed line communications, mobile communications have several attributes which have a particularly negative effect on privacy These... articulated in terms of its instrumentality Democracy and liberty rely on individuals having a certain degree of privacy The right to privacy underpins many human rights, the right to freedom of association, freedom of belief and freedom of expression being particularly significant examples As one writer puts it “in one sense, all human rights are aspects of the right to privacy ,13 in that if privacy is protected... public figures and their rights to control their personal data Fifth, the problematic role of public authorities’ surveillance of the Internet remains difficult Lastly, the appropriateness of anonymity and pseudonymity online represent an important component in the overall debate on privacy protection on the Internet While all of these questions are intimately linked to information privacy, they also... constitutional rights to privacy, as they do in Canada, France, Germany, 4 Ibid 5 Beresford A and Stajano F (2003) Location Privacy in Pervasive Computing, IEEE Communications Society 6 Privacy International, (2006) Privacy and Human Rights 2006: An International Survey of Privacy Laws and Developments 11 Japan, and India.7 Some census agencies have privacy policies to ensure the protection of personal... The digitalisation of information and expectation of free access makes traditional forms of income generation more complex on the Internet Successful companies therefore consciously “mine” personal data in order to target advertising at users There is therefore a direct and powerful economic incentive to secure, retain and share personal data This also applies to non -Internet electronic activity Computerised... Challenges and opportunities for maintaining control over personal data online “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation Everyone has the right to the protection of the law against such interference or attacks.” – Article 12, Universal Declaration of Human Right Protection of privacy has long been... clicking ‘Accept’ and consenting to providing their data without spending any meaningful amount of time reading the terms of service or privacy policy of the respective site The tension between rights and actual control capacity of Internet users over their personal data has led to extensive debates about privacy on the Internet These debates typically focus on the lack of user control and empowerment... agreement, diffusion of personal data is such that it may quickly move beyond the capacity of any one actor to control (see inset below for further details) Fourth, user rights to control their personal data may conflict with other rights, such as the right of another individual to freedom of expression As is discussed in the inset below about Visual Privacy and Edison Chen, there are frequent conflicts between . FREEDOM OF EXPRESSION 95 4.1 The impact of poor protection for privacy on freedom of expression 95 4.2 Tensions between freedom of expression and privacy 97 4.2.1. and regulatorymeasures(constitutionalmeasures,civil lawprotection,criminallawprotection,dataprotectionsystems),corporatepolicy and practice and awarenessraising. Finally,Section6providesanoverview of literature,backgroundmaterial and tools on international and nationalpolicy and practice on privacy and freedom of expression on the Internet. Thissectionisintendedasaresourceforreaderswhowishtoaccessfurther instruments,tools and information. 9 1.