IGF 2021 WS #197 Protecting human rights in the State-business nexus

The session’s content related to Pillar 1 (the State duty to protect human rights) and Pillar 2 (the corporate responsibility to respect human rights) of the United Nations Guiding Principles on Business and Human Rights (UNGPs), within the context of State and technology company collaboration.

One aspect within the State-business nexus is public procurement, within which is the phenomenon of public-private partnerships (also referred to as PPPs). Privacy International (PI) has conducted investigations identifying a number of issues common to PPPs that involve surveillance technologies and the mass processing of data. PI has developed a set of safeguards in response to these issues and trends, which they launched in the session.

The safeguards reflect observations that PPPs related to surveillance technologies do not always resemble a traditional, one-off commercial relationship that might result from a public tender, but take on a new form in which parties are much more co-dependent and states build entire new systems and processes that can be completely reliant on the services of one company, while providing companies with access to valuable data they can they use in developing their own services.

The safeguards (which are jurisdiction-blind for wide application) are classified across six principles: Transparency; Adequate Procurement; Accountability; Legality, Necessity and Proportionality; Oversight; and Redress. Lucie Audibert of PI explained how in their investigations they’ve found a lack of transparency is common in State partnerships with technology companies, stemming from excessive protections around commercial interests and a government tendency to mask the extent of surveillance systems. The organisation also found that such technologies are often deployed initially for private, commercial, or personal purposes before public authorities co-opt such applications for policing or surveillance purposes without adhering to required public procurement processes, which the safeguards can help prevent. 

With regards to accountability, Audibert showed how challenging it is to find policies that clearly define responsibilities, obligations, duties, and standards for each actor within partnerships, or to identify respective accountability mechanisms for these obligations. On legality, necessity and proportionality, the use of technology addressing a public need or fulfilling a public function has to be authorised by an appropriate legal framework, which is not always the case. Assessments of each, along with independent oversight bodies given the mandate and authority to monitor partnerships and offer redress in instances of human rights infringements, make up some of the measures the safeguards propose to correct troublesome trends in PPPs involving surveillance technologies.

Deniz Utlu of the German Institute for Human Rights outlined the activities of national human rights institutions (NHRIs), which are neither governmental nor non-governmental organisations. He explained how NHRIs can serve as an intermediary between different state agencies to establish whether the agencies sufficiently follow a human rights-based approach to establishing PPPs or in other public procurement procedures, and to monitor if they align with States’ human rights obligations when using data technology interfering with technology companies. NHRIs can also undertake human rights impact assessments and artificial intelligence assessments, for which they could provide a crucial function if systematically involved in public procurement procedures and in the establishment of any strategic relationship with private actors.

Théo Jaekel of Ericsson explained how his company is a ‘communication network provider,’ providing infrastructure through its customers which are usually communication service providers or mobile operators, meaning Ericsson rarely deals directly with government entities – but does interact with them as they are often the end-users of some of the company’s technology. Reflecting on the issue of transparency, he noted the importance of clarifying the roles of the different actors within the ICT ecosystem, to make sure each actor takes its particular position, responsibilities and expectations seriously. On the state-business nexus, Jaekel stressed the importance of differentiating between States’ duty to protect and the corporate responsibility to respect human rights – with the corporate responsibility to respect human rights existing regardless of a State’s ability or willingness to comply with its duty to protect human rights. He urged caution on not blurring these lines too much, where State duties could easily be applied to companies. In thinking through remedy and redress, he suggested the technology sector can learn lessons from other industries such as the financial sector in designing remedy in an ecosystem approach.

Moira Oliver of Vodafone echoed the importance of understanding different relationships within the State and technology company ecosystem, particularly as it affects each actor’s responsibilities. She explained how when Vodafone operates in different countries it does so under a State license, which contains contractual obligations but tends to be non-negotiable for the company, and requires complying with local laws. This can create challenging circumstances for private companies and operators when asked to comply with regulations (such as law enforcement demands) that may infringe upon human rights. For example, an operator may be required to comply with a local directive to either pass certain customer data to the local government or to throttle the network. Vodafone joined the Global Network Initiative to highlight such challenges. With transparency, it’s critical to shine a light on some of these challenges – Vodafone has issued transparency reports since 2014 for this purpose.

Sebastian Smart of the Instituto Nacional de Derechos Humanos de Chile (Chile’s NHRI) shared his experience on the application of the UNGPs in Chile. He suggested the ecosystem has changed since the formation of the UNGPs in 2011, the time of the Arab Spring and Occupy movement. In recent years other threats to human rights have grown, from the activities of companies and governments related to freedom of expression, surveillance, and automated decision-making for social programmes (or the “digital welfare state”). Accordingly the UNGPs should provide the foundation to build further mechanisms protecting and promoting human rights in the digital environment. In Chile, the country’s recent strategy on artificial intelligence (AI) makes minimal reference to human rights, a glaring absence. Smart expressed concern about ensuring policy coherence, and reiterated that States are sub-contracting increasingly technical services that may have consequences for human rights, for which governments must exercise proper oversight.