The Right to Privacy in the Digital Age

A/HRC/RES/42/15View PDF

Who adopted this document and its mandates?

A Resolution of the Human Rights Council, under agenda item 3 Promotion and protection of all human rights, civil, political, economic, social and cultural rights, including the right to development, published in 2019.

What other versions does this mandate have?

11 versions · 2014–2024

This is an older version — the most recent is A/RES/79/175

Year	Symbol	Title	Word length	Text similarity
2024	A/RES/79/175	The right to privacy in the digital age	5,325	81%Compare
2023	A/RES/77/211	The right to privacy in the digital age	4,500	79%Compare
2020	A/RES/75/176	The right to privacy in the digital age	3,702	36%Compare
2019	A/HRC/RES/42/15	The right to privacy in the digital age	2,872	27%Compare
2019	A/RES/73/179	The right to privacy in the digital age	2,876	7%Compare

What subjects does this mandate have?

13 subjects

Artificial Intelligence Business Enterprises Communication Technology Conferences Corporate Social Responsibility Crime Prevention Data Protection Digital Technology Electronic Surveillance Information Technology Internet Laws and Regulations Right to Privacy

What’s in this document?

31 operative paragraphs

Reaffirms the right to privacy, according to which no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, and the right to the protection of the law against such interference, as set out in article 12 of the Universal Declaration of Human Rights and article 17 of the International Covenant on Civil and Political Rights;

Recalls that States should ensure that any interference with the right to privacy is consistent with the principles of legality, necessity and proportionality;

Recognizes the global and open nature of the Internet and the rapid advancement in information and communications technology as a driving force in accelerating progress towards development in its various forms, including in achieving the Sustainable Development Goals;

Affirms that the same rights that people have offline must also be protected online, including the right to privacy;

Acknowledges that the use, deployment and further development of new and emerging technologies, such as artificial intelligence, can impact the enjoyment of the right to privacy and other human rights, and that the risks to the right to privacy can and should be minimized by adopting adequate regulation or other appropriate mechanisms, including by taking into account international human rights law in the design, development and deployment of new and emerging technologies, such as artificial intelligence, by ensuring a safe, secure and high-quality data infrastructure and by developing human-centred auditing mechanisms, as well as redress mechanisms;

Calls upon all States:

To respect and protect the right to privacy, including in the context of digital communications;

To take measures to end violations and abuses of the right to privacy and to create the conditions to prevent such violations and abuses, including by ensuring that relevant national legislation complies with their obligations under international human rights law;

To review, on a regular basis, their procedures, practices and legislation regarding the surveillance of communications, including mass surveillance and the interception and collection of personal data, as well as regarding the use of profiling, automated decision-making, machine learning and biometric technologies, with a view to upholding the right to privacy by ensuring the full and effective implementation of all their obligations under international human rights law;

To ensure that any measures taken to counter terrorism and violent extremism conducive to terrorism that interfere with the right to privacy are consistent with the principles of legality, necessity and proportionality, and comply with their obligations under international law;

To establish or maintain existing independent, effective, adequately resourced and impartial judicial, administrative and/or parliamentary domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception and the collection of personal data;

To develop or maintain and implement adequate legislation, with effective sanctions and remedies, that protects individuals against violations and abuses of the right to privacy, namely through the unlawful or arbitrary collection, processing, retention or use of personal data by individuals, Governments, business enterprises and private organizations;

To consider adopting or reviewing legislation, regulations or policies to ensure that business enterprises fully incorporate the right to privacy and other relevant human rights into the design, development, deployment and evaluation of technologies, including artificial intelligence, and to provide individuals whose rights may have been violated or abused with access to an effective remedy, including reparation and guarantees of non-repetition;

To further develop or maintain, in this regard, preventive measures and remedies for violations and abuses regarding the right to privacy in the digital age that may affect all individuals, including where there are particular effects for women, and children and persons in vulnerable situations or marginalized groups;

To promote quality education and lifelong education opportunities for all to foster, inter alia, digital literacy and the technical skills required to protect effectively their privacy;

To refrain from requiring business enterprises to take steps that interfere with the right to privacy in an arbitrary or unlawful way, and to protect individuals from harm, including that caused by business enterprises through data collection, processing, storage and sharing and profiling, and the use of automated processes and machine learning;

To consider appropriate measures that would enable business enterprises to adopt adequate voluntary transparency measures with regard to requests by State authorities for access to private user data and information;

To develop or maintain legislation, preventive measures and remedies that address damage caused by the processing, use, sale or multiple resale or other corporate sharing of personal data without the individual’s free, explicit and informed consent;

To take appropriate measures to ensure that digital or biometric identity programmes are designed, implemented and operated with appropriate legal and technical safeguards in place and in full compliance with international human rights law;

Encourages all States to promote an open, secure, stable, accessible and peaceful information and communications technology environment based on respect for international law, including the obligations enshrined in the Charter of the United Nations and international human rights instruments;

Encourages all business enterprises, in particular business enterprises that collect, store, use share and process data:

To meet their responsibility to respect human rights in accordance with the Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework, including the right to privacy in the digital age;

To inform users about the collection, use, sharing and retention of their data that may affect their right to privacy and to establish transparency and policies that allow for the informed consent of users, as appropriate;

To implement administrative, technical and physical safeguards to ensure that data are processed lawfully, and to ensure that such processing is necessary in relation to the purposes of the processing and that the legitimacy of such purposes, and the accuracy, integrity and confidentiality of the processing, are ensured;

To ensure that individuals have access to their data, and the possibility to amend, correct, update and delete the data, in particular if the data are incorrect or inaccurate, or if the data were obtained illegally;

To ensure that the respect for the right to privacy and other relevant human rights is incorporated into the design, operation, evaluation and regulation of automated decision-making and machine-learning technologies, and to provide compensation for human rights abuses that they have caused or to which they have contributed;

To put in place adequate safeguards that seek to prevent or mitigate adverse human rights impacts that are directly linked to their operations, products or services, including where necessary through contractual clauses, and promptly inform relevant domestic, regional or international oversight bodies of abuses or violations when misuse of their products and services is detected;

Encourages business enterprises to work towards enabling technical solutions to secure and protect the confidentiality of digital communications, which may include measures for encryption and anonymity, and calls upon States not to interfere with the use of such technical solutions, with any restrictions thereon complying with States’ obligations under international human rights law;

Requests the United Nations High Commissioner for Human Rights to organize, before the forty-fourth session of the Human Rights Council, a one-day expert seminar to discuss how artificial intelligence, including profiling, automated decision-making and machine-learning technologies may, without proper safeguards, affect the enjoyment of the right to privacy, to prepare a thematic report on the issue and to submit it to the Council at its forty-fifth session;

Encourages States, relevant United Nations agencies, funds and programmes, intergovernmental organizations, treaty bodies, the special procedures, regional human rights mechanisms, civil society organizations, academia, national human rights institutions, business enterprises, the technical community and other relevant stakeholders to participate actively in the expert seminar;

Decides to continue its consideration of the matter under the same agenda item.

Who adopted this document and its mandates?

What other versions does this mandate have?

What subjects does this mandate have?

What’s in this document?

Table of contents