Home | Databases | WorldLII | Search | Feedback United Nations Special Rapporteur on the Right to Privacy Publications

UN Special Rapporteur on the Right of Privacy - Annual Report; Forty-third session of the UN Human Rights Council [2020] UNSRPPub 1 (12 February 2020)

Human Rights Council
Forty-third session
24 February–20 March 2020
Agenda item3
Promotion and protection of all human rights, civil,
political, economic, social and cultural rights,
including the right to development

Report of the Special Rapporteur on the right to privacy[*]^, [**]

I. Overview of Activities

1. Since March 2019, the Special Rapporteur has examined challenges arising from new technologies; undertaken official and ‘non-official’ country visits; promoted the protection of the right to privacy; advocated privacy principles; contributed to international privacy events; raised awareness on the right to privacy and effective remedies, and reported on alleged violations.
2. In October 2019, the Special Rapporteur reported to the UN General Assembly on Health-related Data Recommendation and initial ‘Privacy and Gender’ Report (A/74/277).

Multiple Communications to UN Member States

3. Throughout the year, letters and statements were issued raising matters concerning practices that appeared to be inconsistent with the right to privacy. They range from communications with the Government of Saudi Arabia concerning the use of technology and the infringement of women’s rights to privacy (Feb-June 2019) to a full set of recommendations to the Government of Malta in December 2019 and January 2020 in connection with proposals for reform of oversight of the Security Services. The Special Rapporteur is pleased to note that the mandate is receiving a growing number of requests from the governments of member States to also assist them to draft new privacy laws, including both data protection and surveillance carried out by law enforcement and intelligence services.

Task Force on Corporations

4. On 16-18 September 2019, the mandate organized its second task force meeting of the year on the Use of Personal Data by Corporations in Brussels, Belgium, following the first meeting in Malta in March. The event engaged partner civil society organisations and leading corporations including Huawei, Deutsche Telekom, Microsoft, Facebook, Apple and Google. These meetings included discussions of best practices and common challenges on topics including corporate transparency, artificial intelligence, the use of personal data, and privacy and children.

Taskforce on Privacy and Health-related Data

5. The Recommendation on Health-related Data presented to the General Assembly was developed with specialised input and extensive global consultation and has been well received. The full version of the Health-related Data Recommendation and detailed Explanatory Memorandum are available on-line.

Taskforce on ‘Privacy and Personality’

6. Following the release of the preliminary report on ‘Privacy: A Gender Perspective’ to the Human Rights Council in March 2019, consultations were opened on the preliminary report. Stakeholder feedback was instrumental during a consultation event organised in New York City, USA with the support of New York University, Facebook inc. and others, on 30-31 October 2019.
7. The mandate also provided input on privacy and gender to events organised by the UNDP in June and October 2019, and to international fora.

Children and Privacy

8. The mandate is working independently and in collaboration with the Committee of the Convention on the Rights of the Child (CRC) to develop new guidelines to protect children’s privacy. It participated in a Consultation Event on the general comment being prepared by the CRC Committee held in London, UK on 7-8 October 2019. The Special Rapporteur briefed the CRC Committee meeting in plenum in Geneva on 31 January 2020.

Visits and Events:

9. Official visits were carried out in Argentina in May 2019 and the Republic of South Korea in July 2019. The Special Rapporteur released preliminary findings at their conclusion.
10. The Special Rapporteur has undertaken study visits and attended many international events, including the African regional data protection conference in Ghana in June 2019 and the International Conference of Data Protection and Privacy Commissioners in Tirana, Albania in October 2019.

II. Security and Surveillance

International Intelligence Oversight Forum (IIOF)

11. On 8-9 October, the mandate organised the 4^th edition of the forum of the IIOF in the United Kingdom. Over 170 registered delegates (from independent oversight agencies, parliamentary committees, and intelligence services in over 40 countries) engaged in candid discussions about best practices to improve the protection of privacy through the oversight of surveillance.
12. The Special Rapporteur thanks the Government of the United Kingdom for its crucial support. . He encourages all member States to respond to the invitations extended through their Permanent Missions in Geneva and participate in IIOF. The next gathering is scheduled for late October 2020.

Encryption

13. The Special Rapporteur is working on a multi-stakeholder initiative in response to some nations’ well-intentioned but fatally-flawed calls to corporations to weaken or halt individual access to strong encryption.

Individual cases

14. The mandate has devoted significant time and resource to dealing with individual cases related to surveillance including those initiated by complaints from Mr. Julian Assange and President Lenin Moreno. The mandate’s investigations are ongoing and shall be reported upon separately as, and when, appropriate.

III. Gender Equality in the Right to Privacy

15. Everyone, irrespective of their biological sex, sex characteristics, sexual orientation or gender identity and expression, is entitled to the full enjoyment of the right to privacy. For some, their gender^[1] entails a particular reliance upon States and non-State actors to facilitate access to their right to privacy, and to protect them from infringements.
16. Privacy enables the full development of the person, while protecting against harms that stunt human development, innovation and creativity, such as violence; discrimination; and the loss of freedom of expression, association and peaceful assembly.
17. Privacy and gender have long been regarded as second-order considerations but their complex impact upon society is of critical importance. Recognising this significance is imperative to deliver the pledge of the 2030 Agenda for Sustainable Development to leave no one behind and to reach the furthest behind first.
18. The mandate requires the integration of gender in all its work. The Special Rapporteur has incorporated gender in Thematic Action Stream Taskforces and has sought a better understanding of privacy from a gender perspective.
19. The work undertaken^[2] reveals deeply disturbing infringements of privacy related to, or arising from individuals’ gender:
    • (a) Gender-based breaches of privacy are a systemic form of denial of human rights, discriminatory, in nature and frequently perpetuating unequal social, economic, cultural and political structures;
    • (b) These harms extend beyond individuals to impact society as a whole. Losses of privacy weaken the universality of human rights and corrode societies and democracy;
    • (c) Gender and factors such as ethnicity, beliefs, culture, social origins, age, economic self-sufficiency, legal and political frameworks serve to mold experiences of privacy;
    • (d) Privacy infringements happen in multiple, interrelated and recurring forms facilitated by digital technologies, in both private and public settings across physical and national boundaries. Online privacy infringements, reflect and extend offline privacy infringements. Digital technologies amplify their scope and intensify their impact;
    • (e) Privacy offers protection against gender-based violence discrimination, and other harms that disproportionately affect women, intersex and gender non-conforming individuals;
    • (f) The actions and responses of States and non-State actors to incursions into privacy based on gender were reported as weakly supportive through to punitive, with a few notable exceptions;
    • (g) Remedial actions to address gender-based breaches of privacy, are needed at international, regional and domestic levels. Preventive strategies only addressing the behaviours of individuals were ineffective.
20. A robust international ‘privacy and gender’ framework was identified as comprising:
    • (a) All UN entities and special procedures and other mechanisms of the Human Rights Council and treaty bodies integrating gender and privacy in their respective mandates;
    • (b) Collaboration between States, companies, religious bodies, civil society, human rights institutions, professional organisations as well as individuals, to secure the benefits for all, regardless of gender, of the right to privacy;
    • (c) Recognition that for those vulnerable due to their gender, the interrelationship between privacy and other rights such as freedom of assembly and of expression, is heightened;
    • (d) A contemporary understanding of ‘gender’ based on recognition that:

(i) cis-normativity; biological sex; sexual orientation and expression gender identity and expression, and sex characteristics, and societal norms are elements of gender;

(ii) gender, for some individuals, can change throughout their life;

(iii) gender identity is integral to personality and important to self-determination, dignity and freedom;

(iv) gender intersects with ethnicity, indigeneity, age, disability, health, migration, marital or family status amongst other factors, to heighten the importance of human rights to dignity and quality of life.

(e) Promoting, designing and enforcing the right to privacy to address structural inequities will significantly increase the enjoyment of the right to privacy of those furthest behind;

(f) Assistance to State and non-State actors, and individuals to implement their responsibilities for the right to privacy; education on gender issues, and support for Civil Society Organisations (CSOs);

(g) Redress for victims of infringements of privacy based on gender.

21. There is great need for international leadership on gender equality and privacy rights. Establishing clear international directions on how to protect against gender based privacy infringements will help prevent the ongoing harms experienced by many individuals and communities round the world.
22. These findings, along with those of treaty bodies and human rights experts, have shaped the following Recommendations that aim to address this gap.

IV. Recommendations for protecting against gender based privacy infringements

23. These recommendations build upon the findings of the first report on privacy and gender published in March 2019, and subsequent consultations. The recommendations aim to ensure the right of each person, regardless of gender, to fully enjoy the right to privacy and to participate in public and private spheres, intimate decisions, and human relations, without arbitrary interference, as set down in the Universal Declaration of Human Rights (Art. 12), the International Covenant on Civil and Political Rights (Art. 17) and findings of various treaty bodies.
24. These recommendations are intended to cover both State and non-State actors and are relevant to the privacy of all individuals, inclusive of binary female and male, and individuals of diverse sexual orientation, gender identity, gender expression and sex characteristics.
25. Their implementation should be informed by consideration of other internationally-recognised instruments such as the Convention on the Elimination of all Forms of Discrimination Against Women, the Convention on the Rights of the Child, the Yogyakarta Principles updated and the Rights of Indigenous Peoples, amongst other instruments.
26. Nothing in these recommendations should be interpreted as restricting or in any way limiting the rights and freedoms of individuals as recognised in international, regional or domestic laws or standards. Nor are the provisions designed to restrict the collection of sex and gender information where this data is necessary for the performance of lawful responsibilities.

1. Development of personality and the person

27. State and non-State Parties to:
    • (a) Recognise that:

(i) the right to privacy also includes gender identity and the freedom of individuals to make autonomous decisions with regard to their bodies;

(ii) the privacy needs and aspirations of people and populations of cis-normativity, diverse sexual orientations, gender identities, gender expressions and sex characteristics while having common ground, are distinct from each other;

(iii) other factors such as disability, age, indigeneity, social origins, intersect with gender to typically intensify privacy–gender experiences;

(iv) an intersectional approach is necessary to address the gender aspects of privacy.

(b) Respect, protect and facilitate the right to privacy to enable individuals’ enjoyment of other rights such as the right to assemble and to express opinions irrespective of gender:

(i) Promote internet access for all regardless of gender, and bridge any digital gender divides through relevant mechanisms including building digital skills and appropriate online behaviour;

(ii) Reduce infringements of privacy based on gender by:

• adopting robust privacy, and data protection law and policies;
• making public commitments on addressing gender differences in the enjoyment of the right to privacy;
• running public awareness campaigns, training and continuing professional development programs with comprehensive, affirmative and accurate material on sexual, biological, physical and psychological diversity, and human rights;
• adopting all measures necessary to eliminate the stigma associated with gender diversity including ensuring internal and external communications constructively address privacy and gender issues;
• requiring gender-aware privacy impact assessments prior to the introduction of new products, services, strategies, legislation, procedures and other initiatives.

(c) Ensure requirements for individuals to provide sex/gender information:

(i) are relevant, reasonable and necessary as required by the law for a legitimate purpose in the circumstances where it is sought;

(ii) respect the right to self-determination of gender;

(iii) protect against arbitrary or unwanted disclosure or threatened disclosure of such information;

(iv) support research into the right to privacy and gender to better understand the benefits, prevention and mitigation of harms arising from infringements of privacy.

28. States to take all necessary legislative, policy, administrative and other measures in line with international human rights norms and standards, to ensure:
    • (a) all individuals have information about their civil, political, economic, social and cultural rights, in relation to gender, by:

(i) ensuring access to international and regional treaties and instruments; national constitutions, laws and regulations; research studies, reports, data, archives; reports and information submitted by the State to international and regional bodies and mechanisms; and other relevant information to enable the exercise of the right to privacy and remedy for violation of this right;

ii) providing and supporting education and public information programs to promote the right to privacy and gender inclusiveness, including relevant training of judicial and law enforcement officers and other public officials in relation to their human rights obligations regarding gender.

(b) Prevent privacy infringements based on gender whether by public or private actors, by ensuring:

(i) the applied legal bases to prevent and penalise privacy breaches align with relevant laws and treaties at global, regional and domestic levels and incorporate provisions to enhance privacy regardless of gender;

(ii) consistency between laws relating to privacy and gender, such as consumer safety, employment, healthcare, anti-discrimination and corporate regulations, amongst others;

(iii) the full inclusiveness of gender in anti-discrimination laws in relation to ‘sex characteristics’;

(iv) recognition of the responsibility to protect and warn due to patterns of extraterritorial outreach of States that violate the right to privacy;

(v) policies and procedures are up to-date and adequately serve their obligation to protect and warn, and prevent surveillance and harassment based on gender, by foreign States and non-State actors against their citizens or non- citizens on their territories;

(vi) the right to privacy of all, regardless of gender, is embedded in policy development; legislative reform; service provision; regulation; programs for CSO support, and education and training;

(vii) adoption of best practice data protection, such as the EU’s General Data Protection Regulation and the ‘modernised’ Convention 108 of the Council of Europe, or better;

(viii) comprehensive protection for secure digital communications,including by promoting strong encryption and anonymity-enhancing tools, products and services, and resisting requests for ‘backdoors’ to digital communications.

(c) Eradicate, investigate, prosecute, penalise, provide remedies for infringements of privacy based on gender by State and non-State actors, whether committed in public or private spheres, and establish support services for victims;

(d) Prevent victimisation, re-victimisation, criminalisation, on the basis of gender, by:

(i) taking action against those, State and non-State, actors who use digital technologies, to subject the users to cruel and degrading treatment, extortion or blackmail;

(ii) refraining from using laws such as vagrancy and loitering, to target certain genders;

(iii) preventing forced labour, human trafficking, abuse and violence in the context of commercial sex;

(iv) ensuring the participation of sex workers in the development of law and policies directly affecting their lives and safety, and enabling equal access for them to justice, health care and other services;

(e) introducing laws and policies to protect sex workers’ health and safety;

(f) not disclosing in any way, the identity of victims except with court authorisation;

(g) not imposing the death penalty for consensual same-sex relations;

(h) ensuring legal provisions, including those in customary, religious and indigenous laws, whether as explicit provisions, or the application of general punitive provisions, do not criminalise or penalise on the basis of gender;

(i) providing access to justice and protection for complainants.

(j) Provide redress for victims whose privacy has been infringed due to their gender, including public apology; application to expunge historical criminal convictions and records concerning consensual adult same sex relations or cross-dressing; rehabilitation and recovery services; adequate compensation, and guarantees of non-recurrence.

(k) Support research into privacy and gender including the experiences of all of the LGBTQI community, on the extent, causes (including attitudes, beliefs, customs and practices) and effects of infringements of privacy.

(l) Assess the type, prevalence, trends and patterns of complaints concerning gender differentiated privacy experiences using rights-based data collection procedures and best practice privacy and data protection standards and law, and make publicly available disaggregated, de-identified data of privacy infringements based on gender.

2. Defence of human rights

29. States and non-State parties to:
    • (a) Provide a safe and enabling environment for Human Rights Defenders with particular attention to the privacy and data protection rights of those defending the rights of women and gender non-conforming individuals, and those Defenders who may be personally vulnerable due to their gender;
    • (b) Meet legal obligations to protect the right to privacy and support the work of Defenders, regardless of their gender or the gender of those whose rights they are defending;
    • (c) Apply an intersectional approach to assessing opportunities and risks to advancing the defence of human rights for and by women and gender non-conforming Defenders;
    • (d) Address the particular challenges women indigenous human rights defenders face when exercising their right to participate in public life.
30. States to:
    • (a) Enact legislation that protects human rights defenders, especially those who are women or gender-diverse, from all forms of violence, including cyber-violence;
    • (b) Repeal any laws which criminalise the role of human rights defender and pass legislation to prohibit and penalise violence towards them;
    • (c) Establish supportive legal, institutional and administrative frameworks by:

(i) establishing a strong and independent national human rights institution that promotes the defence of human rights, and documents abuses and successful exercises of justice;

(ii) ensuring access to justice, and addressing violations against defenders by taking a public stand against all State and non-State actors who violate their rights; ceasing all attacks and threats against defenders, and investigating all that occur;

(iii) introducing effective policies and programs with specific attention to women and gender non-conforming defenders that address the risks and systemic and structural discrimination and violence they experience;

(iv) addressing barriers to the participation of these defenders in public life, including lack of identity or travel documents;

(v) ensuring the privacy of communications of defenders engaging with multilateral institutions and international and regional human rights bodies, and promptly investigating any allegations to the contrary;

(vi) ensuring online media is not used to violate the right of Human Rights Defenders to privacy through, for example, publication of private contact information by a third party, identity theft, threats of sexual violence.

3. Indigenous Peoples

31. State and non-State parties to ensure:
    • (a) Indigenous and tribal peoples enjoy the full measure of the human right to privacy without hindrance or discrimination on the basis of gender, with indigeneity and gender being self-defined.
    • (b) The social, cultural, religious and spiritual values and practices of indigenous and tribal peoples shall be recognised and protected, and account taken of the nature of the gender privacy issues facing them as groups and as individuals;
    • (c) The specific vulnerability of indigenous women and gender-diverse individuals; under both individual and collective rights which lead to ongoing abuses of their privacy rights are addressed;
    • (d) Recognition of the rights of indigenous peoples to own, control, access and possess data that derive from them, and which pertain to their members, knowledge systems, customs or territories including gender in a manner which is more respectful of the uniqueness and dignity of indigenous cultures;
    • (e) Educate non-indigenous populations on the privacy rights of indigenous women and gender non-conforming individuals; integrate such materials into school curricula and human rights training for officials providing services to indigenous peoples, including police, border guards and the judiciary, as well as health and education professionals;
    • (f) Ensure judicial mechanisms are the primary means by which corporate violations of privacy rights regardless of gender, are remedied while allocating adequate legislative attention to providing safeguards and remedies as a matter of substantive and procedural law; avoid legitimizing voluntary, private forms of remedy not providing effective access to justice.

4. People living with disabilities

32. State and non-State parties to ensure:
    • (a) The personal, health and rehabilitation information of persons with disabilities regardless of their gender, shall be protected on an equal basis with others;
    • (b) The systems that assist the exercise of legal capacity by persons with disabilities fully respect those persons’ right to privacy, regardless of gender;
    • (c) Forced, non-consensual medical treatment such as reproductive health procedures including involuntary sterilisation, are not undertaken;
    • (d) Close consultation with people with disabilities, including in the development and implementation of legislation, policies and other decision-making processes.

5. Children and young people

33. State and non-State parties to:
    • (a) Recognise and apply the values and provisions of the Convention on the Rights of the Child, regardless of gender;
    • (b) Take all necessary measures to provide a safe environment by protecting the right to privacy to enable the child to develop freely; provide space to reflect and deliberate on moral and ethical choices; enable social and intimate relationships, and enjoyment of other human rights.
    • (c) Take all necessary measures against any practice that infringes any dimension of privacy, and hinders or endangers a child’s normal growth and physical, emotional and psychological development.
    • (d) Educate children and teenagers about safety on social media platforms and the internet; protecting their privacy online; the risks of sharing intimate images/footage, and that the non-consensual dissemination of such images can be considered a form of gender-based violence^[3], and possibly, in some jurisdictions, a crime;
    • (e) Include in curricula, according to the evolving capacity of the child, comprehensive, and accurate material on sexual, biological, physical and psychological diversity, and the human rights of people of all genders;
    • (f) Ensure children can acquire the knowledge and skills to protect themselves and others as their sexuality develops;
    • (g) Undertake privacy and gender impact assessments prior to the introduction of innovations, including those meant to reduce risks of online exploitation and abuse of children and young people, to avoid inadvertent and harmful impacts including reducing LGBTQI youth’s access to gender information;
    • (h) In relation to research on gender, ensure:

(i) personal information of and about children, accessed through research is not used for purposes other than that for which consent was given;

(ii) children, according to their evolving capacities, participate in decisions on research priorities;

(iii) where appropriate and necessary, once the child has reached the age of legal majority, consent (or re-consent) to participation in the research should be sought.

(iv) a supportive environment is created for children who participate in research.

(i) In relation to healthcare, ensure:

(i) health services employ trained personnel who fully respect the rights of children to privacy and non-discrimination on basis of gender;

(ii) development and implementation of rights-based, lifetime health-care protocols for intersex children and effective independent oversight;

(iii) inform and fully consult children regarding any modifications to their sex characteristics necessary to avoid or remedy proven, serious physical harm, and ensure that any such modifications have the consent of the child concerned according to their evolving capacity;

(iv) protect the confidentiality of any test results, and not disclose this to third parties, including parents, without the child’s consent.

(j) Protect the right to privacy of children sold, trafficked, prostituted or abused, including by avoiding the dissemination of information identifying child victims;

(k) Business enterprises to protect and promote human rights by:

(i) integrating child rights considerations into all corporate policies and management processes;

(ii) developing standard processes to handle child sexual abuse material in conjunction with public authorities;

(iii) creating safer online environments;

(iv) educating children, parents and teachers about responsible use of information and communication technologies;

(v) promoting safe digital technology use for increasing civic and social engagement.

34. States to ensure:
    • (a) Birth certificates are issued for children upon birth, including for indigenous and tribal children, and that these reflect the self-defined gender identity of the parents;
    • (b) Court records of sensitive details of the sex characteristics of intersex children, addresses, details of genitalia and surgical procedures, amongst other personal information are not accessible by search engines;
    • (c) Limitations on the authority of parents of intersex children to authorise medically unnecessary genital plastic surgery that cosmetically "normalise" variations in intersex children's sex characteristics, and ensure the involvement of the child concerned in such decisions according to their evolving capacity.
    • (d) Adoption of privacy protocols so children are fully consulted and informed regarding any modifications to their sex characteristics necessary to avoid or remedy proven, serious physical harm, and ensure that any such modifications have the consent of the child concerned consistent with their evolving capacity.
    • (e) Gender recognition procedures for minors, are human rights compatible and:

(i) fast, transparent and based on self-determination

(ii) have the best interest of the child as the primary consideration

(iii) not medicalised

(iv) protect the child’s identity

(f) Relating to the rights of the child in HIV/AIDS contexts:

(i) implement child-centred and rights-based national and local HIV/AIDS-related policies, plans of action, strategies, and programs;

(ii) allocate financial, technical and human resources, to the maximum extent possible, to supporting national and community-based action, and, where appropriate, within the context of international cooperation;

(iii) expressly prohibit discrimination based on real or perceived HIV/AIDS status;

(g) include HIV/AIDS plans of action, strategies, policies and programs in the work of national mechanisms responsible for monitoring and coordinating children’s rights, and provide a procedure for complaints of neglect or violation of the rights of the child in relation to HIV/AIDS;

(h) ensure HIV-related data collections and evaluations adequately cover children, are disaggregated by age and gender, and include, as far as possible, children belonging to vulnerable groups and those in need of special protection;

(i) enable children to:

(i) obtain in a manner which protects their privacy, adequate information related to HIV/AIDS prevention and care, through formal educational opportunities and child-targeted media, and informal channels (e.g. those targeting street children, institutionalized children or children living in difficult circumstances);

(ii) have private access to voluntary, confidential HIV counselling, testing and test results for all children;

(j) Ensure the confidentiality and security of information concerning:

(i) a child’s involvement in justice processes through privacy standards and protocols, including closed court proceedings;

(ii) child victims of sexual and economic exploitation, trafficking and sale;

(iii) participants in services designed for those subjected to such treatment.

(k) Ensure child pornography laws are not susceptible to being used in ways that could compound the negative social stigma already disproportionately borne by those whose sexualised self-representations are distributed beyond their intended recipient, and which discourage reporting and prosecution of the exploitative and abusive redistributions the statute was enacted to address.

6. Gender identity and legal recognition

35. State and non-State Parties to:
    • (a) Facilitate formal recognition of identity, regardless of the individual’s gender, by ensuring:
    • (b) requirements for information on sex or gender are relevant, reasonable and necessary as required by the law for a legitimate purpose in the circumstances where it is sought, and that these respect everyone’s right to self-determination of name/gender;
    • (c) changes of the name or gender marker, are not disclosed without the prior, free, and informed consent of the person concerned, unless ordered by a court;
    • (d) protection of the data of an individual who has changed their sex and/or gender on official records by:

(i) protecting their history of changes of sex/gender or name from interference;

(ii) ensuring that such data is only recorded and accessed when this history is relevant to decision-making;

(iii) requiring robust security controls;

(iv) de-identifying or destroying such information when no longer required.

36. States to ensure:
    • (a) Government digital identity programs are not used to monitor and enforce societal gender norms, or for purposes that are not lawful, necessary and proportionate in a democratic society;
    • (b) Official identity documents only include relevant, reasonable and necessary personal information relating to sex/gender as required by law for a legitimate purpose;
    • (c) Enact and implement comprehensive legislative, administrative and technological systems to establish a quick, transparent and accessible mechanism, based on self-determination by the person, which legally recognises and affirms each person’s chosen name and self-defined gender identity;
    • (d) No eligibility criteria, such as surgical, medical or psychological interventions, psycho-medical diagnosis, minimum or maximum age, economic status, civic record, immigration, health, marital or parental status, or any other third-party opinion, shall be a prerequisite or barrier to changing one’s name, legal sex or gender;
    • (e) Make available a multiplicity of gender marker options while moving to end the registration of sex and gender in identity documents such as birth certificates, identification cards, passports and driver licences;
    • (f) Provide robust privacy protections for legal recognition of name changes in identity documents, and where there is a requirement to publicly notify such changes whether by online means or not, provide options for affected individuals to seek non-release of public records, judicial notices and decisions concerning name/gender identity changes;
    • (g) Use gender appropriate terms and titles in forms and personal records; develop policies to assist staff in managing relationships with members of the intersex, transgender and/or gender-diverse community, and provide guidance and training on rights and procedures for name and gender identity changes;
    • (h) Provide clear and publicly accessible information on how sex/gender information can be changed on personal records.

7. Civic, recreational and cultural activities

37. State and non-State parties to:
    • (a) Review their legal frameworks and policies to facilitate inclusion of all genders and the protection of their privacy in the enjoyment of their cultural and civic rights.
    • (b) Facilitate the ability of all individuals, regardless of gender, to be able to participate fully in civic and public life; to have reasonable expectations that their privacy will not be violated by this participation, and confidence that they have meaningful redress against, protection from, and consequences for, the perpetrator(s) of such privacy breaches.
    • (c) Implement affirmative action programs to prevent infringements of privacy that restrict public and political participation;
    • (d) Remove all:

(i) barriers that exclude women and individuals of non-conforming gender from public spaces such as stadiums, mixed concerts, cafés, places of worship or heritage sites;

(ii) gender-specific regulation of clothing to be worn in public;

(iii) prohibition of cross-dressing in public places.

(e) Design and maintain public spaces and facilities with gender needs and responsibilities in mind, for example, well-lit pedestrian walkways, family restrooms, public toilets and sanitation facilities with sufficient privacy to enable safety when attending to basic human needs;

(f) Ensure the protection of members of the LGBTQI community from exclusion, abuse and shaming in public spaces by sending strong messages of inclusion and official support;

(g) Information contained in mandatory notifications to public authorities of use of public spaces is held securely, and any personal information particularly of sex/gender is protected from disclosure;

(h) Implement comprehensive laws and policies to prevent and respond to gender-based violence in public spaces including on public transport, educational institutions, whether perpetrated by State agents or private persons;

(i) Train officials on the concept of inclusive public spaces and respect for the dignity of users of these places, regardless of gender;

(j) Recognise that some indigenous or cultural traditions, languages, rituals, festivals, and sites have gender significance where, when consistent with applicable international human rights law, privacy is expected;

(k) Mainstream privacy and gender in all functions, including complaint handling and human rights education, and encourage gender diversity amongst leadership and staff teams;

(l) Sporting organisations integrate the Yogyakarta Principles (2006) and Additional Principles (2017), and all relevant human rights norms and standards, in their policies and practices, in particular:

(i) ensure all individuals can participate in sport in line with the gender with which they identify, subject only to reasonable, proportionate and non- arbitrary requirements, and without gender based discrimination;

(ii) install appropriate changing rooms, and increase awareness in the sporting community of privacy and any anti-discrimination laws for persons of diverse sexual orientations, gender identities, gender expressions, and sex characteristics;

(iii) remove, and refrain from introducing, policies that force, coerce or otherwise pressure women athletes into undergoing unnecessary and harmful medical examinations, testing and/or procedures in order to participate as women athletes;

(iv) take measures to encourage the general public to respect diversity base on gender in sports, and to eliminate privacy incursions.

(m) When it is a matter of important public interest to inquire into past events arising from or associated with infringements of privacy on the basis of gender, ensure:

(i) protection of the right to privacy of individuals, as necessary, proportionate and lawful;

(ii) effective access to information concerning the facts related to violations, including archived material;

(iii) individuals have full access to their complete health histories;

(iv) independent and impartial investigation, remedies, redress, reparation including where appropriate, psychological support and restorative treatments;

(v) preservation of documentary evidence of infringements of the right to privacy based on gender.

(n) Prohibit the use of mass surveillance techniques for indiscriminate surveillance based on gender, of those exercising the right to peaceful assembly and association, in physical spaces and online.

(o) Protect the privacy of those involved in advocacy for, and on behalf of individuals and communities subject to infringements of privacy based on gender;

(p) Design and implement a protocol for military service of LGBTQI individuals that recognises their gender identities, enables military service, and protects from discrimination and violence.

8. Housing and education

38. State and non-State actors to:

(a) Ensure:

(i) housing and educational programs protect the privacy of all regardless of gender irrespective of age, indigeneity or disability amongst other factors;

(ii) do not discriminate on the basis of gender.

(b) Establish privacy respectful and gender-inclusive policies, programs and services that address issues such as single-sex facilities for example, toilets and changing rooms, clothing in educational institutions, introduce gender appropriate official documents/records, and reform discriminatory education policies, regulations, curricula, teaching materials and teaching practices;

(c) Take action to prevent, reduce and penalise prejudice and violence, for example, bullying, harassment, and exclusion based upon gender;

(d) Raise public awareness through education programs providing comprehensive, accurate information regarding sexuality and diverse gender identities and their right to privacy, and implement safety and support measures;

(e) Conduct studies/collect statistical data, where appropriate and necessary categorised by gender, to inform policy development.

9. Physical autonomy, reproductive rights and well-being

39. State and non-State parties to:

(a) Recognise:

(i) the ability of women to exercise control of their reproductive capacity is central to their lives and dignity, and this control enables women’s participation and contribution to the economic and social life of their societies;

(ii) a woman's decision to voluntarily terminate her pregnancy is not a matter of public or general interest;

(iii) a woman’s right to privacy cannot be violated by mandating the disclosure of the name and particulars of the biological father of her child, nor by requiring health personnel to report women who have undergone terminations;

(iv) violations of the right to privacy include forced and coercive medical interventions and therapies, as well as traditional practices such as female genital mutilation.

(b) Ensure:

(i) elimination of all forms of sexual and reproductive violence on the basis of gender, including forced marriage, ‘corrective’ rape and forced pregnancy;

(ii) access, including for minors, to safe, affordable and effective contraceptives; to information and education on family planning; sexual and reproductive health, and privacy;

(iii) decriminalisation of abortion, with provisions for declaration by the medical practitioner of conscientious objection with the option to refer a pregnant woman to a government health service, with her health records, for assistance;

(iv) health professionals and personnel who receive requests for voluntary termination of pregnancy treat these confidentially, and respect women's right to privacy and dignity.

(c) Prevent the disclosure of personal health data related to reproductive health, sexual orientation, gender identity, gender expression and sex characteristics, such as gender-affirming treatment, without the free, prior and informed consent of the person;

(d) Guarantee and protect the rights of everyone, including all children, to bodily and mental integrity, autonomy and self-determination, by prohibiting any practice and repealing any laws and policies, so no one shall be subjected to invasive or irreversible medical procedures that modify sex characteristics including female genital mutilation, forced genital-normalising surgery, involuntary sterilisation, unethical experimentation, medical display, “reparative” or “conversion” therapies, without their free, prior and informed consent unless necessary to avoid serious, urgent and irreparable harm to that person;

(e) 10.5 Address stigma, discrimination and stereotypes based on gender, and combat the use of gender stereotypes, and other social, religious and cultural rationales, to justify modifications to sex characteristics, including of children;

40. States to:

(a) Prohibit the use of Per Vaginal (‘two finger’ tests), anal and genital examinations in legal and administrative proceedings and criminal prosecutions unless required by law, as relevant, reasonable, and necessary for a legitimate purpose;

(b) Repeal laws denying individuals the opportunity for surgical or other procedures to align physically with their gender identity;

(c) Ensure that legal provisions, regulations or administrative procedures relating to donation of biological material such as blood, gametes, embryos, organs, cells or other tissues contain privacy provisions with exemptions and exceptions as lawfully provided;

(d) Ensure inclusion of privacy rights and responsibilities in material relating to gender in health curricula and continuing professional development programs.

(e) 10.10 Repeal laws:

(i) criminalising consensual sexual activity between adults, including people of the same-sex,; or

(ii) prohibiting the expression of gender identity.

(f) Release people detained under pretrial detention or on the basis of a criminal sentence, if their detention is related to consensual sexual activity between people over the age of consent, or to their gender identity.

10. Health care

41. States and non-State Parties to:

(a) Implement the provisions of the UN SRP’s Recommendation on Health-related Data, particularly:

(i) taking all necessary administrative and other measures to manage health-related data so as to ensure enjoyment of the right to healthcare, confidentially and regardless of gender;

(ii) ensuring free, prior and informed consent forms the basis of provision of healthcare;

(iii) health-related data concerning gender is not used to restrict the enjoyment of human rights in either health or non-health contexts unless medically indicated as established by evidence, and/or in compliance with a legal requirement;

(iv) ender-marker categories in health records and health-related data include provision for non-binary classifications;

(v) all necessary measures are taken to ensure systems, procedures, records and data collection reflect all medical or other treatments, for example, upon intersex children or gender-change transitions;

(vi) health-related data systems for recording and processing familial relationships reflect, for example, same-sex partner recognition, and, in the case of children, the self-defined gender of their parents, guardians, or other family members;

(vii) enabling access to quality information relevant to gender health care needs, as well as full access to health records on the basis of the best interests of the individual and not subordinated to the claimed interest of the State or of the institution, or any of its employees, contractors or agents;

(viii) a person or an entity making a decision concerning the health-related data of an individual must do so in a way consistent with that person’s gender, in their best interests and with the individual’s knowledge and consent;

(ix) the health-related data of individuals subject to a notifiable diseases report such as a sexually transmitted disease, are to be given particular protection so as not to subject any individual to opprobrium or discrimination;

(x) reporting of notifiable diseases is to be undertaken with ethical consideration of advising the person concerned, regardless of gender, while providing suitable and specific measures to safeguard their rights and freedoms;

(xi) review medical classifications in order to eradicate the conception of some forms of sexual orientation or gender identities as pathologies.

(b) An individual’s gender whether in combination with age, disability, indigeneity or other factors, does not obviate the application of the Health-related Data Recommendation, nor does it nullify any decisions made by individual in relation to their health care or the use of their health-related data;

(c) Protect all persons from infringements of the right to privacy on the basis of gender in healthcare settings, including by design of facilities, management of healthcare services, staff practices as well as data processing;

(d) Remove barriers to accessing health services by introduction of, for example, ‘safe access zones’ around facilities including STD clinics, women’s health centres;

(e) Refrain from censoring, withholding or intentionally misrepresenting health-related information, including sexual education and information;

(f) Recognise the:

(i) connection between basic services, such as adequate public sanitation facilities which can be accessed safely and privately regardless of gender, in schools, workplaces, public services, and places of detention, for the safety of women, young girls, inter-sex and gender-diverse individuals.

(ii) Need for culturally gender-specific healthcare for communities such as indigenous and tribal women.

11. Data analytics

42. States and non-State parties to:

(a) Ensure the highest attainable standard of data protection for all individuals, regardless of gender, by:

(i) adopting best practice data protection laws and regulation including the establishment of a well-resourced, independent privacy/data regulator with appropriate powers and public reporting mechanisms;

(ii) developing systems for the effective protection and effective use of data in ways which benefit society and all individuals, regardless of gender;

(iii) engaging with members of the public on a regular basis to develop policies relating to data terminology, definitions and sensitivities associated with the intersex, transgender and gender-diverse communities;

(iv) reviewing legislative, regulatory or policy requirements relating to the collection of sex and/or gender information and amending these as required to ensure compliance with best practice data protection laws;

(v) collecting and maintaining sex and gender-disaggregated data necessary for the ongoing monitoring of gender equality and in accord with best standards of data protection law;

(vi) removing biases in existing datasets by identifying incomplete or non- existent gender categories in datasets;

(vii) employing the principles of data minimisation, necessity, and proportionality when aggregating gender data so only the minimum necessary level of detail is included in a dataset to achieve the intended positive outcome of the data use;

(viii) taking appropriate and necessary measures to guarantee the confidentiality and security of the personal data of individuals vulnerable due to their gender, such as same-sex couples;

(ix) Prohibiting release of unit record data on sex or gender as Open Data;

(x) protecting personal information relating to sex/gender through regular vulnerability assessments of information management systems, regular training for staff on data privacy and data security;

(xi) Using privacy impact assessments and other mechanisms to ensure that data analytics do not result in inferences being drawn about individuals or groups according to gender which could lead to discrimination.

12. Online violence

43. State and non-State parties to:

(a) Counter gender-targeted violence using privacy-intrusive and technologically-facilitated forms of abuse based on gender, by:

(i) providing education, outreach and gender sensitive trainings for internet users on online-violence in schools and communities;

(ii) including advocates, victims, and support services in the design of strategies to counter technologically-facilitated violence;

(iii) providing training and technical expertise for frontline staff, including dedicated hotlines and law enforcement support;

(iv) establishing data protection compliant reporting of incidence and outcomes of service interventions.

44. States to:

(a) Recognise online-facilitated violence targeted by gender as a human rights violation and form of discrimination, and take measures to apply international human rights instruments, in conjunction with domestic laws, to prevent and mitigate its occurrence;

(b) Review, strengthen and devise policies and legal and regulatory privacy and data protection frameworks to address gender-based violence in online and offline contexts, particularly technologically-interconnected violence, including smart home technologies;

(c) Reform criminal and civil laws to address technology-facilitated violence, establish criminal and civil causes of action to allow victims to pursue remedies with adequate protection of their privacy to avoid secondary victimization and which provide them greater control;

(d) Allow victims to obtain orders of protection (e.g. restraining orders) in family or civil courts to prevent their abusers from posting or sharing intimate images/footage without their consent or engaging in other unlawful harassment;

(e) The rights or claims of perpetrators/alleged perpetrators during and after judicial proceedings with respect to privacy, should be determined in the light of a victim or child’s human rights to life and physical, sexual and psychological integrity and guided by the principle of the best interests of the child;

(f) Collaborate with civil society organisations, tech companies, national human rights institutions, victims and activists to develop strategies including legislation to prevent, and mitigate online violence based on gender, technical support, counselling, legal guides, referral information and advice services;

(g) Promote, and provide educational resources and training for magistrates, lawyers, police, frontline workers and service providers on technology-facilitated gender violence;

(h) Develop specialised, clear, efficient and available protocols for law enforcement officials concerning online violence to improve existing investigation techniques and models with, for example, liaison-officers trained to investigate and respond to such assault using leading international practices;

(i) Increase prevention programs to teach respect, boundaries and appropriate behaviour, with practical booklets, seminars, training for front-line agencies, survivors, practitioners, policy makers, and technologists on technology-facilitated abuse and the safety and privacy of those experiencing domestic violence and sexualised violence;

(j) Explore, where appropriate and necessary, third-party liability options for platforms including social media networks, permitting the redistribution of private images and the continuation of harassment;

(k) Sustainably fund service providers for continuing service provision, training and resource development;

(l) Introduce inclusive, appropriate gender-sensitive, lawful data practices and ensure information collected about violence targeted at certain genders, is accurate, useful for policy makers, and published;

(m) Require privacy and data protection regulators, and regulators in related areas, address regularly, with the CSO sector, the gender aspects of privacy in their work, and publicly report it;

(n) Protect the personal data of gender non-conforming individuals such as trans and intersex persons, in court documentation, including having decisions revealing personal data of trans persons suppressed upon request, as long as this does not compromised the integrity of judicial process and proceedings;

(o) Prohibit and criminalise the non-consensual distribution of intimate images in digital and offline spaces, with legislation encompassing all elements of this type of abuse, including:

(i) not limiting the scope to present or former intimate partners, or to binary genders;

(ii) criminalizing the distribution or ‘re-sharing’ of these images;

(iii) protecting victims in images depicting sexual acts or sexual conduct, not just nudity, and in ‘deep fakes’;

(iv) making it illegal to threaten to disseminate non-consensual intimate images;

(v) enabling victims to request a court order to destroy harmful content, in addition to an interim order that the perpetrator promptly cease circulating the material pending the resolution of the legal case, in collaboration with internet intermediaries;

(vi) undertaking investigations in a timely, robust manner and enforcing penalties for those found guilty of such abuse.

(p) Provide civil remedies and ensure these and criminal prosecutions, do not entail violations of privacy and re-victimisation that provide disincentives to victims to progress their matters;

(q) Take measures to protect in conflict-affected areas, those vulnerable due to their gender, from abuse of their right to privacy arising from sexual harassment and gender-based violence, by business enterprises.

13. Digital technologies and online digital platforms

45. States and non-State Parties to:

(a) Recognise that for some people their gender means they have a greater dependency upon information and communication technologies, to fully develop their social, educational and other capacities;

(b) Ensure, regardless of gender, that:

(i) everyone has the right to access and use information and communication technologies, including the internet, for private communications and other positive uses;

ii) all necessary legislative, administrative, technical and other measures are taken, as per relevant international standards and human rights law, in consultation with stakeholders, to prevent, remedy and eliminate online hate speech, harassment and technology-related violence targeted by gender, and these efforts ensure private sector accountability.

(c) Adopt best practice privacy and data protection standards for all regardless of gender, to enable control of their personal information, particularly that relating to sex/gender;

(d) Implement in the design, construction and operation of products and all services including profiling and digital welfare services:

(i) gender-equality and privacy protection principles;

(ii) privacy risk management and governance mechanisms such as privacy by design/default approaches, and gender impact analyses.

(e) Minimise and restrict data processing relating to gender and ensure data collected, derived or inferred on gender, accords with international human rights law, and is held

(f) Provide easy access to data profiles, and monitor for gender bias by, for example, algorithmic auditing;

(g) Introduce provisions to enable an individual, regardless of gender, to remove personal information;

(h) Establish guidelines on AI development incorporating gender, the right to privacy and principles of data protection;

(i) Engage more women and LGBTQI persons in the design, development and regulation of digital technologies to develop privacy enhancing technologies and reduce risks of infringing privacy on the basis of gender;

(j) Take all necessary legal, administrative and other measures to fully respect and recognise individuals’ self-defined gender identity, and update privacy statements, and redesign tools, systems and processes accordingly;

(k) Utilise strong encryption technologies to ensure the privacy of communications and resist requests for user data that do not comply with international human rights standards of lawfulness, proportionality and necessity;

(l) Adopt strong policies, procedures and complaint mechanisms for reporting and requesting the removal of harmful content from social media, and display these policies and procedures prominently in local languages;

(m) Provide training, particularly for front line staff, on privacy, gender, and measures taken to end infringements of privacy within business operations;

(n) Provide education for users on digital security and technological assistance such as support services, information apps, design choices, terms of service, and tools for reporting violations;

(o) Report complaints of online violence, by types and number of cases by country, and lawful actions protective of the right to freedom of expression that were taken to respond to incidents of online harassment based on gender;

(p) Support research on digital technologies, and the experiences of women and the LGBTQI community, on the extent, causes and effects of infringements of privacy and the harms arising, and on the effectiveness of measures to prevent, eradicate, prosecute and provide reparation for such harm.

46. Business enterprises to:

(a) Implement the ‘UN Guiding Principles on Business and Human Rights’ and accompanying ‘Gender Guidance’, to respect the human rights of all persons affected by their practices;

(b) Exercise human rights due diligence to identify, prevent, mitigate and address violations of the rights to privacy and non-discrimination based on gender, including by:

(i) undertaking human rights impact assessments which incorporate the rights to privacy and gender non-discrimination, when developing or modifying their products and services, and include consultation with CSOs and other experts and validation by an accredited external third party with privacy expertise;

(ii) Integrating the findings of impact assessments, by:

• providing training and guidelines to management, employees and others, including contractors;
• adopting policies and procedures setting out how the company will respond to restrictions to communications or access to content;
• establishing early warning systems within business processes to identify privacy and gender rights risks, and respond in a timely fashion;
• challenging requests that unduly infringe the right to privacy;
• supporting research and development of appropriate technological solutions to online harassment, abuse and misogyny, including tools to detect and identify State-linked accounts and bots;
• monitoring specific concerns related to privacy and gender.

(c) Establish Codes of Conduct and Terms of Services to manage social media pages promoting gender violence, harmful gender stereotypes, and sharing intimate images without consent;

(d) Take effective measures to ensure transparency of their policies and practices, including the application of terms of service and computation-based review processes, and respect due process guarantees;

(e) Publish regular information on their official websites unless contravening a necessary and proportionate law, regarding the legal basis of requests made by governments and other third parties; the number or percentage of requests complied with, and about content or accounts restricted or removed under the company’s policies and applicable requirements;

(f) Introduce independent oversight mechanisms to monitor the outcome of content moderation decisions;

(g) Establish, in meaningful consultation with the communities affected, clearly available, accessible, and effective operational-level grievance mechanisms;

(h) Collaborate with governments and civil society to develop technology promoting and strengthening human rights.

47. States to:

(a) Take all necessary steps to ensure all State policies, legislation, regulations, prevent, investigate, penalise and provide redress for all forms of infringements of privacy based upon gender, committed by business enterprises operating within their territory/jurisdiction;

(b) Encourage via effective incentives and disincentives, business enterprises to integrate gender, this Recommendation, and the ‘Gender Guidance’, companion to the ‘UN Guiding Principles on Business and Human Rights’, in their operations;

(c) Establish strong, independent oversight of business enterprises’ performance on privacy and gender.

14. Work and employment

48. State and non-State parties to:

(a) Respect human dignity, privacy and protect sex/gender information in the processing of personal data for work and employment purposes;

(b) Allow the free development of all employees’ personality regardless of their gender, by:

(i) ensuring all necessary safeguards for workers' right to privacy and protection of their personal data;

(ii) advising and consulting workers and their representatives at reasonable intervals and without excessive delay as to what data is being collected on them, its processing, and the right to access, rectify and delete inaccurate data collected about them and derived from work processes.

(c) Ensure communications are:

(i) lawful and do not infringe privacy and discriminate against, or harass any worker on the basis of their gender;

(ii) timely, in an intelligible form, and include all relevant information on what is being collected, its origins, the purpose(s), retention periods, workers’ rights of access and rectification, how rights may be exercised and any other information to ensure transparent processing.

(d) Inform workers clearly and fully before the introduction of information systems and

(e) Ensure any use of data analytics and predictive technologies:

(i) accords with relevant privacy, and data protection laws and standards;

(ii) data predictive technologies, including those using health data, do not discriminate by gender;

(iii) technology revealing workers’ location is only introduced if necessary to achieve legitimate purpose(s) of employers such as health and safety, and does not lead to continuous monitoring of workers;

(iv) monitoring is only an indirect consequence of protecting and enhancing operations, health and safety;

(v) processing of biometric data is only undertaken if there are no other less intrusive means available and only if accompanied by appropriate safeguards including scientifically-recognised methods, and strict security and proportionality protocols.

(f) Develop appropriate measures to ensure enterprise-wide practices comply with privacy principles and lawful obligations relating to data processing for employment purposes, regardless of gender, including:

(i) limiting data collection to what is necessary to achieve the objectives of the collection in question;

(ii) conducting privacy impact assessments as in case of potential profiling or decisions taken by means of automated systems;

(iii) consulting workers on possible infringements of workers' right to privacy based on gender;

(iv) only providing personal data concerning gender to workers’ representatives, consistent with domestic law and practice, or the terms of collective agreements, to the extent that such data are necessary to allow proper representation of workers’ interests or to meet obligations in collective agreements;

(v) conduct investigations of employees with due regard to privacy and data protection laws;

(vi) ensure confidential procedures for appealing wrongful dismissal based on gender.

49. States to:

(a) Ensure employee records are not exempt from privacy and data protection regulation;

15. Social security protection

50. States and non-State parties to recognise:

(a) Everyone, regardless of gender, has the right to social security, a right to privacy in relation to receipt of this protection, and to lawful processing of their personal information collected as part of receiving this protection.

51. States to ensure:

(a) All necessary legislative, administrative, and other measures, are taken to ensure social security programs and strategies enable the development of the personality and promote social and economic inclusion regardless of gender, without undue intrusion into the personal circumstances of recipients;

(b) Regulation of the receipt of social security benefits and assistance incorporates a human rights framework stressing privacy, dignity, choice, self-respect, autonomy, self-determination, grounded in law, and conducted transparently;

(c) Digitalisation of welfare arrangements is accompanied by careful and transparent consideration of gender impacts with programs designed to promote and teach pre-requisite digital skills; reasonable access to necessary equipment as well as effective online access; genuine non-digital options to access benefits; consultation with intended users, and participatory evaluation;

(d) Effective action to prevent societal biases, relating to gender, being embedded via automated decision-making in social welfare programs and systems, including predicting risk;

(e) Record system arrangements and data collection practices including cross-matching, data sharing, and cross-verification across datasets underlying the creation, auditing, and maintenance of data relating to gender, are compliant with best practice data protection regulation;

(f) Access to effective appeal mechanisms, and remedies for exclusion from social security programs, or targeting and harassment, based on gender;

(g) Where the provision of benefit and social assistance systems involves private entities, that:

(i) gender privacy protections are included in such contracts and these contain remedial measures for breaches of such provisions;

(ii) no conflicts exist between the public interests these systems serve, and the private interests of corporations and their owners.

16. Security and surveillance

52. State and non-State parties to:

(a) Protect the privacy of digital communications and the enjoyment of the right to privacy by all regardless of gender, through promoting tools such as encryption;

(b) Ensure any restrictions on the right to privacy, including through mass or targeted surveillance; requests for personal data, or limitations on the use of encryption, pseudonymity and anonymity tools, are:

(i) on a case-specific basis;

(ii) do not discriminate on the basis of gender, or other factors such as indigeneity;

(iii) are reasonable, necessary and proportionate as required by law for a legitimate purpose and ordered only by a court.

53. States to:

(a) Amend cybercrime, surveillance and antiterrorism laws for compliance with international human rights norms and standards applying to the rights to privacy; freedom of opinion and expression; freedom of peaceful assembly, and freedom of association;

(b) Enshrine the principles of gender non-discrimination in the design and implementation of all surveillance;

(c) Review, repeal and prohibit legislation facilitating State surveillance designed to monitor gender non-conforming communities;

(d) Ensure the processing of personal data for profiling is consistent with relevant human rights standards and data protection;

(e) Provide legal protections against non-consensual, predatory, commercial surveillance that enables profiling, monitoring and marketing at a micro-level, and invades privacy according to gender using big data techniques such as mobile geo-fencing and geospatial location markers;

(f) Renounce the use of discriminatory, inaccurate, disproportionate or unevidenced gender stereotypes for profiling, and promote human rights training to prevent and mitigate any stigma, harassment and discrimination arising from such profiling practices;

(g) Implement policies and procedures that specifically address gender and privacy implications of potentially sensitive CCTV footage, including relevant training for data controllers and those who can access the footage;

(h) Implement data protection and security protocols to prevent the abuse, redistribution, or degrading treatment of captured CCTV images, including privacy impact and risk assessments and governance protocols with embargoes on face recognition or other algorithmic analysis of captured surveillance without judicial permission and independent oversight;

(i) Establish all appropriate measures to oversight, investigate, document and monitor the impacts of surveillance infringements of privacy based on gender, including public reporting;

(j) Penalise egregious image-based abuse by law enforcement officials by internal and external disciplinary means; create protocols for victim redress, and maintain ongoing communication with victims;

(k) Ensure counter-terrorism measures do not disproportionately or unnecessarily affect women and LGBTQI asylum-seekers, refugees and immigrants.

17. Detention

54. States and non-State parties to:

(a) Implement:

(i) privacy policies relating to the placement and treatment of persons deprived of their liberty that reflect the needs and rights of persons of all genders including sexual orientations, gender identities, gender expressions, and sex characteristics;

(ii) policies combating violence, discrimination and other harm arising from infringements of privacy based on gender, faced by people deprived of their liberty, including placement, body or other searches, items expressing gender or access to and continuation of gender-affirming treatment and healthcare, and ‘protective’ solitary confinement;

(iii) programs addressing the gender-specific needs of indigenous people and their cultural, spiritual and religious requirements, and others, such as individuals with disabilities.

(b) Ensure effective independent oversight of detention facilities, both public and private, that addresses the protection of the right to privacy, regardless of gender.

18. Asylum-seeking

55. States to:

(a) Ensure that those seeking asylum are protected from infringements of their privacy committed on grounds of gender, including during reception and the determination of their claims by:

(i) recording information about a person’s sex/gender only where it is lawful, reasonable, necessary and proportionate;

(ii) storing this information securely;

(iii) prohibiting its release to any person other than those directly involved in the refugee determination process;

(iv) accepting, as the starting point for consideration of an asylum claim, the self-identified gender of the person seeking asylum;

(v) eschewing inappropriate, invasive, unnecessary or coercive medical or psychological testing or unlawfully obtained personal information to assess a person’s self-declared gender when seeking asylum;

(vi) providing privacy protections for the health-related information of those seeking asylum, particularly in relation to gender-sensitive information such as reproductive health, HIV information and therapy, hormonal or other therapy, and gender-affirming treatment;

(vii) establishing, implementing and monitoring privacy guidelines; viii) providing training on privacy and gender for agents involved in determining refugee status and managing reception conditions.

Annex 1

Bibliography

Australian Human Rights Commission Guidelines for the Inclusion of transgender and gender diverse people in sport, June 2019.

https://www.humanrights.gov.au/sites/default/files/document/publication/ahrc_transgender_and_gender_diverse_guidelines_2019.pdf

Bridges, K.M., The Poverty of Privacy Rights, Stanford University Press, 2017.

Council of Europe Gender Equality Strategy, https://edoc.coe.int/en/gender-equality/6995-combating-sexit-hate-speech.html

European Court of Human Rights, Second Section, L. v Lithuania, application No. 27527/03, Final Judgment, 31 March 2008; European Court of Human Rights, Fifth Section, A.P., Garçon and Nicot v. France, application Nos. 79885/12, 52471/13 and 52596/13, Judgment, 6 April 2017.

European Institute for Gender Equality Understanding intimate partner violence in the EU: the role of data, 2019,

European Union Agency for Fundamental Rights:

Violence against Women: an EU-wide survey. Main Results, 2015. https://fra.europa.eu/en/publication/2014/violence-against-women-eu-wide-survey-main-results-report

Challenges to Women’s Human Rights in 2017 – gender discrimination, sexist hate speech and gender-based violence against women and girls, http://fra.europa.eu/en/publication/2017/colloq-womens-rights

European Union:

Code of Conduct, Countering illegal hate speech online, 4 February 2019 http://europa.eu/rapid/press-release_MEMO-19-806_en.htm

The Asylum Procedures Directive 2013/32EU.

International Labour Office, Code of Practice on the Protection of Workers’ Personal Data, 1997

Köhler, R., Legal Gender Recognition and the Best Interest of the Child, TGEU Policy paper, November 2018

Queensland Law Reform Commission, Expunging criminal convictions for historical gay sex offences, 2016.

UK Parliament, House of Commons:

Women and Equalities Committee, Sexual harassment of women and girls in public places, October 2018, para 108, https://publications.parliament.uk/pa/cm201719/cmselect/cmwomeq/701/70111.htm

Committee, Disinformation and 'fake news': Final Report, February 2019.

Yogyakarta principles 2006, and Updated 2017, https://yogyakartaprinciples.org/principles-en/yp10

Women against Violence Europe, Country Report 2017-The Situation of Women’s Specialist Support Services in Europe, http://fileserver.wave-network.org/researchreports/WAVE_CR_2017.pdf

United Nations:

Committee on the Rights of Persons with Disabilities Eleventh session, 31 March–11 April 2014 General comment No. 1 (2014) Article 12: Equal recognition before the law

Committee on the Elimination of Discrimination against Women:

General recommendation No.37 (2018) on the gender-related dimensions of disaster risk reduction in the context of climate change CEDAW/C/GC/37

General recommendation No.36 (2017) on the right of girls and women to education CEDAW/C/GC/36

General recommendation No.33 (2015) women’s access to justice CEDAW/C/GC/33

General recommendation No.32 (2014) gender-related dimensions of refugee status, asylum, nationality and statelessness of women

General recommendation No.28 (2010) Core Obligations of States Parties (Art. 2)

General recommendation No.27 (2010) Older women and protection of their human rights

Committee on Economic, Social and Cultural Rights:

General comment No. 24 (2017) on State obligations under the International Covenant on Economic, Social and Cultural Rights in the context of business activities

General comment No. 23 (2016) on the right to just and favourable conditions of work (article 7 International Covenant on Economic, Social and Cultural Rights)

General comment No. 22 (2016) on the right to sexual and reproductive health (art. 12 International Covenant on Economic, Social and Cultural Rights)

General comment No. 21 (2009) Right of everyone to take part in cultural life (art. 15, para. 1 (a), International Covenant on Economic, Social and Cultural Rights)

General comment No. 20 (2009) Non-discrimination in economic, social and cultural rights (art. 2, para. 2, International Covenant on Economic, Social and Cultural Rights)

General comment No. 19 (2007) The right to social security (art. 9)

General comment No. 18 (2005) The right to work (art. 6 International Covenant on Economic, Social and Cultural Rights)

General comment No. 16 (2005) The equal right of men and women to the enjoyment of all economic, social and cultural rights (art. 3 International Covenant on Economic, Social and Cultural Rights)

General comment No. 7 (1997) The right to adequate housing (art. 11 (1) of the Covenant): Forced evictions

General comment No. 6 (1995) The economic, social and cultural rights of older persons

General comment No. 5 (1994) Persons with disabilities

Human Rights Committee:

Communication No. 2172/2012, G. v. Australia, 17 March 2017.

General Comment No. 28, para. 20. Art 9 International Covenant on Economic, Social and Cultural Rights.

General Comment No. 36, para. 22; 23.

Toonen v Australia, UN Doc. CCPR/C/50/D/488/1992, 1994.

Special Rapporteur on the on the promotion and protection of the right to freedom of opinion and expression, May 2015. https://documents-dds-ny.un.org/doc/UNDOC/GEN/G15/095/85/PDF/G1509585.pdf?OpenElement

Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism UNGA 64th Session, A/64/211, August 2009.

Special Rapporteur on violence against women, its causes and consequences, online violence against women and girls from a human rights perspective, A/HRC/38/47, 2018

Special Rapporteur on extrajudicial, summary or arbitrary executions, Investigation of, accountability for and prevention of intentional State killings of human rights defenders, journalists and prominent dissidents 2019, 41st session Human Rights Council.

Special rapporteur on extreme poverty and human rights, Uses of digital technologies in the welfare state, 2019. UNGA 74th session

A/73/345712 https://www.ohchr.org/EN/Issues/Privacy/SR/Pages/AnnualReports.aspx
UN Development Group, UNDG Guidance Note on Big Data for SDGs: Data Privacy, Data Protection and Data Ethics, 2017.

UN Global Pulse, Data Privacy and Data Protection Principles

UNFPA, Danish Institute for Human Rights, and UN Human Rights Office of the High Commissioner, Reproductive Rights are Human Rights, a Handbook for National Human Rights Institutions, 2014, https://www.ohchr.org/Documents/Publications/NHRIHandbook.pdf

UN Women Global Pulse Gender Equality and Big Data, 2018 https://www.unglobalpulse.org/sites/default/files/Gender-equality- and-big-data-en-2018.pdf

UN Internet Governance Forum, The Charter of Human Rights and Principles for the Internet, Internet Rights and Principles Dynamic Coalition, 2014.

OHCHR, A Human Rights-Based Approach to Data: Leaving No One Behind in the 2030 Agenda for Sustainable Development, 2015.

World Health Organization, Eliminating virginity testing: an interagency statement. Geneva 2018.

Declaration on the Right and Responsibility of Individuals, Groups and Organs of Society to Promote and Protect Universally Recognized Human Rights and Fundamental Freedoms

Body of Principles for the Protection of All Persons under Any Form of Detention or Imprisonment https://www.ohchr.org/EN/ProfessionalInterest/Pages/DetentionOrImprisonment.aspx

International Labour Organisation, Indigenous and Tribal Peoples Convention, 1989 (no. 169)

General Assembly resolution 68/167, A/HRC/13/37

General Assembly resolution 217 A (III), preamble to the Universal Declaration of Human Rights.

Human Rights Council Resolutions 20/8, 19/36 and 28/14.

HRC resolution 34/73 UNGA (2014). Right to privacy in the digital age, A/RES/71/199 https://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/71/199

Office of the High Commissioner for Human Rights, Born Free and Equal: Sexual Orientation and Gender Identity in International Human Rights Law, New York/ Geneva, 2012.

United Nations High Commissioner for Human Rights (2014). The right to privacy in the digital age, A/HRC/27/37.www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session27/Documents/ A.HRC.27.37_en.pdf;

United Nations High Commissioner for Human Rights (2018). The right to privacy in the digital age, A/HRC/39/29.www.ohchr.org/Documents/Issues/DigitalAge/ReportPrivacyinDigitalAge/ A_HRC_39_29_EN.docx;

Human Rights Council (2015). The right to privacy in digital age, A/HRC/RES/28/16. p.4 (OP 4f) http://ap.ohchr.org/documents/dpage_e.aspx?si=A/HRC/RES/28/16

Human Rights Council (2017). The right to privacy in the digital age, A/HRC/RES/34/7, p4. http://ap.ohchr.org/documents/dpage_e.aspx?si=A/HRC/RES/34/

UN Secretary General, Situation of women and girls with disabilities and the Status of the Convention of the Rights of Persons with Disabilities and the Optional Protocol thereto, 2017.

UNESCO, Human rights and encryption, 2016. https://www.enisa.europa.eu/about-enisa/structure-organization/national-liaison- office/news-from-the-member-states/nl-cabinet-position-on-encryption

Annex 2

Acknowledgements

1. The Special Rapporteur appreciates the support of the Office of the High Commissioner for Human Rights. The assistance of UN staff is gratefully acknowledged.
2. The Special Rapporteur has sourced extra-mural funding and volunteer assistance from the Department of Information Policy and Governance, University of Malta, and the Security, Technology & e-Privacy Research Group, University of Groningen, Netherlands, and from volunteers. Corporations like Huawei and Facebook provided material assistance in 2019 through logistical support such as venues and lunch-break and coffee-break expenditure for some consultation events and other meetings organised by the mandate.
3. The Special Rapporteur would like to particularly recognise the efforts and support of non-governmental organisations, small and large, local, national and international. The mandate could not be undertaken successfully without their assistance around the world.
4. The Special Rapporteur would like to thank the many Government agencies, regulatory and professional bodies who have assisted his mandate, and the Taskforce Chairs, Taskforce members, and voluntary secretariat support. Special thanks in this regard go to Prof. Nikolaus Forgò of the University of Vienna for Chairing and Mr. Sean McLaughlin for acting as Secretary to, and chief co-ordinating author, of the Task Force on Privacy and Health-related data.
5. The mandate is particularly indebted to Dr. Elizabeth Coombs, Chair of the Task Force on Privacy and Personality, who has primary responsibility for compiling and drafting many sections of these reports, the recommendations on Gender and Privacy, also researching responses received from the consultations and the organisation of the event in New York in October 2019, and undertaking the work on privacy and children.
6. The mandate is especially indebted to the teams of volunteers from the Department of Information Policy and Governance at the University of Malta STeP, the Security, Technology and e-Privacy Research Group at the University of Groningen for their on-going support in all of the work carried out by the mandate and especially that involving surveillance, encryption, individual cases and corporations. These have included Dr. Aitana Radu, Ms. Tanita Cotarcea, Mr. Ketan Modh, Mr. Joshua Smith, Mr. Halefom Abraha, Ms. Ioanna Meletiadou, Ms. Jimena Garfias, Prof. Jeanne Pia Mifsud Bonnici and Ms. Bettina Zijlsta.

[*] Submitted after the deadline to reflect the most recent information.

[**] Annexes are reproduced as received.

^[1] All references to ‘Gender’ in this document should be read to mean inclusive of cis-normativity, sexual orientation, gender identity, gender expression and sex characteristics and the social norms attributed to biological characteristics.

^[2] See Annex 2

^[3] It is noted that in some jurisdictions even consensual sharing of images can be considered to be gender-based violence and possibly subject to criminal law. Without in any way endorsing the validity of such a position, this recommendation, would, in that context, need to be interpreted as meaning that educational authorities in those jurisdictions would also be bound to educate children and teenagers about the legal position obtaining in that particular jurisdiction.