P The GNI Principles at Work PUBLIC REPORT ON THE THIRD CYCLE OF INDEPENDENT ASSESSMENTS OF GNI COMPANY MEMBERS 2018/2019 cmyk / RGB BK / GREYSCALE SOCIAL Lorem ipsum D35852 ED6345 5566AD 347587 298VA0 59C5CE E6EBEF 705C6B E6EBEF A563A2 825B7A 63C3A4 4A936A A6CE40 Global Network Initiative The GNI Principles at Work Public Report on the Third Cycle of Independent Assessments of GNI Company Members 2018/2019 Follow Us Twitter: @theGNI Facebook: #theGNI Contact Us 718 7th Street NW Washington DC 20001 202-793-3053 [email protected] globalnetworkinitiative.org Table of Contents Executive Summary 1 1) Introduction 4 2) 2018/2019 Assessments 9 Assessor Findings 12 Process Review 12 Case Studies 16 Company Determinations 48 Facebook 51 Google 55 Microsoft 59 Millicom 63 Nokia 67 Orange 71 Telefónica 75 Telenor Group 79 Telia Company 83 Verizon Media 86 Vodafone Group 89 3) Improvement Over Time 92 4) Lessons & Opportunities 101 5) Looking Ahead 106 Appendices 110 Appendix I: Acronyms and Abbreviations 110 Appendix II: Assessment Review Recommendations 111 Executive Summary This is the public report on the 2018/2019 independent assess- implement the GNI Principles on Freedom of Expression and ments of 11 member companies of the Global Network Initiative Privacy (“the GNI Principles”). This report marks the third cycle (GNI): Facebook, Google, Microsoft, Millicom, Nokia, Orange, of GNI company assessments. Based on a detailed evaluation Telefónica, Telenor Group, Telia Company, Verizon Media, and of confidential reports prepared by independent assessors, and Vodafone Group. This assessment cycle covered a two-year the querying of the assessors and member companies, GNI’s period, from July 1, 2016, to July 1, 2018 (“the assessment multistakeholder Board of Directors reviewed the assessments period”). However, only for this assessment cycle, the relevant and determined that each company is making good-faith efforts period of review for Millicom, Nokia, Orange, Telefónica, Telenor to implement the GNI Principles with improvement over time. Group, Telia Company, and Vodafone Group spanned from their accession to GNI on March 27, 2017, to July 1, 2018. “The assessment process strives to GNI was launched in 2008. Its mission is to protect and advance increase company transparency while freedom of expression and privacy rights in the information and communications technology (ICT) sector by setting a global protecting users’ rights through ample standard for responsible decision making and serving as a access to information.” multistakeholder voice in the face of government restrictions GARE SMITH, Foley Hoag LLP and demands. GNI brings together ICT companies, civil society (including human rights and press freedom groups), academics, The independent assessments were conducted according to academic institutions, and investors from around the world to the GNI Assessment Toolkit by assessors accredited by the provide a framework for responsible company decision making, GNI Board as meeting independence and competency criteria foster accountability by member companies, offer a safe space established by GNI, who then participated in mandatory for shared learning, and provide a forum for collective advocacy assessor training. Assessors received access to information, in support of laws and policies that promote and protect including relevant documents in secure settings. They also freedom of expression and privacy. had access to key company personnel, from frontline teams to senior management, and conducted a total of 125 interviews. 1 A unique feature of GNI is its independent assessment process Assessments included an examination of 86 case studies, which that relies on a methodology designed to allow GNI’s civil looked at how the companies are dealing with government society, academic, and investor board members (non-company requests and demands in practice. The GNI Board met four board members) insight into member company efforts to times over the course of 2019 to review the 11 company reports and engage in detailed discussion with each company and and respect the freedom of expression and privacy rights of assessor before making their determinations. billions of users and customers while dealing with increasingly sophisticated government measures to assert control over The GNI assessment process is confidential by design. It allows online content and digital communications. companies to share and discuss sensitive cases of government requests with GNI’s non-company board members. It also No single company can face today’s freedom of expression and allows discussion of internal company systems and processes privacy challenges on its own. Pushing back on efforts to sup- to implement the GNI Principles. This report primarily presents press freedom of expression and privacy rights or limit the oper- information in aggregate or anonymized form in order to ating environment for rights-respecting ICT companies requires show how the companies review and respond to government dedicated efforts by governments, regulators, companies, and requests, without disclosing confidential or otherwise legally other key stakeholders, including investors, academics, and civil Executive Summary Executive protected information. To increase transparency with the society organizations inside and outside of GNI. public, this report includes some examples of case studies and assessor recommendations specific to individual companies. The assessment process shows how companies from different segments of the ICT sector can commit to a common set of This report shares the findings from the 11 company assess- fundamental freedom of expression and privacy principles, ments. Points of progress and areas for future shared learning grounded in international human rights law and commitments identified in the report include further consideration of how to accountability, collaboration, shared learning, and public companies integrate the GNI Principles into their business policy. After the publication of this report, each company operations, ways to enhance and expand training efforts inside will communicate to the public about the outcome of its companies, and developing tools and guidance on topics such assessment. as human rights due diligence (HRDD) and impact assessment. Going forward, GNI will work to integrate insights from this The assessments also provide insights into the external assessment cycle into our wider efforts to protect and promote operating environment for companies. These include ongoing freedom of expression and privacy in the ICT sector. Specific challenges around state surveillance and impediments to steps will include: transparency, challenges responding to government-ordered network disruptions, and the need for greater collaboration with ● A complete review of the assessment process to civil society and other stakeholders to engage governments to strengthen our standards and practices for the fourth GNI bring their laws and policies into alignment with international assessment cycle, human rights norms. ● The integration of findings from the assessments into shared learning across and within constituencies, and 2 This cycle of assessments provides a window into how a ● Using insights from the assessment to inform and growing number of companies from across the ICT sector enhance GNI’s collaborative engagement with govern- are exercising their responsibility to uphold the rule of law ments on freedom of expression and privacy rights. KEY NUMBERS OF THE THIRD ASSESSMENT CYCLE 4 Internet 6 companies Telecommunications network operators Executive Summary Executive 11 ➤ 33 COMPANIES INTERVIEWS CASE STUDIES ASSESSED RESPONDED TO SUGGESTIONS BY 125 GNI NON-COMPANY MEMBERS CASE STUDIES (civil society organizations, 1 investors, and academics) Telecommunications 86 equipment vendor 7 assessors 9 COMPANY selected to perform BOARD MEMBERS1 assessments 12 10 NON-COMPANY ACCREDITED BOARD MEMBERS ASSESSORS 3 1 The GNI Governance Charter describes the composition of the board. There can be up to 10 company representatives. In cases where there are open board seats in a constituency group, the voting authority for those open seats shall be evenly distributed among representatives of that constituency group on the board. 1 1) Introduction GNI IN THE ICT SECTOR ACCOUNTABILITY 1) Introduction ECOSYSTEM The GNI Principles are rooted in the rule of law and internation- About the Global Network Initiative ally recognized laws and standards for human rights. GNI was This is the public report on the third cycle of the Global Network founded to address the gap that can arise in this system, when Initiative (GNI) independent company assessment process. governments use national laws to compel ICT companies to GNI brings together companies, civil society organizations, take actions that infringe upon the freedom of expression and investors, and academics to enhance freedom of expression privacy rights of users. As a multistakeholder initiative, GNI’s and privacy in the information and communications technology core commitments complement the national laws and regu- (ICT) sector. By committing to the GNI Principles on Freedom of Expression and Privacy (“the GNI Principles”), our members lations that affect ICT sector companies, including consumer work to actively promote and facilitate responsible company privacy and data protection regulations. In this regard, GNI decision making and serve as a multistakeholder voice in the should be viewed as one component