Universal Periodic Review Stakeholder Report: 23rd Session, Lebanon The Right to Privacy in Lebanon

Submitted by Privacy International, Social Media Exchange and the Association for Progressive Communication The Right to Privacy in Lebanon

Stakeholder Report Universal Periodic Review 23rd S e s s io n - L e b a n o n

Subm itted by Privacy International, Social M edia Exchange and th e Association for Progressive Comm unication

March 2015 In tro d u c tio n

1.This stakeholder report is a subm ission by Privacy International,Social Media Exchange and Association for Progressive Com m unication. Privacy International (PI) is an international hum an rights organisation that works to advance and prom ote the right to privacy around the world. TheSocial Media Exchange (SMEX)is a registered Lebanese nonprofit that conducts tra in in g , re s e a rc h , a n d a d v o c a c y o n s tra te g ic c o m m u n ic a tio n s a n d h u m a n rig h ts in th e d ig ita l era. The Association for Progressive Comm unication (APC) is a n in te rn a tio n a l o rg a n iza tio n and network w ith EC O SO C Status. Its m ission is to em pow er and support organizations, social m ovem ents and individuals in and through the use of inform ation and com m unication te c h n o lo g ie s .

2.Together PI,SM EX a n d A P C w is h to b rin g th e ir c o n c e rn s a b o u t th e p ro te c tio n a n d p ro m o tio n of the right to privacy in Lebanon before the Hum an Rights C ouncil for consideration in Lebanon’s upcom ing review.

The right to privacy

3.Privacy is a fundam ental hum an right, enshrined in num erous international hum an rights in s tru m e n ts .1 It is central to the protection of hum an dignity and form s the basis of any dem ocratic society. It also supports and reinforces other rights, such as freedom of expression, information and association. The right to privacy em bodies the presum ption that in d iv id u a ls s h o u ld h a v e a n a re a o f a u to n o m o u s d e v e lo p m e n t, in te ra c tio n a n d lib e rty , a “private sphere” with or without interaction with others, free from arbitrary State intervention and from excessive unsolicited intervention by other uninvited individuals.2

4.Activities that restrict the right to privacy, such as surveillance and censorship, can only be ju s tifi e d w h e n th e y a re p re s c rib e d b y la w , n e c e s s a ry to a c h ie v e a le g itim a te a im , a n d proportionate to the aim pursued.3

5.As innovations in information technology have enabled previously unimagined forms of collecting, storing and sharing personal data, the right to privacy has evolved to encapsulate State obligations related to the protection of personal data.4 A num ber of international

1 Universal Declaration of Human Rights Article 12, United Nations Convention on Migrant Workers Article 14, UN Convention of th e P ro te c tio n o f th e C h ild A rtic le 1 6 , In te rn a tio n a l C o v e n a n t o n C ivil a n d P o litic a l R ig h ts , In te rn a tio n a l C o v e n a n t o n C ivil a n d Political Rights Article 17; regional conventions including Article 10 of the African Charter on the Rights and Welfare of the Child, Article 11 of the American Convention on Human Rights, Article 4 of the African Union Principles on Freedom of Expression, Article 5 of the American Declaration of the Rights and Duties of Man, Article 21 of the Arab Charter on Human Rights, and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedom s; Johannesburg Principles on National Security, Free Expression and Access to Information, Cam den Principles on Freedom of Expression and Equality. 2 Martin Scheinin, Report of the Special Rapporteur on the promotion and protection of human rights and fu n d a m e n ta l fre e d o m s w h ile c o u n te rin g te rro rism , 2 0 0 9 , A /H R C /1 7 /3 4 . 3 Universal Declaration of Human Rights Article 29; General Comment No. 27, Adopted by The Human Rights Committee Under Article 40, Paragraph 4, Of The International Covenant On Civil And Political Rights, CC PR/C/21/Rev.1/Add.9, November 2, 1999; see also M artin Scheinin, “Report of the Special Rapporteur on the prom otion and protection of human rights and fu n d a m e n ta l fre e d o m s w h ile c o u n te rin g te rro rism ,” 2 0 0 9 , A /H R C /1 7 /3 4 . 4 Human Rights Committee general comment No. 16 (1988) on the right to respect of privacy, family, home and correspondence, and protection of honour and reputation (art. 17). in s tru m e n ts e n s h rin e d a ta p ro te c tio n p rin c ip le s , 5 and many domestic legislatures have in c o rp o ra te d s u c h p rin c ip le s in to n a tio n a l la w . 6

Follow up to the previous UPR

6.There was no mention of the right to privacy and data protection either in the National Report subm itted by Lebanon or in the report of the W orking G roup.

7.However, at the last review, Armenia submitted a recommendation to Lebanon on guaranteeing freedom of expression w hich read,“C ontinue to guarantee freedom of expression7 c re a tin g a d d itio n a l c o n d itio n s fo r its fu lfi lm e n t.” 8 Domestic laws and regulations related to privacy

8.Article 14 of the Lebanese Constitution does ensure the inviolability of the hom e:

“The citizen's place of residence is inviolable. N o one m ay enter it except in the circumstances and manners prescribed by Law.”

9.Articles 8 and 13 of the Constitution indirectly protect the right to privacy9 w ith the fo rm er guaranteeing individual liberty and the latter freedom of expression. It had been interpreted th a t th e s e la w s in c lu d e th e s e c re c y o f a ll m e a n s o f c o m m u n ic a tio n s , b o th m a il a n d te le p h o n e calls.10

10.The Law No. 140 related to the protection of secrecy of com m unications carried out by all means of communication, stipulates that the right to secrecy of communications, both in te rn a l a n d e x te rn a l, b y a ll m e a n s w ire d o r w ire le s s (la n d lin e s a n d m o b ile o f a ll ty p e s in c lu d in g m o b ile te le p h o n e , fa x , e le c tro n ic m a ils ) is g u a ra n te e d a n d p ro te c te d b y la w a n d cannot be subjected to any forms of tapping, surveillance, interception or violation except in th e c a s e s , a n d b y th e m e a n s a n d p ro c e d u re s , p re s c rib e d b y la w . A rtic le 9 8 o f th e L e b a n e s e Code of Civil Procedures regulates the regime applicable to search and seizures.

11.Whilst there is no data protection framework in place, various laws protect personal data including, Article 2 of the Banking Secrecy Law of Septem ber 3, 1956 (the Banking Secrecy Law ), and the penal code under Article 579, 580 and 581 relating to the violation of secrets, Article 7 of the Code of M edical Ethics (Law no. 288 of February 22, 1994) protects the confidentiality of physician and patients relationships, and Articles 51 and 58 of the Consumer Protection Code (Law no. 659 of 4 February 2005) says that suppliers must not disclose data without the consent of the consum er.

5 See the Council of Europe Convention for the Protection of Individuals with regard to Autom atic Processing of Personal Data (N o . 1 0 8 ), 1 9 8 1 ; th e O rg a n iza tio n fo r E c o n o m ic C o -o p e ra tio n a n d D e v e lo p m e n t G u id e lin e s o n th e P ro te c tio n o f P riva c y a n d Transborder Data Flow s of Personal Data (1980); and the G uidelines for the regulation of com puterized personal data files (G eneral A ssem bly resolution 45/95 and E/C N .4/1990/72) 6 As of December 2013, 101 countries had enacted data protection legislation: David Banisar, National Com prehensive Data Protection/Privacy Law s and Bills 2014 Map (January 28, 2014). Available at SSRN : http://ssrn.com /abstract=1951416 or http://dx.doi.org/10.2139/ssrn.1951416 7 A /H R C /1 6 /1 8 , R e p o rt o f th e W o rk in g G ro u p o n th e U n iv e rs a l P e rio d ic R e v ie w , L e b a n o n , H u m a n R ig h ts C o u n c il, S ix te e n th session, Agenda item 6. Available at: http://daccess - dds - ny . un . org / doc / UNDO C / GEN / G11/102/11/PD F / G1110211.pdf? OpenElement 8 As noted by Frank La Rue, “The right to privacy is often understood as an essential requirement for the realization of the right to f 9 Special Tribunal of Lebanon, Case No. STL-11-01/T/TC, p a ra . 2 9 . A v a ila b le a t: http://ww w .stl-tsl.org/en/the-cases/stl-11- 01/m ain/filings/replies-and-responses/defence-team -counsel/f1857 10 HiiL, The Rule of Law in Lebanon: Prospects and Challenges, H ill R u le o f L a w Q u ic k S c a n S e rie s , A p ril 2 0 1 2 , p p . 1 8 . A v a ila b le a t: http://www . hiil . org / data / / media / Quickscan _ Lebanon_160812_digitaal _ def . pdf In te rn a tio n a l o b lig a tio n s re la te d to p riv a c y

12.Lebanon is a signatory to the Universal D eclaration of Hum an Rights (‘UD H R’), for w hich it was on the drafting Committee, and has ratified the International Covenant on Civil and Political Rights (‘ICC PR’). Article 17 of the ICC PR, which reinforces Article 12 of the UD HR, provides that “no one shall be subjected to arbitrary or unlaw ful interference with his privacy, fa m ily, h o m e o r c o rre s p o n d e n c e , n o r to u n la w fu l a tta c k s o n h is h o n o u r a n d re p u ta tio n ” . T h e Human Rights Committee has noted that states parties to the ICCPR have a positive obligation to “adopt legislative and other m easures to give effect to the prohibition against such interferences and attacks as well as to the protection of this right [privacy].”11

13.The preamble of the Lebanese Constitution s ta te s : “ “Lebanon is also a founding and active mem ber of the United Nations O rganization and abides by its covenants and by the U niversal D eclaration of H um an Rights. The Government shall embody these principles in all fields and areas without exception.”

14.In a d d itio n , th e A p p e a ls C h a m b e r's 12 jurisprudence affirms that the right to privacy, as provided for in the UD HR and the ICC PR, has constitutional value under Lebanese law .

15.The International Principles on the Application of H um an Rights to C om m unications Surveillance13 a re n o t le g a lly b in d in g b u t p ro v id e c la rity a s to h o w in te rn a tio n a l h u m a n rig h ts la w a p p lie s in th e c u rre n t d ig ita l e n v iro n m e n t. In o rd e r to m e e t th e ir in te rn a tio n a l h u m a n rig h ts obligations to uphold the fundam ental right to privacy, States must com ply with the principles these principles set out including: legality, legitim ate aim , necessity, adequacy, proportionality, com petent judicial authority, due process, user notification, transparency, public oversight, integrity of com m unications and system s, safeguards for international cooperation, safeguards against illegitimate access and right to effective remedy.

16.By co-sponsoring both UN G eneral Assem bly on the right to privacy in the digital age, A/RES/68/167 adopted in December 2013 and A/RES/69/166 adopted in December 2014, Lebanon re-affirmed its com m itment to prom oting, respecting and ensuring the right to privacy as a hum an right.

Areas of Concern

I. L a c k o f c o n s titu tio n a l p ro te c tio n o f th e rig h t to p riv a c y

17.The Constitution in Lebanon does not explicitly protect the right to privacy. The Constitution only protects the inviolability of the hom e, but fails to protect the secrecy of com m unications.

18.Given the information provided below on the extensive powers of the Lebanese government to c o n d u c t s u rv e illa n c e o f c o m m u n ic a tio n s , th is C o n s titu tio n a l o v e rs ig h t is w o rry in g , especially in light of the lack of other robust privacy safeguards elsew here under Lebanese la w .

11 General Comment No. 16 (1988), para. 1 12 See CH/AC/2011101, Decision on partial appeal by Mr El Sayyed of Pre-Trial Judge's decision of 12 May 2011, 19 July 2011, para. 60 and footnote 102; Lebanese Constitutional Council, decision no. 2/2001, 10 May 200 I, published in Al-majless al- doustouri (200 1-2005) [Constitutional Council review (200 1-2005)], para. 61. 13 See: https://necessaryandproportionate.org/ II. C o m m u n ic a tio n s u rv e illa n c e

19.Lebanon w as the first Arab country to introduce, in 1999, a legal framew ork for the in te rc e p tio n o f c o m m u n ic a tio n s , a lth o u g h th e la w w a s n o t a d o p te d b y th e C a b in e t u n til 2 0 0 9 .

20.The first provision of the Telecom m unication Interception Act of 27 O ctober 1999 (thereafter re fe re n c e d a s L a w 9 9 /1 4 0 ) e s ta b lish e s th e p rin c ip le a c c o rd in g to w h ic h th e rig h t to m a k e confidential internal or external calls by using telecom m unications m eans (such as fixed te le p h o n e s , m o b ile d e v ic e s o f a n y ty p e w h a ts o e v e r in c lu d in g c e llu la r p h o n e s , fa x , e -m a il) is protected by the law and is not to be subject to any form of w iretapping, m onitoring, in te rc e p tio n o r d is c lo s u re .

21.Law 99/140 restricts any breach of secrecy and limits interferences with privacy to cases of extreme urgency and upon obtaining a judicial or adm inistrative order.

22.The judicial authorisation process, as outlined in Article 2 and Article 3 of the Law, states that interception may be authorised by court order in cases of emergency, provided the targeted in d iv id u a l is th e s u s p e c t o f a c rim e . T h e c o u rt o rd e r s h o u ld s p e c ify th e m e a n s o f com m unication, subject matter of the procedure, the crime subject matter of the prosecution or the investigation, and the duration of interception, which may not exceed 2 months.

23.In accordance w ith A rticle 9, com m unications interception can also occur on the basis of the adm inistrative authorisation of either the m inister of interior or the m inister of defence, after obtaining the approval of the Prime M inister in order to gather information aimed at com bating terrorism , crimes against state security, and organized crime. To b e law fu l, su c h decisions must be approved in writing, duly justified and approved by the Prime Minister and should specify the m eans of com m unication, subject m atter of the procedure, the subject matter of the prosecution or the investigation, and the duration of interception, which may not exceed two months.

24.As a safeguard against abuse, A rtic le 1 6 s tip u la te s th a t s u c h a d m in is tra tiv e d e c is io n s m u s t b e verified by an independent judicial com m ission. The judicial panel consisting of the first president of the C ourt of C assation, the president of the State Shura C ouncil, and the president of the C ourt of Audits, or three judges from separate and independent judicial bodies.

25.Whilst the law seems to provide the necessary safeguards, in practice systematic failures to abide by the law are directly threatening the right to privacy of Lebanon's citizens.

Lack of application of judicial oversight of adm inistrative authorisation

26.Based on information obtained by Al-Ahkbar, a Beirut-based m edia outlet, from the retired President of the Court of Audits, it appears that the actual role of the judiciary in authorising or overseeing the adm inistrative authorisation of interceptions is merely sym bolic. In practice, th e P rim e M in iste r ro u tin e ly c irc u m v e n ts th e re q u ire m e n t fo r ju d ic ia l a u th o risa tio n b y d ire c tly authorising intercepts himself.14

27.This situation is very concerning as allo w in g a m e m b e r o f th e e x e c u tiv e b ra n c h to a u th o ris e th e in te rc e p tio n o f c o m m u n ic a tio n s u n d e rm in e s a c c o u n ta b ility a n d in c re a s e s th e like lih o o d o f arbitrary and politically motivated surveillance. As the UN Special Rapporteur on the freedom

14 Nazzal, M., The surveillance state: No privacy for the Lebanese, A l-A k h b a r, 1 3 M a y 2 0 1 4 . A v a ila b le a t: http://english . al- akhbar . com / /1 9 7 5 1 node of expression and opinion stated in his 2013 report, Article 12 UD HR implies that “[...] S ta te surveillance of com m unications m ust only occur under the m ost exceptional circum stances and exclusively under the supervision of an independent judicial authority.” 15 Political authorisation does not place a sufficient check on what is an extremely invasive intrusion into th e e n jo y m e n t o f th e rig h t to p riva c y.

28.In failing to im plem ent and respect A rticle 16 of the law , Lebanon is failing to m eet its their in te rn a tio n a l h u m a n rig h ts o b lig a tio n s in re la tio n to p ro te c tin g th e rig h t to p riv a c y w h e n conducting com m unications surveillance. D eterminations related to com m unications surveillance m ust be m ade by a com petent judicial authority that is impartial and in d e p e n d e n t.16 In a d d ition , th e L e b a n e se a u th o rities sh o u ld e sta b lish ind e p e n d e n t o ve rsigh t mechanisms to ensure the transparency and accountability of the surveillance authorisation processes. The oversight m echanism m ust be independent of the executive, properly re s o u rc e d to c o n d u c t in v e s tig a tio n s , a n d a b le to c o m m a n d p u b lic c o n fi d e n c e th ro u g h re g u la r re p o rtin g a n d p u b lic s e s s io n s .

Unauthorised bulk interception of data

29.It is c le a r th a t a t le a s t o n e L e b a n e s e s e c u rity a g e n c y, th e In te rn a l S e c u rity F o rc e s ('IS F ') engages in the unauthorised bulk interception of data for prolonged periods of time.

30.In D ecem ber 2012, it w as reported that the Inform ation Branch of the ISF had sought the interception and retention of all SM S text m essages sent in Lebanon from 13 Septem ber to 10 N ovem ber 2012. The ISF justified its request as part of its investigation into the car bom bing that had occurred on 19 October 2012 in Beirut, w hich killed W issam Al Hassan, the head of ISF. The details of the types of data requested w as contested but a leaked docum ent from the M inistry of Information show ed that the types of data included 2G and 3G data subscribers in Lebanon, including log files, IP addresses, usernames, phone num bers, addresses, names, and passw ords.17

31.Lebanon’s Telecom m unications M inister, N icolas Sehnaoui, refused the request18 b u t it w a s re p o rte d th a t th e g o v e rn m e n t n e v e rth e le s s o b ta in e d a c c e s s to th is d a ta .19

32.In M arch 2014, another controversial debate arose as the governm ent approved a proposal permitting the ISF full, unrestricted access to the electronic com m unications data of all Lebanese citizens.20 J u d g e A w n y R a m a d a n , h e a d o f th e L e b a n e s e a c c o u n ta b ility a g e n c y , s a id th a t th e b la n k e t a n d a rb itra ry g o v e rn m e n t re q u e s ts fo r th e c o m m u n ic a tio n d a ta o f a ll fo u r million Lebanese citizens is a violation of the Law 99/140 given that every single citizens cannot be a suspect of a crime.21 A lso , th e d e c isio n p e rm itte d fu ll a c c e s s fo r a p e rio d o f s ix months, which is far beyond the two months permitted by the Law 99/140 under Article 9.

33.The U nited N ations International Independent Investigation C om m ission (UN IIIC), and the Special Tribunal for Lebanon (STL), which were set up to investigate assassinations in the country, particularly that of the late prime m inister Rafik H ariri in 2005, have also taken

15 A/HRC /23/40 at para. 81 16 www.necessaryandproportionate.org 17 Bow e, R., Data Request from Lebanese Security Agency Sparks Controversy, E le c tro n ic F ro n tie r F o u n d a tio n , 2 7 D e c e m b e r 2 0 1 2 . Available at: https://www . eff . org / deeplinks/2 0 1 2 /1 2 /le b a n e s e - security - agency - user - data - re q u e s t - sparks - controversy 18 Republic of Lebanon, Ministry of Telecom m unication, The M inistry of Com m unications will not implement any Data request if it to u c h e d th e fre e d o m s o f th e L e b a n e s e a n d re p re s e n te d a n a s s a u lt to th e ir p riva c y. Available at: http://www . mpt . gov . lb / in d e x . php / en / about - mpt-2 /mpt - in - press/1 1 8 -th e - ministry - of - com m unications - will - not - - any - data - re q u e s t - if - it - to u c h e d - th e - fre e d o m s - of - th e - le b a n e s e - and - re p re s e n te d - an - assault - on - th e ir - privacy 19 Chakrani, H., Lebanon Security Forces: Give Us Your Facebook Passw ord, A l-A k h b a r, 4 D e c e m b e r 2 0 1 2 . A v a ila b le a t: http://english . al - akhbar . com / content / le b a n o n - security - fo rc e s - give - us - your - fa c e b o o k - password 20 Global Voices Advocacy, Law 140: Eavesdropping on Lebanon, 1 0 A p ril 2 0 1 4 . A v a ila b le a t: http:// . globalvoicesonline . org/2 0 1 4 /0 4 /1 1 /la w -1 4 0 -eavesdropping - on - le b a n o n / 21 Ib id advantage of com m unications interception pow ers to permit the ISF unregulated access to private data of Lebanese citizens from an array of sources including university archives, medical records, and mobile phone records.22 There are som e cases pending before the Special Tribunal for Lebanon where the expansive access to user data is being challenged.23

34.An independent com m ission in Lebanon confirmed that, even in the context of intelligence gathering, as opposed to judicial investigations,“providing the full com m unication database on all Lebanese territories in a periodic m anner violates the provisions of effective law s because it am ounts to a clear violation of basic freedom s.”24 T h is ind e p e n d e n t c o m m issio n also considered that the transfer of the full contents of SM Ss sent through the two operating mobile telephone companies all over the Lebanese territories was unlawful.25

35.These findings com port with that of the UN High Com m issioner for Hum an Rights, Navi Pillay, in h e r 2 0 1 4 re p o rt o n th e rig h t to p riv a c y in th e d ig ita l a g e , in w h ic h s h e s ta te d th a t “th a t a n y capture of com m unications data is potentially an interference with privacy and, further, that th e c o lle c tio n a n d re te n tio n o f c o m m u n ic a tio n s d a ta a m o u n ts to a n in te rfe re n c e w ith p riva c y whether or not those data are subsequently consulted or used.... The very existence of a mass surveillance programme thus creates an interference with privacy.”26

36.The bulk interception of and access to data directly challenges the principles of necessity and proportionality that m ust be applied w hen conducting any activities w hich interfere w ith fu n d a m e n ta l h u m a n rig h ts . C o m m u n ic a tio n s s u rv e illa n c e (in c lu d in g in te rc e p tio n a n d a c c e s s to d a ta ) s h o u ld b e re g a rd e d a s a h ig h ly in tru s ive a c t th a t in te rfe re s w ith h u m a n rig h ts a n d th re a te n s th e fo u n d a tio n s o f a d e m o c ra tic s o c ie ty. D e c isio n s a b o u t s u c h a c tivitie s m u s t consider the sensitivity of the information accessed and the severity of the infringem ent on hum an rights and other com peting interests.

Monitoring by non-state actors

37.The U S State D epartment reported in its H um an Rights Report of Lebanon in 2013, that “m ilitias and non-Lebanese forces operating outside the area of central government authority also frequently violated citizens’ privacy rights. Various factions, such as H izballah, used in fo rm e r n e tw o rk s a n d te le p h o n e m o n ito rin g to o b ta in in fo rm a tio n re g a rd in g th e ir p e rc e iv e d adversaries.”27 The ab ility o f no n-state acto rs to co nd uct co m m unications m o nito ring is o f extreme concern given these activities are unregulated by law which is heightened by the lack of safeguard in place to protect the privacy of citizens.

Purchase of internet monitoring system s

38.In January 2013, the C itizen Lab of the U niversity of Toronto published a research brief 28 in which it reported that researchers had discovered threeBlue C oat PacketShaper

22 Freedom House, Freedom on the Net 2014: Lebanon. A v a ila b le a t: https://fre e d o m h o u s e . org / re p o rt / fre e d o m - net/2 0 1 4 /le b a n o n 23 See for example: Prosecution v Ayyash et al., C a s e N o . S T L -1 1 -0 1 /T /T C . A v a ila b le a t: Available at: http://ww w .stl-tsl.org/en/the- cases/stl-11-01/m ain/filings/replies-and-responses/defence-team -counsel/f1857 24 In a n o p in io n d a te d 8 N o v e m b e r 2 0 1 2 o n a C o u n c il o f M in is te rs D e c is io n ta k e n in a p p lic a tio n o f a rtic le 9 o f L a w 1 4 0 /9 9 to authorise the transfer of the entire com m unication data of Lebanon from 19 Septem ber 2012 to 31 Decem ber 2012 data to security and m ilitary agencies, 4D 00104 25 In a n o p in io n d a te d 2 1 N o v e m b e r 2 0 1 2 o n a C o u n c il o f M in is te rs D e c is io n ta k e n in a p p lic a tio n o f a rtic le 9 o f L a w 1 4 0 /9 9 to authorise the transfer of the full contents of SM Ss sent through M IC1 and M IC2 all over the Lebanese territories, 4DO O 105. 26 A/HRC /27/37 at para. 20 27 U.S. State Department, Lebanon 2013 Hum an Rights Report. A v a ila b le a t : http://www . state . gov / docum ents / organization/2 2 0 5 7 5 .pdf 28 CitizenLab, P la n e t B lu e C o a t: M a p p in g G lo b a l C e n s o rs h ip a n d S u rv e illa n c e T o o ls , R e s e a rc h B rie f, N u m b e r 1 3 , J a n u a ry 2 0 1 3 , University of Toronto, MUNK School of Global Affairs. Available at: https://citizenlab . org / wp - content / uploads/2 0 1 3 /0 1 /Planet- Blue - Coat . pdf in s ta lla tio n s 29 in various countries including Lebanon. PacketShaper is a technology that allow s for the surveillance and monitoring of users’ interactions on various applications such as Facebook, Tw itter, Google M ail, and Skype.30 W h ils t s u c h to o ls c a n b e u s e d fo r le g itim a te aims, such as controlling bandw idth costs, they also have the functionality to permit filtering, censorship, and surveillance. C itizen Lab noted they had identified two installations of PacketShaper. One was found on “a netblock associated with IncoN et Data M anagem ent.” An additional PacketShaper installation was identified by a Google search on a netblock associated with “Virtual ISP Lebanon” (visp).”31

39.The discovery of the installations came in the context of the government drafting a regulation pertaining to controlling online content concerning public m orals. Although this draft re g u la tio n w a s la te r a b a n d o n e d , th e re s e a rc h e rs n o te d th a t th is w a s a n in te re s tin g fi n d in g given that Lebanon did not have a history of internet filtering prior to the publication of the draft regulation.32

Limiting access to internet and mobile services

40.Often held out to be one of the more liberal countries in the region in terms of openness and diversity of the media, limitations on the freedom to express do occur in Lebanon33 a n d th e re have been several alleged attempts by State institutions and non-State actors to censor or shut dow n online forum s and social m edia platform s.34

41.Research conducted by Social M edia Exchange into the blocking of websites in Lebanon in 2013 show ed that the blocking of websites is being done inconsistently across ISPs.35

42.In accordance w ith the 2002 Telecom m unication Act 36, s o m e Voice over Internet Protocol (V o IP ) a p p lic a tio n s a re b lo c k e d , b u t s o m e n o t a ll.37 There seem s to be no clear and tra n s p a re n t p o lic y a s to h o w s u c h d e c isio n s a re m a d e . T h e g o v e rn m e n t c la im s th a t V o IP a re im p o s s ib le to b a n b u t m u s t b e d e re g u la te d a s th e y c a u s e s m illio n s o f d o lla rs o f lo s s , “ T h e Ministry teams are currently working on a formula that would allow private operators to sell th e s e rv ic e , p ro v id e d th e y s h a re re v e n u e s w ith th e S ta te ” .38 VoIP applications are m ore secure, and thus an increasing num ber of individuals are resorting to using them such as jo u rn a lis ts , p o litic a l a c tiv is ts , b u t if p e o p le a re fo rc e d to u s e tra d itio n a l p h o n e lin e s , th e n th e re is a c o n c e rn th a t it is p ro v id in g th e g o v e rn m e n t w ith a n in c re a s e a b ility to c o n d u c t surveillance.

Restrictions and limitation on anonym ity

29 Ib id , p p . 2 5 . “ A ll th re e w e re in itia lly id e n tifi e d b y S h o d a n in D e c e m b e r 2 0 1 2 a n d w e re v e rifi e d a s a c c e s s ib le . T h e s e w e re o n netblocks associated with Hughes Network System s, which is a satellite-based Internet provider. The hostnam es of the IP addresses of these installations resolve to the iWayAfrica dom ain, which is an African provider of broadband Internet service.” 30 Blue Coat, Applications that Blue Coat PacketShaper Classifies and Controls. A v a ila b le a t: http:// . bluecoat . com / sites / default / files / docum ents / files / PacketShaper _ Application _ List . c . pdf 31 CitizenLab, Appendix A: Summ ary Analysis of Blue Coat “Countries of Interest, 1 5 J a n u a ry 2 0 1 5 . A v a ila b le a t: www://citizenlab . org/2 0 1 3 /0 1 /appendix - a - sum m ary - analysis - of - blue - coat - countries - of - in te re s t/ 32 CitizenLab, P la n e t B lu e C o a t: M a p p in g G lo b a l C e n s o rs h ip a n d S u rv e illa n c e T o o ls , R e s e a rc h B rie f, N u m b e r 1 3 , J a n u a ry 2 0 1 3 , University of Toronto, MUNK School of Global Affairs. Available at: https://citizenlab.org/wp-content/uploads/2015/03/Planet- Blue-Coat-Mapping-Global-Censorship-and-Surveillance-ToolsPlanet-Blue-Coat-Mapping-Global-Censorship-and-Surveillance- Tools.pdf 33 Zayadin, H., Lebanese governm ent moves to control expression in the online realm , IF E X , 2 8 M a rc h 2 0 1 4 . A v a ila b le a t: https://www . ife x . org / le b a n o n /2 0 1 4 /0 3 /2 8 /bloggers _ fa c in g _ th re a ts / 34 Freedom House, Freedom on the Net 2014: Lebanon. A v a ila b le a t: https://fre e d o m h o u s e . org / re p o rt / fre e d o m - net/2 0 1 4 /le b a n o n 35 Social Media Exchange, Blocked websites in Lebanon 2013,8 J a n u a ry 2 0 1 4 . A v a ila b le a t: http://www . sm ex . org / blocked - websites- in - le b a n o n -2 0 1 3 / 36 Telecom m unication Law 431/2002. Available at: http://ww w .tra.gov.lb/Telecom -Law-431-2002 37 Freedom House, Freedom on the Net 2014: Lebanon. A v a ila b le a t: https://freedom house.org/report/freedom -net/2014/lebanon 38 Ministry of Telecommunications, Progress Report 2013, p p . 3 0 . A v a ila b le a t: http://www . ta y y a r . org / ta y y a r / te m p MOT_2013_En . pdf 43.There have been unconfirmed reports of extralegal m ethods used to identify anonym ous online users.

44.A report by the Open Society Foundation notes how such incidents remain low-profile and are often not reported by the individual as they feel intimidated and threatened.39

45.When anonymity is challenged or undermined this means that citizens, and in particular those speaking out against the governm ent, have little or no protection from surveillance, fa c ilita tin g th e g o v e rn m e n t’s e ffo rts to m o n ito r a n d id e n tify th e m .

Lack of oversight of security agencies

46.There are several state institutions which have the pow er to conduct surveillance and access user data, nam ely the G eneral Directorate of G eneral Security.40, the G eneral D irectorate of In te rn a l S e c u rity F o rc e s (IS F )41 a n d th e A rm y In te llig e n c e D ire c to ra te .

47.The G eneral D irectorate of G eneral Security, is a Lebanese intelligence agency, w hich w as fo u n d e d o n 2 1 Ju ly 1 9 2 1 . W ith th e a d o p tio n o f D e c re e N o . 1 3 9 o f 1 2 Ju n e 1 9 5 9 , th e G e n e ra l Security Directorate became a special branch of the Ministry of Interior. Its main task and fu n c tio n is to c o llec t a n d g a th e r Inte llige n c e , an d to info rm th e L e b a n e se g o ve rn m e n t w ith th e a im o f e n s u rin g th e n a tio n a l s e c u rity a n d p u b lic o rd e r th ro u g h o u t th e te rrito ry o f th e Republic of Lebanon.

48.The G eneral D irectorate of Internal Security Forces (ISF) is the national police and security fo rc e o f L e b a n o n . It d ire c tly re p o rts to th e M in istry o f In te rio r.

49.The Cybercrime and Intellectual Property Rights Bureau officially operates under the umbrella of the judicial police but its legality is contested, given that it w as established under a memorandum of service rather than by the Law or Decree.42 T h e re h a v e b e e n re p o rts o f th e Bureau acting as a censorship authority m ainly targeting journalists, bloggers and online activists.43 Its exp ansive p o w ers illustrate the p o o r o versight und er w hich in o p erates, and ra ise s c o n c e rn s a s to th e la c k o f s a fe g u a rd s p ro te c tin g p riva c y a n d re g u la tin g th e p o w e rs o f th e B u re a u .

50.Article 16 of the Law 99/140 restricts the powers of the Ministry of Interior to wiretap, but in practice this provision does not seem to be respected. It was reported by A l-A k h b a r, a B e iru t- based media outlet, based on inform ation obtained from high-level judicial and parliam entary sources that “all security services, without exception, continue to illegally operate their ow n wiretapping divisions of unknown nature and scope... This means that there are no guarantees the security services are not eavesdropping on the Lebanese aw ay from any legal oversight.”44 In a d d itio n , in th e s a m e a rtic le , th e m e d ia o u tle t q u o te s a s e n io r ju d ic ia l so u rc e saying, “the security services them selves do not trust each other. If they all operated through th e s u rv e illa n c e c e n tre ru n b y th e M in istry o f In te rio r in a c c o rd a n c e w ith th e la w , e v e ry o n e w ill be able to see what other security services are up to. Because they som etimes com pete, aw ay from national interests, each agency has its ow n ‘centre’ away from the law.”

39 Open Society Foundations, Mapping Digital Media: Lebanon, 1 5 M a rc h 2 0 1 2 , p p . 9 2 . A v a ila b le a t: http:// . opensocietyfoundations . org / sites / default / files / mapping - digital - media - le b a n o n -2 0 1 2 0 5 0 6 .pdf 40 General Directorate of General Security. See: http://www . general - security . gov . lb / Default . aspx ? la n g =en - us 41 In te rio r S e c u rity F o rc e s . S e e : http://www . is f . gov . lb / en 42 Al-Akhbar, Cybercrime Bureau's ever-growing powers threatening freedom s in Lebanon, 22 November 2014. Available at: http://english . al - akhbar . com / node/2 2 6 0 5 43 Zayadin, H., Lebanese governm ent moves to control expression in the online realm , IF E X , 2 8 M a rc h 2 0 1 4 . A v a ila b le a t: https://ww w .ifex.org/lebanon/2014/03/28/bloggers_facing_threats/ 44 Nazzal, M., The surveillance state: No privacy for the Lebanese, A l-A k h b a r, 1 3 M a y 2 0 1 4 . A v a ila b le a t: http://english . al- akhbar . com / /1 9 7 5 1 node 51.These various security agencies are failing ensure that their policies and practices adhere to international hum an rights and adequately protect the rights to privacy and freedom of expression. The different various security services, their remit and operations m ust be re v ie w e d to m e e t/ th e s ta n d a rd s s e t b y International Principles on the A pplication of H um an Rights to Com m unications Surveillance.45 T h e S ta te s h o u ld b e tra n s p a re n t a b o u t th e u s e a n d scope of com m unications surveillance techniques and pow ers.

Foreign spying

52.There have been on-going reports of attempts by the Israeli government to infiltrate the Lebanese telecom m unication system.46 In c id e n ts h a v e o c c u rre d a fte r a n n o u n c e m e n t o f Is ra e l having destroyed spying equipm ent in Lebanon which was then discovered by the Lebanese authorities. Such incidents took place in Decem ber 2011, February and July 2012,47 a n d m o re re c e n tly in S e p te m b e r 2 0 1 4 .48

53.In 2 0 1 2 , K a s p e rs k y L a b 49, a Russian m ultinational com puter security com pany, published re p o rt s h o w in g th e y h a d d isc o v e re d F la m e , a n a tio n -s ta te c re a te d m a lw a re , in Ira n a n d various other countries in the M iddle East and the m ajority of infected m achines w ere in Lebanon.50 The research w as unable to determine w hether the bank com ponent of the malware was used to spy on financial/banking transaction or steal money, but some have argued that given in was state-created, it is likely the motivation was not only econom ic gain but sought counterintelligence data too.51

54.Such spying facilities and use of such sophisticate espionage tools directly threaten the privacy of Lebanese citizens as well as the security of the telecom m unication network and infrastructure, and the financial sector. These threats em phasise the need for the im p le m e n ta tio n o f s tro n g data protection standards to ensure that the Lebanese governm ent meets its international legal obligations to protect the privacy of its citizens from external th re a ts .

III. D a ta p ro te c tio n

55.Lebanon does not have a law regulating the protection of personal data. Privacy is regulated by other provisions as outlined above, including the Law 99/140 related to the protection of secrecy of com m unications carried out by all m eans of com m unication, the law 03/09/1956 on banking secrecy, and the penal code under Article 579, 580 and 581 relating to the violation of secrets.

45 Launched in Septem ber 2013 follow ing a year of consultation, the International Principles on the Application of Hum an Rights to Communications Surveillance a set of standards that interpret States’ human rights obligations in light of new technologies and surveillance capabilities. The Principles are endorsed by 410 civil society organisations around the world, over 40 leading experts, academ ics and prom inent individuals, as well as 4 elected officials. The Principles set for the first time an evaluative fram ew ork fo r a s s e s s in g s u rv e illa n c e p ra c tic e s in th e c o n te x t o f in te rn a tio n a l h u m a n rig h ts la w . P le a s e re fe r to th e www.necessaryandproportionate.org w e b s ite fo r fu rth e r d e ta ils . 46 Freedom House, Freedom on the Net 2014: Lebanon. A v a ila b le a t: https://freedom house.org/report/freedom -net/2014/lebanon 47 BBC New s, Is ra e l d e s tro y s 's p y d e v ic e s ' in s o u th e r L e b a n o n , 3 J u ly 2 0 1 2 . A v a ila b le a t: http://www . bbc . co . uk / new s / world - middle- east-1 8 6 9 1 7 9 2 48 The Associated Press and Khoury, J., Is ra e l d e to n a te s s p y in g d e v ic e in s o u th L e b a n o n , re p o rt s a y s , 6 S e p te m b e r 2 0 1 4 . A v a ila b le at: http://www . haaretz . com / new s / diplomacy - defense/1 .61 4 3 4 3 49 Kaspersky,Kaspersky Lab Discovers ‘Gauss’ – A New Com plex Cyber-Threat Designed to Monitor Online Banking Accounts, 9 August 2012. Available at: http://www . kaspersky . com / about / new s / virus/2 0 1 2 /Kaspersky _ Lab _ and _ IT U _ Discover _ Gauss _ A _ New _ Complex _ Cyber _ Threat _ D esigned _ to _ Monitor _ Online _ Banking _ Accounts 50 Raad, M., Surveilling the banking sector in Lebanon, published in Global Information Society Watch 2014: Com m unications Surveillance in the Digital Age. Available at: http://giswatch . org / en / country - re p o rt / com m unications - surveillance / le b a n o n 51 Zetter, K., Flame and Stuxnet cousin target Lebanese bank custom er carries mysterious payload , W ire d , 8 S e p te m b e r 2 0 1 2 . Available at: http://www . wired . com /2 0 1 2 /0 8 /gauss - espionage - to o l/ 56.Given the lack of a data protection regime, the current issues of concern in the area of data protection include:

Unique ID number e-government initiative and the impending deployment of biometric passports

57.In 2002, Lebanon launched its first e-governm ent initiative w hich w as then updated in 2007 to in c lu d e th e e s ta b lis h m e n t o f a U n iq u e Id e n tity N u m b e r (U IN ) u n d e r th e 'e -c itiz e n ' p illa r o f th e strategy. The governm ent noted that this w as a pre-requisite to the Sm art card.52 T h e id e n tity card includes 10 fingerprints and palm prints as w ell as the holder's m other's and father's nam e. 58.In 2013, the governm ent of Lebanon announced that it w ould start using biom etrics passports as a result of a request by the United N ational International C ivil Aviation Organization (ICAO). ICAO has set a deadline of 24 November 2015 for all of its members to adopt biom etric technologies.

59.It w as recently announced 53 th a t Inkript, a L e b a n o n -b a se d R e so u rc e G ro u p H o lding (R G H ), who had submitted a joint offer with Gemalto, a digital security company with its headquarters in the Netherlands, had won the tender to supply Lebanon with security-print biometric passports. Inkript would manage the program m ing and software development in- house, and G em alto w ould be in charge of m anufacturing the passports and the m atch program m e's interface with the coding machines.

60.The passport will include a SIM card-sized chip which would include data on the identify and criminal history of the passport holder as well as fingerprints and facial recognition.

61.Given the lack of a data protection framework and a robust Constitutional protection of the rig h t to p o lic y, b io m e tric p a s s p o rts w ill b e d e p lo y e d in a c o m p le te le g a l v o id w h ic h w ill fa il to re g u la te a n d lim it th e p u rp o s e o f th e u s e o f b io m e tric d a ta o f c itize n s . T h u s , it c a n p o te n tia lly be used as a tool for surveillance through profiling, data mining and big data analysis.

62.The use of biom etric technology can be problematic:54  The data processed is at risk of being misused and is subject to fraud;  It c a n re s u lt in m is id e n tifi c a tio n a n d in a c c u ra c ie s ;  Its n a tu re re n d e rs it e x c lu s io n a ry  Its u n re g u la te d re te n tio n ra is e s q u e s tio n s o f “ fu n c tio n c re e p ” (u s e s o f b io m e tric d a ta fo r purposes for which it was not originally collected) and concerns around the safety of the data

63.Additionally, the physical or digital structure in which biom etric data is stored m ust be developed to ensure the safety of the data. If they are to be used, centralised mass data system s m ust be regulated by clear legislation in order to eliminate the possibility of the governm ent or third parties (i.e. private sector actors) taking advantage of the existence of th e d a ta fo r (n e w ) u n fo re s e e n p u rp o s e s .

64.An additional concern is the involvement of a non-Lebanese com pany, G emalto, in the process raises concerns as to the ow nership of data, and the responsibility and accountability of the government and the com pany to protect the data from abuse, theft, and lo s s . G iv e n th a t L e b a n o n d o e s n o t h a v e a d a ta p ro te c tio n la w , it is e s s e n tia l th a t th e governm ent takes the steps necessary to ensure the protection of its citizens’ personal data

52 Minister of State for Administrative Reform, High Level e-government strategy Document: Lebanon, e -G o v 2 0 0 7 , p p . 1 2 . A v a ila b le at: http://ww w .om sar.gov.lb/C ultures/en- US/Publications/Strategies/Documents/4a8c1c25f5f9444aa94923c5e4d38cacHighLevelEGovernmentStrategyAM 21Jan08.pdf 53 Bank Audi, The Lebanon W eekly M onitor, F e b ru a ry 2 3 -M a rc h , 0 1 , 2 0 1 5 , W e e k 0 9 , p . 9 . A v a ila b le a t: http://www . bankaudi . com . lb / GroupWebsite / openAudiFile . aspx ? id =2534 54 Privacy International (2013) B io m e tric s : F rie n d o r fo e o f p riv a c y ? A v a ila b le a t: https://www . privacyinternational . org / sites / privacyinternational . org / files / file - dow nloads / biometrics _ frie n d _ or _ fo e . pdf when engaging with third parties. Given the recent revelations that Gemalto's office network had been the target of attacks in 2010 and 2011, “probably”55 by the N SA, the U.S. in te llig e n c e a g e n c y , a n d G C H Q , th e B ritis h in te llig e n c e a g e n c y , it is im p o rta n t to n o te h o w such com panies have now becom e the target of intelligence agencies, and so they are vulnerable to attacks.

Data retention56

65.It w as reported in 2013, that an order issued on 7 June 2013 by the Public Prosecutor's office re q u e s te d a ll in te rn e t s e rv ic e p ro v id e rs (IS P s ), a n d s o m e in te rn e t c a fe s th a t o ffe r In te rn e t access, to retain the data of their users' activity for a period of one year.57 The order in s tru c te d “ a ll la n d lin e a n d w ire le s s in te rn e t s e rv ic e p ro v id e rs fo r h o m e s a n d c o m p a n ie s a n d fro m a ll c a fé s a n d s to re s p ro v id in g th e ir c lie n ts w ith d e v ic e s th ro u g h w h ic h th e y c a n a c c e s s th e In te rn e t” to “ d o w h a te v e r it ta k e s to a c tiva te a n d s a v e a ll In te rn e t lo g fi le s g o in g th ro u g h th e ir s e rv e rs a n d ro u te rs , a n d p re p a re a p e rio d ic a l b a c k u p c o p y to s a v e th e s e fi le s fro m being lost, for at least one year.”58 T h e o rd e r a lso o u tline s th e typ e o f u se r d a ta th a t m u st re ta in e d in c lu d in g th e u s e rn a m e , u s e r’s IP a d d re s s , th e w e b s ite s to w h ic h s /h e c o n n e c te d , and the protocols used in the process, in addition to specifying the user’s location.

66.Data retention is broadly presented as a method to combat serious crime such as organized crime and terrorism 59. These goals are generally considered adequate objectives to attem pt to c o m b a t. T h a t d o e s n o t m e a n th a t a ll m e a s u re s ta k e n in a c h ie v in g th a t o b je c tive a re le g itim a te , a n d it ra is e s q u e s tio n o f n e c e s s ity a n d p ro p o rtio n a lity . 60

67.As was noted by the UN Office of the High Com m issioner for Human Rights (OHC HR) in its re p o rt o n th e rig h t to p riva c y in th e d ig ita l a g e ,61 “any capture of com m unications data is potentially an interference w ith privacy and, further, that the collection and retention of com m unications data amounts to an interference with privacy whether or not those data are subsequently consulted or used. Even the m ere possibility of com m unications inform ation being captured creates an interference with privacy with a potential chilling effect on rights, in c lu d in g th o s e to fre e e x p re s s io n a n d a s s o c ia tio n .”

E-transaction bill

68.In 2010, Lebanon proposed a new Law on electronic transactions.62 The Law was intended to address m ultiples issues including the regulation of electronic signatures, w hich is a legal is s u e ; e -c o m m e rc e tra n s a c tio n s , w h ic h is a c o m m e rc ia l is s u e ; a n d re s p e c t fo r in d iv id u a l privacy and the protection of personal freedom s.

55 Gemalto, Gemalto presents the findings of its investigations into the alleged hacking of SIM card encryption keys by Britain's Government Communications Headquarters (GCHQ) and the U.S. National Security Agency (NSA), 2 5 F e b ru a ry 2 0 1 5 . A v a ila b le at: http://ww w .gem alto.com /press/Pages/G em alto-presents-the-findings-of-its-investigations-into-the-alleged-hacking-of-SIM - card-encryption-keys.aspx 56 Privacy International, Mass Surveillance, P riv a c y 1 0 1 . A v a ila b le a t: https://www . privacyinternational . org / re s o u rc e s / privacy- 101/mass - surveillance 57 Freedom House, Freedom on the Net 2014: Lebanon. A v a ila b le a t: https://freedom house.org/report/freedom -net/2014/lebanon 58 Nash, M., Providers tracking customers' Internet use, N o w , 2 9 N o v e m b e r 2 0 1 3 . A v a ila b le a t: https://now . mmedia . me / lb / en / re p o rts fe a tu re s /523209-523209-523209-providers - tra c k in g - custom ers - in te rn e t - use 59 Digital Rights Ireland v Minister for Communications, Marine and Natural Resources et al., European Court of Justice, C-293/12, para. 41-44. Available at: http://curia . europa . eu / ju ris / docum ent / docum ent . js f? te x t=&docid=150642& pageIndex=0& doclang=en&mode=ls t&dir=&occ=first&part=1&cid=322968. 60 Klass and Others v Germany, European Court of Hum an Rights, Application No. 5029/71, para. 49. Available at: http://hudoc . echr . coe . in t / sites / eng / pages / search . aspx ? i=001-57510 61 A/HRC /27/37, para 20 62 Khaddaj, A., Lebanon's proposed internet law struggles to gain IT sector support, A l-S h o rfa , 1 7 A u g u s t 2 0 1 1 . A v a ila b le a t: http://al - shorfa . com / en _ GB / articles / meii / fe a tu re s / main/2 0 1 1 /0 8 /1 7 /-0 2 69.At the time, civil society organisations raised concerns about Article 82 of the Bill which would allow for w arrantless search and seizure of financial, m anagerial, and electronic files, in c lu d in g h a rd d riv e s , c o m p u te rs , e tc . a n d A rtic le 7 0 o n th e E le c tro n ic S ig n a tu re & S e rv ic e s Authority, a new regulatory and licensing body with practically unchecked powers. One main criticism was that the Bill had not been opened for public consultation thus failing to allow civil society and other stakeholders from contributing and being part of the law m aking process.63 70.In 2012, the E-transaction bill w as sent to Parliam ent under D ecree, N o. 9341 dated of 8 October 2012, but this law remains a draft law.

Recom m endations

71.We recommend that the government of Lebanon to:

• Recognise and take steps towards com pliance with international hum an rights law and standards by ensuring the application of the follow ing principles to com m unication surveillance as articulated in the International Principles on the A pplication of H um an Rights to Com m unications Surveillance nam ely, legality, legitimacy, necessity, adequacy, proportionality and respecting process of authorisation from a com petent judicial authority, with due process, user notification, transparency, public oversight and respect fo r th e in te g rity o f c o m m u n ic a tio n s a n d s y s te m s a s w e ll a s e n s u rin g s a fe g u a rd s a g a in s t ille g itim a te a c c e s s a n d rig h t to e ffe c tiv e re m e d y ;

• Investig ate claim s that illeg al co m m unicatio ns intercep tio n and access to d ata is ro utinely undertaken by the security services and other state authorities; ensure that such practices are ended and responsible individuals held to account if the claims are verified and victims redressed for the violation they experienced;

• Ensure that there are appropriate controls to prevent the use of private surveillance in d u s try p ro d u c ts to fa c ilita te h u m a n rig h ts a b u s e s ;

• Ensure that the state surveillance of online and offline activities is lawful and does not in frin g e o n h u m a n rig h ts d e fe n d e rs ’ rig h t to fre e d o m o f e x p re s s io n a n d a b ility to d e fe n d hum an rights, including through use of the information com m unication technologies;

• Im m e d ia te ly e n a c t d a ta p ro te c tio n le g is la tio n th a t c o m p lie s w ith in te rn a tio n a l s ta n d a rd s ;

• Establish an independent data protection authority

• Make further efforts to ensure freedom of opinion and expression in the country, in c lu d in g b y e n s u rin g th a t b lo c k e d o r fi lte re d w e b s ite s a re b a s e d o n la w fu l c rite ria .

63 Social Media Exchange, AC T NO W : Postpone the Vote on the E-Transaction Law , 1 4 J u n e 2 0 1 0 . A v a ila b le a t: http://www . sm ex . org / act - now - postpone - th e - vote - on - th e - e - tra n s a c tio n s - la w /