AUTHOR2015 ONE, AUTHOR TWO, Corporate & AUTHOR THREE ThisAccountability is the Title ofIndex the Report The Ranking Digital Rights 2015 Corporate Accountability Index evaluates 16 of the world’s most powerful Internet and telecommunications companies on their commitments, policies, and practices that affect users’ freedom of expression and privacy. Developed in partnership with NOVEMBER 2015 OPEN TECHNOLOGY INSTITUTE | @NEWAMERICA | REPORT TYPE | JULY 5, 2014 | RELEASE 3.0 Acknowledgements About Ranking Digital Rights Ranking Digital Rights staff: Ranking Digital Rights is a non-profit research initiative housed at New America’s Open Technology Institute Rebecca MacKinnon, Director in Washington D.C., working with an international network of partners to promote greater respect for Allon Bar, Research Coordinator and freedom of expression and privacy by focusing on the Human Rights Specialist policies and practices of companies in the information communications technology (ICT) sector. For more Priya Kumar, Research Analyst information, please visit rankingdigitalrights.org. Tim Libert, Open Technology Fund Fellow For a full list of all people who contributed research for About Sustainalytics this Index please see rankingdigitalrights.org/who/affiliates. Headquartered in Amsterdam, Sustainalytics is an independent ESG and corporate governance research, The 2015 Corporate Accountability Index, plus related ratings, and analysis firm supporting investors around methodological research and stakeholder consultations the world with the development and implementation conducted by the Ranking Digital Rights project since of responsible investment strategies. With 13 offices 2013, was supported by the following funders: globally, Sustainalytics partners with institutional investors who integrate environmental, social and • John D. and Catherine T. MacArthur Foundation governance information and assessments into their investment processes. Today, the firm has 230 staff • John S. and James L. Knight Foundation (2014 members, including more than 120 analysts with varied Knight News Challenge) multidisciplinary expertise across more than 40 sectors. • Ford Foundation For the past three years, Sustainalytics has been named the best independent responsible investment research • Open Society Foundations firm in Extel’sI RRI survey of institutional investors. For more information, visit sustainalytics.com. • The William and Flora Hewlett Foundation • The Shuttleworth Foundation (Flash Grant) • Media Democracy Fund • Hivos People Unlimited • Global Engagement Fund (Provost’s Office, 2013), University of Pennsylvania • Internews Center for Innovation and Learning For a full list of institutional partners please see the project website at rankingdigitalrights.org/who/partners. i2 Contents Executive summary 4 4 1. INTRODUCTION 6 1.1 What and why 6 1.2 Our approach 9 2. KEY FINDINGS 11 2.1 The bad news 12 2.2 The good news 14 3. RECOMMENDATIONS 16 3.1 For companies 16 3.2 For governments 18 3.3 For all others: Individuals, advocates, activists, investors, and researchers 18 4. CATEGORY ANALYSIS 20 4.1 Commitment 20 4.2 Freedom of expression 22 4.3 Privacy 27 5. COMPANY REPORTS 32 5.1 Internet Companies 33 Facebook, Inc 33 Google 35 Kakao Corp. 37 Mail.ru Group 39 Microsoft 41 Tencent 43 Twitter, Inc 45 Yahoo 47 5.2 Telecommunications Companies 49 América Móvil 49 AT&T 51 Axiata 54 Bharti Airtel 56 Etisalat 59 MTN 61 Orange 64 Vodafone 67 6. APPENDIX 70 6.1. Methodology 70 6.2. Table of Company Results Per Indicator 76 2 5. COMPANY REPORTS 32 CORPORATE ACCOUNTABILITY INDEX 5.1 Internet Companies 33 Facebook, Inc 33 Overall results for Internet and telecommunications companies Results are tallied from 31 indicators across three categories: Commitment, Freedom of Expression, and Privacy. Google 35 Kakao Corp. 37 INTERNET COMPANIES Total Commitment Freedom of Expression Privacy Mail.ru Group 39 Google 65% 78% 68% 57% Microsoft 41 Yahoo 58% 80% 53% 52% Tencent 43 Microsoft 56% 82% 46% 53% Twitter, Inc 45 Twitter, Inc. 50% 35% 58% 51% Yahoo 47 Kakao Corp. 47% 39% 59% 42% 5.2 Telecommunications Companies 49 Facebook, Inc. 41% 62% 35% 36% 49 América Móvil Tencent 16% 8% 19% 17% AT&T 51 Mail.Ru Group 13% 2% 23% 11% Axiata 54 Bharti Airtel 56 TELECOMMUNICATIONS COMPANIES Total Commitment Freedom of Expression Privacy Etisalat 59 Vodafone 54% 75% 47% 49% MTN 61 AT&T 50% 57% 42% 52% Orange 64 Vodafone 67 Orange 37% 73% 29% 24% América Móvil 22% 11% 27% 25% 70 6. APPENDIX MTN 18% 22% 20% 14% 6.1. Methodology 70 Bharti Airtel 17% 13% 16% 21% 6.2. Table of Company Results Per Indicator 76 Axiata 16% 0% 23% 17% Etisalat 14% 3% 21% 14% RANKINGDIGITALRIGHTS.ORG 3 EXECUTIVE SUMMARY Ranking Digital Rights’ inaugural Corporate share user information. Without such information it is Accountability Index evaluates 16 of the world’s most difficult to hold companies, governments, and other powerful Internet and telecommunications companies actors accountable when users’ rights are undermined. on their commitments, policies, and practices that affect users’ freedom of expression and privacy. • Disclosure about collection, use, sharing, and retention of user information is poor. Even By opening the door for greater corporate transparency companies that make efforts to publish such and public scrutiny of business practices, the Index information still fail to communicate clearly with encourages companies to do a better job of respecting users about what is collected about them, with their users’ rights around the globe. whom it is shared, under what circumstances, and how long the information is kept. To view in-depth results, download data, and access related resources, news, and updates, please visit: • Disclosure about private and self-regulatory rankingdigitalrights.org processes is minimal and ambiguous at best, and often non-existent. Few companies disclose Highlights data about private third-party requests to remove or restrict content or to share user information – There are no “winners.” Even companies in the even when those requests come with a court order lead are falling short. or subpoena, or are made in accordance with established legal processes such as a copyright Across the board, companies need to improve their “notice-and-takedown” system. Even fewer disclosure of policies and practices that affect users’ companies disclose any information about whether freedom of expression and privacy, as well as their – let alone how – they receive or respond to private commitments to these human rights. or informal requests. Further, no companies in the Index disclose any information about actions they • Only six companies scored at least 50 percent of the have taken to enforce their terms of service. total possible points. The highest score was only 65 percent. • In some instances, current laws and regulations make it more difficult for companies to respect • Nine companies scored at least 30 percent, the minimum threshold for companies to demonstrate freedom of expression and privacy. However, meaningful effort to respect users’ rights. there are still actions companies can take to improve. All of the ranked companies face some • Seven companies – nearly half – scored between legal or regulatory requirements that hinder their 13-22 percent, demonstrating a serious deficit performance on certain indicators. For example, of respect for users’ freedom of expression and laws in many countries forbid companies from privacy. disclosing national-security related government requests. Some companies face more domestic Users are left in the dark about many company political, legal, and regulatory obstacles to practices that affect freedom of expression and respecting users’ rights than others, because some privacy. countries’ political and legal frameworks are less compatible with international human rights No company in the Index provides users with sufficiently standards. Nonetheless, we have identified ways clear, comprehensive, and accessible information about that all companies can improve their performance, their practices that affect freedom of expression and even without changes to their political, legal, and privacy. These practices include companies’ handling regulatory environments. of user information, terms of service enforcement, and government and private requests to restrict content or 4 There is also good news: • Demonstrate a credible commitment to security. Companies should provide evidence that they • Each of the companies in the Index is doing maintain industry standards of encryption and something well. All of the companies we evaluated security, educate users about potential threats, have at least some practices and/or policies in and disclose basic information about their security place that help to protect freedom of expression or practices, including whether employee access to privacy. user information is monitored and whether the company conducts security audits. • “Transparency reporting” is becoming a standard practice. Nine of the 16 ranked companies publish • Carry out due diligence to understand and some information about requests they receive address the impact of products, services, from governments or private parties to share user and business operations on users’ rights. information, and/or to remove or block content, Companies that are serious about respecting users’ deactivate accounts, or deny access to service. human rights need to undertake regular impact assessments that examine potential risks to freedom • Seven of the companies