Blog post written by Jean Monnet Professor ad personam, Elspeth Guild, Queen Mary University of London, and forms part of a series of blog posts examining the implementation of the Global Compact for Safe, Orderly and Regular Migration.*
Objective 1 expresses the commitment of states to strengthen the global evidence base regarding international migration by improving and investing in the collection, analysis and dissemination of accurate, reliable, comparable data. The challenge presented by this objective and stated in the objective itself, is to uphold the right to privacy under international human rights law and protect personal data.
The Right to Privacy is found in Article 12 UDHR:
no one shall be subject to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
Article 17(1) ICCPR gives further force to the right:
No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.
It further states:
everyone has the right to the protection of the law against such interference or attacks.
The GCM acknowledges that Objective 1 must uphold “the right to privacy under international human rights law and protect…personal data.” (paragraph 17). The provisions set out above constitute the framework of human rights to which GCM paragraph 17 refers.
In 2014 the UN General Assembly and the Human Rights Council approved a report on the right to privacy in the digital age produced at the General Assembly’s request by the Commissioner for Human Rights (OHCHR – A/HCR/27/37). Through this adoption, the international community established its opinion about the scope and meaning of the right to privacy contained in Articles 12 UDHR and 17 ICCPR. Accordingly regard must be had to the report to understand how best to achieve GCM Objective 1 while respecting the right to privacy.
1.
All collection of personal data presents challenges for the right to privacy. As the HRC report states “it follows that any capture of [communications] data is potentially an interference with privacy and, further that the collection and retention of communications data amounts to an interference with privacy whether or not those data are subsequently consulted or used.” While aimed specifically at communications data, the principle is clear – personal data collection is always an interference with the right to privacy. As such it must be contained in law and justified. There are two main ways in which personal data collection can be justified: first valid and informed consent by the data subject; secondly a valid overriding interest of society. Too often immigration authorities include boxes on applications which must be ticked for the application to be valid and which purport to provide the consent of the data subject to virtually unlimited use of his or her data. These practices are inconsistent with the right to privacy.
Indicator: There is a law which permits the collection of personal data for the purpose of generating migration statistics for policy use. The law fulfils the requirement that it is clear and accessible and limits the use of personal data to the explicit purpose for which it has been collected. Further, the law provides for the destruction of the original personal data as soon as it has been used for its exclusive single purpose.
2.
The justification for any interference with the right to privacy must be expressed in law and reflect the data minimisation principle. It is important to ensure that the use of personal data is clearly limited to what is necessary for a legitimate purpose. The OHCHR report grapples with the issue of content v metadata and clearly concludes that metadata which is only about the communication itself and not the content is equally personal data protected by international human rights law. In anonymizing data for the purposes of use in public policy, the possibility of reversal must be excluded to protect the individual.
Indicator: the law limits the purpose for which personal data is collected to a legitimate one which sets out the justification on the basis of statistical evidence for the interference. The same law limits access to personal data only to those authorities charged with its anonymization and no reversal to reveal the identity of individuals is possible. This is set out in law and specific institutions are legally responsible for its application.
3.
The interference with the right to privacy is only permissible if it is neither arbitrary nor unlawful. A law may be unlawful if it is not consistent with the ICCPR. The quality of the law must express the international law principles of legality, necessity and proportionality. Already Paragraph 17(g) GCM which calls for data collection “on country of birth, country of birth of parents, country of citizenship, country of residence five years before the census, most recent arrival date and reason for migrating” does not obviously fulfil the necessity and proportionality requirements. Many people asked questions like this will never have migrated but have been born citizens of their state of residence, though their parents may have migrated. This may constitute stigmatization on the basis of birth and national origin. GCM paragraph 17(g) provides no justification for the collection of such intrusive and potentially divisive data.
Indicator: laws which set out questions to be included in any census must include a justification for the collection of personal data on objective grounds. The law must clearly prohibit the collection of personal data which may endanger the right to privacy or any other human right (for instance data on gender preference etc). The international law principles of legality, necessity and proportionality must be respected.
4.
As the OHCHR report sets out, the right to privacy applies equally to citizens and migrants. No discrimination on the basis of nationality in the protection of privacy is permitted. Both citizens and migrants are entitled to equal access to privacy protections. This position is strengthened by Article 26 ICCPR which prohibits discrimination on any ground of race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status. States are required to protect the personal data of everyone regardless of the nationality or location of individuals.
Indicator: The law which sets out the power to collect personal data must also include a strict non-discrimination obligation in respect of that data. Further, all protections of the data subject which are contained in the law to comply with national and international obligations must be equally applicable to citizens and migrants.
5.
Procedural safeguards and effective oversight are necessary components of the right to privacy. Procedural safeguards must include effective and adequately resourced institutional arrangements. Further, independent oversight bodies charged with ensuring that the collection of personal data conforms with both national and international law must be empowered to review the collection, use, manipulation, storage and destruction of personal data.
Indicator: The law permitting the collection of personal data includes procedural safeguards for the data subject to ensure that the individual can check what is being done with his or her data. These must be clear and accessible. Further an independent oversight body is charged with reviewing the activities of the data collection authority to ensure that it complies with national and international binding standards.
These five issues and indicators set out a framework within which the collection of data as proposed in Objective 1 GCM can be tested regarding their compliance with international human rights law. In implementing Objective 1, states must ensure that the result of applying these indicators shows that the state is fully compliant with its international obligations.
*Many thanks to A Napolitano, Privacy International and Professor Jackie Bhabha, Harvard University for their most helpful comments on the draft.
The views expressed in this article belong to the author/s and do not necessarily reflect those of the Refugee Law Initiative. We welcome comments and contributions to this blog – please comment below and see here for contribution guidelines.