UPR: Universal Periodic Review

Digital rights are human rights: Holding Australia, Georgia, Myanmar, and Nauru to account at the U.N.

Countries around the world commit to protecting our rights as part of their international human rights obligations, including their participation at the United Nations (U.N). When they fail to protect these rights — such as by cutting off internet access in the middle of a global pandemic — there’s a mechanism we can use to call attention to that failure and press for change: the U.N. Universal Periodic Review (UPR).

In June, we joined partner organizations to submit UPR reports to the U.N. Human Rights Council (the Council) on Australia, Georgia, Lebanon, Myanmar, Nauru, and Rwanda. The Council uses reports like the ones we prepared to evaluate the situation for human rights in countries around the world, looking at information provided by (1) the government under review, (2) independent human rights experts and groups, such as U.N. entities, and (3) other stakeholders, which includes civil society actors like Access Now. This process sets up and fosters an ongoing dialogue between a country and the international human rights community, with the goal of establishing a human rights record and pushing the countries that are violating our rights to take action. The process is designed to ensure equal treatment of every country when their human rights situation is assessed.

At Access Now, we focus on digital rights — that is, human rights in the context of our use of digital technology and networked spaces. Our mission is to defend and extend the digital rights of those most at risk across the globe, including journalists, activists, human rights defenders, and members of marginalized and oppressed communities. In our reports on Australia, Georgia, Myanmar, and Nauru, summarized below, we call out government attacks on freedom of expression and access to the internet, increasing threats to journalists and activists, the rise of digital ID systems, and the deepening entrenchment and expansion of surveillance. We also offer a set of recommendations tailored to each country, which they should take to meet their human rights obligations. In addition to these four reports, Access Now joined a submission on Lebanon led by SMEX and Small Media, as well as a submission on Rwanda led by ARTICLE 19.

We’re grateful to be working alongside our civil society partners in this ongoing effort to advance human rights in the digital age. In January 2021 the Office of the High Commissioner for Human Rights (OHCHR) will publish final reports that compile recommendations by the stakeholders who engaged in the UPR process. We hope to see these governments commit to making the changes we recommend.

Australia: ramping up surveillance, using digital ID systems without sufficient privacy protections

In our report submitted in partnership with Digital Rights Watch, we highlight the Telecommunications Amendment Act in 2015, which introduced a harmful metadata retention scheme that is still in place. Journalists have an ethical obligation to protect the identity of confidential sources, and the Act threatens this capacity. While authorities can’t get access to a journalist’s metadata without first obtaining a Journalist Information Warrant, this kind of warrant is available to several government agencies. Authorities are not required to notify the journalist beforehand, and the warrant cannot be challenged. More recently, the Australian Parliament rushed into law the Telecommunications and Other Legislative Amendments (TOLA), which has become globally infamous for threatening encryption and the security of communications and internet infrastructure.

That’s not the only threat to journalists. Authorities in Australia have leveraged defamation laws against reporters, and police have carried out raids that target journalists, media outlets, and whistleblowers. These measures chill speech, as people self-censor due to the fear of harassment, intimidation, and prosecution. In our report, we also highlight the threat the 2019 Criminal Code Amendment Act poses, as it gives law enforcement agencies additional discretionary powers to remove online content.

Others are also at risk of privacy violations. Australia has sought to expand its surveillance powers both inside and outside the country. The threat posed by a surveillance state is exacerbated when the government in question lacks comprehensive, digital era privacy laws that meet international human rights standards.

The absence of such laws in Australia makes the implementation of digital identity programs dangerous. Australians are using two digital ID programs, the GovPass and the Digital iD, without having passed necessary legislation to prevent the government from misusing these systems to undermine Australians’ human rights.

Among our recommendations for Australia:

  • Revise the data retention scheme in order to restrict the scope and to require judicial warrants for access to metadata, to reduce the overall retention period requirement, and to extend protections and safeguards for journalists and whistleblowers who may be impacted by the creeping scope.
  • Repeal TOLA or heavily amend it in order to better protect the security of digital infrastructure, require transparency on the use of these powers and ensure that individual rights are protected in the day-to-day function of law enforcement agencies and intelligence services.
  • Review national legislation and policies to fully protect the safety and rights of individuals who speak up, including journalists, activists, and whistleblowers.
  • Update the federal-level Privacy Act, which currently grants little to no actual privacy and data protection for Australian users.
  • Take steps to establish a comprehensive legal framework around its digital identity programs.

Read the full report

Georgia: threatening media independence, greenlighting biometric data collection

In our report submitted with the Media Development Foundation, we acknowledge that Georgia has taken important steps to promote digital rights, but also highlight the stagnation and serious setbacks on certain issues. One such issue is freedom of expression, which is usually protected in Georgia, but is now threatened by the significant polarization of the media and government interference with both print and online media outlets, such as through allocation of funds and attempts to influence the governing bodies of these outlets. As a result of this interference, the media may serve the purpose of advancing the government’s agenda and interests, instead of fully informing the public through independent reporting. We also call attention to the shocking kidnapping of Afgan Mukhtarly, an Azerbaijani dissident journalist.

Connectivity is another troubling issue for Georgia, where there are problems with internet infrastructure that impact access to a high-speed and high-quality internet, which can render mobile coverage and internet penetration rates meaningless. This lack of adequate internet infrastructure also negatively impacts cybersecurity, as it makes networks — and the people who use them — vulnerable to cyber attacks and hacking.

When activists, human rights defenders, and journalists are able to connect, they are increasingly targeted for online harassment and intimidation. We highlight the hostile environment for women and people in LGBTQ+ communities on social media and other online platforms in Georgia, as they are suffering attacks, including by far-right and nationalist groups.

Privacy and data protection are critical for safeguarding the human rights of those already at risk. In Georgia, data protection law gives individuals a certain level of protection for privacy, but it also authorizes the government and the private sector to deploy surveillance technologies and strategies, including the collection of biometric data. Provisions of the law contain broad and vague language that opens space for the arbitrary use of surveillance, in contravention of international human rights standards. A number of regulations in Georgia give authorities sweeping powers to monitor and interfere with online communications, as well as to process large amounts of personal data. This regulatory framework undermines the right to privacy and the principles set out in Georgia’s data protection law.

There are also long-term threats to digital rights in Georgia. The judicial branch of the government lacks independence, which may compromise the ability of the courts to uphold and advance these rights.

Among our recommendations for Georgia:

  • Refrain from political interference in the work of local media, to ensure the existence of a free and independent press, whether print or online.
  • Repeal or amend the provisions of the Personal Data Protection Law concerning surveillance, as well as the 2017 legislative regulations on surveillance.
  • Do not use mass surveillance technologies and strategies against individuals, and ensure that any surveillance of digital communications is consistent with international human rights and conducted on the basis of a legal framework that is publicly accessible, clear, precise, comprehensive, and non-discriminatory.
  • Work to stop discrimination based on gender identity and sexual orientation, and develop a legislative and/or policy framework aimed to prevent and effectively remedy online threats and offenses based on perceived gender identity or sexual orientation.
  • Ensure the independence of the judicial branch in Georgia to safeguard the unbiased and fair application of human rights.

Read the full report

Myanmar: imposing internet shutdowns, criminalizing free expression, tracking via SIM cards and digital IDs

Jointly with Free Expression Myanmar, we submitted our report calling attention to the alarming state of digital rights in Myanmar. The country refuses to engage with international delegations, experts, and missions, and has not yet ratified the International Covenant on Civil and Political Rights (ICCPR).

Myanmar has a history of attacks on freedom of expression, and is continuing these attacks by applying a set of broad, vague, and abusive laws to prosecute those who exercise their free expression rights, including journalists, lawyers, artists, and users of social media platforms. The government has threatened to prosecute individuals who disseminate “fake news,” but under these laws, what constitutes “fake news” is likely to be determined by the government arbitrarily. In addition, the government has increased its control over dissemination of information through the National Records and Archives Law in 2019, which threatens the right to access information.

Among the bluntest attacks on free expression is the imposition of internet shutdowns. Myanmar imposed the longest shutdown of 2019, primarily in the areas where Rohingya Muslims reside and where there are conflicts between the Myanmar military and the Arakanese Army. New orders to block websites have further restricted freedom of expression and access to information. While the government has attempted to justify internet shutdowns as a measure to address conflict, that conflict is ongoing, illustrating the lack of efficacy shutdowns have shown for this or any other purpose.

Amid the COVID-19 pandemic, access to the internet becomes a matter of life and death, as individuals rely on the internet to seek and receive public health information to protect themselves, control the spread of the virus and exercise a wide range of human rights. Nonetheless, Myanmar continues to deny people access to timely and accurate information by refusing to lift the internet shutdown.

Myanmar is also expanding its surveillance capabilities, which has implications for free expression. The government recently implemented mandatory SIM card registration, requiring people who use mobile phones to hand over their personal information, including biometrics, to acquire a SIM card. This makes it easier to identify SIM card users, and enables telecommunication companies and the government to trace conversations to specific people, undermining their right to privacy. In addition, the government is developing a Digital Government program that will include a digital ID system and entail broad collection of individuals’ personal data, including biometric data.

Myanmar lacks legal protections for the rights that are at risk in surveillance. It does not have a regulatory framework to cover the interception of communications, proper safeguards for the digital ID system, or laws to ensure the transparency of government agencies that conduct surveillance. The absence of legal protections means the government could use both the mandatory SIM card registration and the digital ID system as mass surveillance tools, allowing authorities to monitor, identify, harass, and prosecute members of minority groups or any individual who speaks up against the government.

Our recommendations for Myanmar include:

  • Repeal or amend specific laws that undermine freedom of expression in order to bring Myanmar’s legal framework in line with international human rights law obligations.
  • Immediately lift all restrictions on internet access and restore telecommunications unconditionally to full capacity, and refrain from blocking lawful websites and applications, as well as manipulating network traffic to silence or favor particular voices or content, in addition to prohibiting any such practices by third parties.
  • Ensure universal access to a free, secure, and open internet, extending digital economic, educational, health, social, and cultural resources to all, and particularly to those in vulnerable communities and at-risk groups.
  • Enact a comprehensive data protection law to protect the right to privacy, and adequately fund and support its implementation.
  • Ensure that mandatory SIM card registration is not deployed to exclude individuals or target communities.
  • Do not make enrollment or participation in the digital identity program mandatory for receiving essential goods and services.

Read the full report

Nauru: restricting press freedom and the media, blocking sites and services, failing to protect whistleblowers

In our report on Nauru, we highlight a number of threats to the exercise of the rights to freedom of expression and access to information. These include provisions of the Crimes Act 2016 that criminalize defamation, the absence of legal protections to ensure access to information, and the government’s attempts to stop the media from reporting about what is happening in the country.

Nauru’s government seeks not only to control the media in the country, but also to prevent foreign journalists and independent observers from entry through visa restrictions. Nauru has banned journalists from the Australian Broadcasting Corporation from attending the Pacific Islands Forum that was held in Nauru in 2018. During the event, Nauruan police detained a journalist from New Zealand’s TVNZ who was interviewing refugees living in Nauru.

The government’s threatening approach to those reporting on the state of human rights in Nauru is creating a chilling effect on speech, as journalists and whistleblowers fear prosecution. Authorities in Nauru have also pursued reprisal against individuals who participate in protests to voice criticism of the government, impacting the right to freedom of assembly.

Nauru has also interfered with access to information online. In 2015, the government imposed an internet shutdown, blocking people from accessing certain websites, including Facebook, in what appears to have been an attempt to hide human rights violations allegedly perpetrated in the immigration detention center in Nauru. The block was lifted in 2018, but should not have been imposed to begin with, as any such restrictions contravene international human rights law.

Adding to these risks is the lack of laws to protect privacy in Nauru, opening space for the government to access and use personal data collected within the country.

Therefore, we recommend the government of Nauru:

  • Sign and ratify the International Covenant on Economic, Social and Cultural Rights.
  • Repeal or amend the provisions of the Crimes Act 2016 on criminal defamation in order to bring Nauru’s legal framework in line with international human rights law obligations.
  • Pledge to refrain from imposing any restrictions on internet access and telecommunications, and amend Article 12 of the Constitution to explicitly prevent the blocking or throttling of information and communications technologies, networks, applications, or services.
  • Ensure that national legislation and policies fully guarantee the safety of journalists, whistleblowers, and human rights defenders.
  • Refrain from restricting individuals’ right to freedom of peaceful assembly and association, pursuant to the ICCPR, or subjecting them to criminal prosecution or civil liability.
  • Enact a comprehensive data protection law to protect the right to privacy, and adequately fund and support its implementation.

Read the full report