Innovations in Democratic Oversight of Surveillance from OGP Members

Overview

• Limitations on surveillance are necessary for a prosperous society.
• Citizen oversight is an essential part of that function.
• Citizen oversight requires investment in (a) transparencyAccording to OGP’s Articles of Governance, transparency occurs when “government-held information (including on activities and decisions) is open, comprehensive, timely, freely available to the pub... More and disclosure of activities and impacts; (b) public access to formal oversight mechanisms; (c) adequate safeguards for private sectorGovernments are working to open private sector practices as well — including through beneficial ownership transparency, open contracting, and regulating environmental standards. Technical specificat... activity; and (d) records management.

Safeguards to protect privacy, democracy, and free expression need to keep up with evolving technologies, including surveillance technologies. Protecting from abuses of surveillance by the executive requires legislative and judicial counterweight. Just as importantly, however, the public oversight of the purchase, use, and disposal of surveillance technologies (and the information they produce) is necessary to ensure that interference of private communications is legal and proportionate.

This document outlines steps governments can take to improve public oversight of surveillance technologies. It is based on the experiences and standards across a range of OGP countries, including a number of important commitments undertaken in OGP action plans. It aims to inspire new commitments and reforms to enhance public oversight in this critical policy area.

Why Limit Surveillance?

Limits on surveillance are essential for the protection of privacy. Privacy is an intrinsic good in its own right and is essential to the functioning of democratic societies.

• Personal reasons: Individuals and families need` to be able to express themselves and interact in private spaces, virtual and real.
• Protection of property and personal safety: Sharing of data, especially location data, can lead to dangerous intimidation, violence, or harassment.
• Protection of speech and right to dissent: Maintaining privacy is essential for free thought, and in turn, essential for free expression, which is the cornerstone of democracy and human rightsAn essential part of open government includes protecting the sacred freedoms and rights of all citizens, including the most vulnerable groups, and holding those who violate human rights accountable. T....
• Commercial standards and harmonization: Companies working across borders, including in the trade of online goods and services, seek regulatory harmonization to ensure that products are compatible with the market rules in a variety of countries, including rules around data protection. In addition, they have a reasonable expectation of fair competition, which includes protection from commercial espionage.

Beyond the instrumental arguments for limits on surveillance, there is a strong normative basis for safeguards. International law limits the extent of surveillance and increasingly has become the norm under national and regional law.

• The Necessary & Proportionate Principles provide guidance on how human rights law applies to digital surveillance to ensure that surveillance is only justified when prescribed by law, when it is necessary to achieve a legitimate aim, and proportionate to the aim pursued.
• The Tshwane Principles, developed collaboratively by civil society, government, and private sector, give guidance on how the law can establish safeguards to national security surveillance.
• The right to privacy and the right to freedom of expression without interference are both human rights enshrined in the Universal Declaration of Human Rights.
• Increasingly, governments around the world are enacting national privacy and data protection laws.

Surveillance in the Open Government Partnership

Citizen oversight has been central to the Open Government Partnership (OGP) since its earliest days. In fact, Ambassador John Kerry first acknowledged the Snowden leaks, which uncovered the extent of US surveillance, while speaking at the OGP Global Summit in London in 2013. It was around this time that a large group of civil society organizations working on OGP in their respective countries urged the international community and OGP members to review their national laws and to commit to greater transparency in matters related to surveillance technology.

Since early efforts at the international level, several countries have adopted such commitments in their OGP action plans.

Potential Reforms

Below are a set of reforms to enhance public oversight and democratic controls on interventions of private communications. Recommendations are based on actions made by OGP members in these or tangentially related topics.

Transparency and Disclosure of Activities and Impacts

• Foster implementation of impact assessments: Require ministries, departments and agencies executing a program or procuring contracts and granting to carry out privacy risk screening and impact assessments.
  • Tools: There are three increasingly common types of impact assessment used which have overlapping functions. (See “Privacy Impact Assessments” below.)
    • Privacy impact assessment: – to establish specific effects on personal data and information
    • Algorithmic impact assessment – might go beyond personal impacts to collective impacts, such as effects on democracy or discrimination, but is limited to data processing
    • Human rights impact assessment – may include the right to privacy among other core rights such as the right to seek and share information

• Establish a presumption of openness in administrative procedures: Require acting officers to make a positive case for secrecy of a decision-making process before an established, independent commission. Exemptions should be narrow, legally-based, and specific. Special attention within the context of surveillance procurement and deployment should minimize claims of confidential business information, trade secrets, and minimize secret law. Dozens of OGP countries have made significant commitments in this area.
• Establish a presumption of openness in procurement: Require acting officers to make a positive case for secrecy before an established, independent commission for procurements meeting a certain threshold. If such cases are not approved, contracting from tender to execution and evaluation should be part of an open contracting procedure. These exemptions should be rare. Australia, which has such a rule, has flagged 2.7% of all national security contracts, a small number, even in an area of activity known for secrecy.
• Establish data processing registers: Establish a public data processing register which allows for public oversight of data processing (usually defined, at a minimum, as “collection, storage, modification, transfer, and disposal.”) The GDPR requires all EU member states to publish such registers. France’s data protection register is the first such register, although dozens are expected to come online in coming months, even beyond the EU.

Formal Oversight

• Establish a multi-stakeholder oversight body: This body would be composed of officials, permanent staff, and qualified members of the public selected through a transparent process and standards. The mandate may include:
  • Review and recommendation of policy and practices
  • Examination of specific individual actions
  • Receipt of complaints
  • Referral of evidence or cases to public advocates

  Some OGP members have established oversight bodies in other sectors such as public procurement. Ukraine’s ProZorro e-procurement system includes DoZorro, a citizen monitoring platform. DoZorro allows citizens to access data, submit feedback and flag irregularities, which are then channeled to the appropriate authority.

• Establish or enhance a Data Protection Authority: 
• • Data protection authorities would typically have a mandate to carry out the following oversight functions (See “South Africa and Brazil” examples below.)
    • Ensuring regular, periodic reporting and compliance with transparency requirements (see below) of regulated entities;
    • Investigating for particular harms and referencing findings and recommendations to appropriate judicial authorities. These may be triggered by public requests or initiated directly by the authority;
    • Ensure regular reporting to parliament on surveillance and personal data protection regime.
  • Some authorities would have the following powers:
    • Subpoena powers for documents and testimony (including ability to hold non-compliant individuals in contempt);
    • Ability to initiate independent investigations;
    • Ability to assign fines or other sanctions to regulated entities that are found not to be compliant;
    • Training for individuals, communities, and other levels of government in rights, procedures, and compliance.
• Establish surveillance courts
• • Establish specialized transparency courts with a mandate to protect privacy and minimize intrusion according to constitutional and statutory requirements.
  • Maintain meta-data on personal data requests to track how many agencies made requests, including the number of denials, appeals, nullifications and confirmation by courts.
  • Ensure public parliamentary oversight by requiring periodic reviews of performance of courts relative to their mandate of privacy protection and civil liberties.

• Whistleblower protection for security staff 

• • Establish a chain of complaints and appeals that allows security staff to file cases of waste, fraud, and abuse in agency actions. Such a chain of complaints would allow whistleblowers to go directly to an ombudsman’s office, inspectorates or their equivalent without exhausting the chain of immediate supervisors. In turn, inspectorates, auditors, and ombudsman offices may be required to report such cases in detail to parliamentary oversight committees with appropriate security protocols.

• • Establish a legal right of action for those complaining of whistleblower retaliation.

• • Establish personal liability for retaliation by superior officers toward whistleblowers. This would include a range of remedies from restoration and fines, to removal from office and potential criminal charges for egregious cases.

• Whistleblower protection for private contractors – Many security and surveillance activities are outsourced to private contractors who do not benefit from the same  channels for reporting wrongdoing and employment protection from retaliation. (See “United States: Whistleblower Protection”
  for more.)

• Private and public interest right of action – Establish a private right of action for individuals to seek remedy and redress when they have established a material violation of privacy. Where such a right exists, such a right may be enhanced through:

• • Statutory implementation of constitutional writ of amparo or the writ of habeas data in cases where an individual (natural or legal) or community believes there to be a harm or potential harm.

• • The establishment of administrative and judicial courts, which allow for, among other things, challenging decisions issued by the Data Protection Authority.

• • Loosening restrictions on standing (to allow for amicus curiae filings) and class actions in cases of surveillance and privacy; some statutes may establish “public interest” rights to allow legal persons to seek redress and remedy for harms to the public interest.

• • Establishment of material supports for filers of complaints, such as ombudsmans’ offices, removal of court fees for public interest action (including “English rule” court costs), and protections for filers, especially of vulnerable groups.

Private Sector Transparency Regulation

• Prior and informed consent in terms of service – Establish a requirement of free, prior, informed consent for data processing. This should, at a minimum, require opt-out options for digital services and the ability to restrict data transfers.

• Fiduciary risk disclosure

• • For publicly traded companies listed on official stock exchanges and public employee pension plans, require quarterly public disclosure to regulators and shareholders on major actions impacting privacy or creating a risk of liability for privacy.

• • Require major lending institutions to disclose privacy impacts and risks in annual reports.

• Telecommunications and internet service provider (ISP) transparency reporting – Require or coordinate private companies and telecommunications utilities to publish official government requests for content removal, warrants, unwarranted requests for content removal, and other cooperation through transparency reports. See an example here.

• Procurement blacklist – Establish and maintain a publicly searchable blacklist/database of private sector contractors who have been found by oversight authorities to have violated the right to privacy. Ensure that all beneficial owners (above 10%) are included in the blacklist and that such data is required to be regularly updated and interoperable with company and ownership registries, politically exposed persons databases, and official asset disclosureAsset declaration laws are an essential safeguard against corruption that require public servants to disclose information on their wealth, possessions, and other interests. Technical specifications: A... databases.

Records Management

• Establish limitations of the right to privacy for holders of public office and government employees in their duties as public officers. This would minimize the ability to use take down requests on public records or protected speech. (The Grand Chambers of the European Union, for example, have ruled this illegal. The European Court of Human Rights has significant case law on balancing the right to informationThe legal right to request information from the government allows the public to follow government decision-making, participate in ensuring better decisions, and hold the government accountable. Techni... and personal data protection.)

• Require historical archives declassification. In cases of national security or privileged information, require declassification of security documents after a set time period. Establish declassification as automatic and default, requiring agencies to request continued classification. After continuous civil society criticism, the US made a significant number of steps on security declassification through OGP, including unexpectedly declassifying its drone program in 2016.

• Publish metadata on classified documents. By publishing metadata on classified records (with appropriate removal of high-risk information), future researchers will be able to corroborate metadata with actually released information. (See Canada “Records management” below.)

• Establish processes for systematic disposal of private personal data after a certain time period. Where there are pending legal cases, establish procedures for maintaining those records.