A/HRC/28/39 44. Many delegations recalled that any limitation to the right to privacy must be based on accessible, transparent, clear, comprehensive and non-discriminatory laws and be limited to what was necessary to safeguard the public interest in a democratic society. Any state surveillance of individuals must be proportionate and fair, in compliance with international norms and standards, governed by the rule of law and subject to oversight. There must be adequate and effective guarantees against abuses. It was noted that defining the line between arbitrary or unlawful interference in the right to privacy properly would be one of the challenges of the next few years. It was also stressed that blanket surveillance could amount to an unjustified infringement. One delegation noted that article 17 of the Covenant must be the basis for discussion of the limiting principles – legality and arbitrariness – expressly stated therein. 45. Several delegations noted that States had legitimate security concerns, including the threat of terrorism and cybercrime. One delegation noted that the use of the Internet for criminal and antisocial activities was on the rise. Another delegation noted that security required intelligence, including with regard to digital communications to counter terrorism, while another stated that Governments had the responsibility to protect individuals, and that data surveillance could be an effective and legitimate measure for law enforcement purposes. There was broad agreement, however, that legitimate security concerns needed to be addressed within the framework of international human rights law, including the right to privacy. 46. In response to a question about data-sharing between government agencies, Ms. Nyst stated that the same oversight and procedural guarantees should apply to information collected directly and obtained through the sharing of information. Ms. Cleveland noted that the Human Rights Committee had expressed concern in that regard.8 Data sharing between various State agencies within a given country could be legitimate, provided the purpose of the collection and use of that data was the same for each of those agencies, so as to ensure compliance with the principles of necessity and proportionality and therefore no breach of the right to privacy. 47. Some delegations noted that the Internet transcended traditionally existing geographical boundaries. Several delegations recalled that, as stated in the report of the High Commissioner, human rights law applied when a State exercised power outside its own territory, so that it could not avoid its international human rights obligations and bypass its own national laws by taking action outside its territory, which it would be prohibited from taking at home. Several delegations recalled that article 17 of the International Covenant on Civil and Political Rights must be read in conjunction with article 2 of the Covenant, which states that the obligations of States apply to all individuals within their territory and subject to their jurisdiction. Several delegations noted that any interference with the right to privacy should comply with the principles of legality, proportionality and necessity, regardless of the nationality or location of individuals whose communications are under direct surveillance. While many delegations stressed that the responsibility of the State to protect the right to privacy did not end at its borders, some delegations expressed concerns about expansive views on the extraterritorial application of the Covenant and called for an in-depth discussion on the issue of extraterritoriality with regard to article 17. 48. Ms. Nyst recalled that most surveillance took place within a State. On the question of citizenship-based distinctions for the purpose of surveillance, she noted that not only were those distinctions in violation of the principle of non-discrimination, but it was also a very outdated and impractical approach, because it was difficult – if not impossible – to 8 12 See Human Rights Committee general comment No. 16 (1988) on the right to privacy, para. 10.