A/HRC/28/39 7. The Deputy High Commissioner recalled that in resolution 68/167, the General Assembly had requested the High Commissioner to submit a report on “the protection and promotion of the right to privacy in the context of domestic and extraterritorial surveillance and/or the interception of digital communications and the collection of personal data, including on a mass scale”, which was presented to the Human Rights Council at its twenty-seventh session. The report built on expert consultations and in-depth research regarding existing national and international legislation and jurisprudence, and information from a broad range of sources, including replies to a questionnaire sent out to stakeholders. 8. As the report made clear, international human rights law provided a robust and universal framework for the promotion and protection of the right to privacy, including in the context of domestic and extraterritorial surveillance; the interception of digital communications; and the collection of personal data. However, practices in many States revealed a lack of adequate national legislation and enforcement, weak procedural safeguards and ineffective oversight, which contributed to widespread impunity for arbitrary or unlawful interference with the right to privacy. 9. The Deputy High Commissioner recalled that the High Commissioner’s report examined the protection afforded by international human rights law regarding privacy, including the meaning of “interference with privacy” in online communications; the definition of “arbitrary and unlawful” interference in that context; and the question of whose rights were protected, and where. For instance, on the question of what constituted privacy interference, it was clear that the aggregation of communications data might give a comprehensive insight into an individual’s behaviour, social relationships, private preferences and identity, extending even beyond the information obtained by reading someone’s mail. The collection and retention of communications data might therefore constitute an interference with privacy, whether or not those data were subsequently consulted or used. The very existence of a mass surveillance programme regarding email communication and other forms of digital expression created an interference with privacy, and the onus was on the State to demonstrate that such interference was neither unlawful nor arbitrary. 10. Turning to “arbitrary” or “unlawful” interference with privacy, the report noted that State surveillance of electronic communications data might be a legitimate law enforcement measure, if it was conducted in compliance with the law. But States must demonstrate that the surveillance was both necessary and proportionate to the specific risk being addressed. Mandatory third-party data retention – whereby telephone companies and Internet service providers were required to store metadata about communications by their customers, for subsequent access by law enforcement and intelligence agencies – appeared neither necessary nor proportionate. 11. As stressed in the report, the Deputy High Commissioner recalled that States had an obligation to ensure that the privacy of individuals was protected by law against unlawful or arbitrary interference. All forms of communications surveillance must be conducted on the basis of publicly accessible law; and that law must in turn comply with the constitutional regime of the State concerned and international human rights law. Secret rules and secret interpretations of the law – even if issued by judges – were not compatible with the principle that laws should be clear and accessible. Neither were laws or rules that gave excessive discretion to executive authorities, such as the security and intelligence services. 12. The Deputy High Commissioner also mentioned the concerns raised in the report regarding extraterritorial surveillance and the interception of digital communications. Drawing on the work of the Human Rights Committee and the International Court of Justice regarding the determination of when a State exercises jurisdiction, the report noted that the human rights obligations of a State were engaged whenever it exercised power or 4