A/HRC/35/22 route. 31 When specific services or platforms are disrupted, governments typically target those that are the most efficient, secure or widely used. 32 B. Government access to user data 17. Government surveillance today relies on access to communications and associated data belonging to users of privately owned networks. While such access frequently requires the assistance of private actors, it may also be obtained without their knowledge or involvement. As with other forms of surveillance, government access to user data may interfere with privacy in a manner that can both directly and indirectly limit the free development and exchange of ideas (see A/HRC/23/40, para. 24). Undue access to personal data implicitly warns users to think twice and possibly avoid controversial viewpoints, the exchange of sensitive information and other exercises of freedom of expression that may be under government scrutiny (see A/HRC/27/37, para. 20). Requests for user data 18. Vague laws and regulations violate the legality requirement (see A/HRC/23/40, para. 50). The Communications and Multimedia Act of Malaysia, for example, permits authorities to order the disclosure of “any communication or class of communications” on “the occurrence of any public emergency or in the interest of public safety”. The Act does not define the conditions that trigger a public emergency and certification by the King is deemed “conclusive proof on the point”.33 In Qatar, law enforcement enjoys a broad right to seek access to providers’ customer communications in cases of national security or emergency.34 These provisions empower authorities to request user data based on a mere assertion of national security. Users are thus unable to predict with reasonable certainty the circumstances under which their communications and associated data may be disclosed to authorities. 19. Providers should only be compelled to release user data when ordered by judicial authorities certifying necessity and proportionality to achieve a legitimate objective. The Criminal Code of Canada requires law enforcement to submit requests for the disclosure of telephone records in criminal investigations to a judge for approval. 35 In Portugal, the authorities must obtain a judicial order to compel the disclosure of communications data. 36 However, national law often exempts user data requests from judicial authorization. In Bangladesh, the authorities require only executive branch approval to access communications data belonging to telecommunications subscribers on the grounds of national security and public order.37 20. Laws that require private actors to create large databases of user data accessible to the government raise necessity and proportionality concerns. In Kazakhstan, telephone numbers, e-mail and Internet Protocol (IP) addresses and billing information must be stored by the provider for two years. 38 The Russian Federation requires private actors to store the content of all their customers’ calls and text messages for six months, and related communications metadata for three years. 39 Both countries also require such data to be stored locally. 40 In countries where mobile phones are a dominant means of communication, mandatory SIM card registration laws effectively require the majority of the population to divulge personally identifiable information (see A/HRC/29/32, para. 51). 31 32 33 34 35 36 37 38 39 40 Deniz Duru Aydin, “Five excuses governments (ab)use to justify Internet shutdowns” Access Now (6 October 2016). Article 19 submission, p. 2. Malaysia, Communications and Multimedia Act (1998), sect. 266. Qatar, Decree Law No. (34) of 2006. See submission from Canada, p. 6. Portugal, Criminal Proceedings Code, arts. 187-190. Bangladesh, Telecommunication Regulatory Act (2001), sect. 97 (Ka). Kazakhstan, Government resolution No. 1593 (23 December 2011). OHCHR, letter to the Government of the Russian Federation, 28 July 2016 (OL RUS 7/2016). Article 19 submission, p. 5. 7