A/HRC/35/22 Challenge requests and underlying laws 68. Companies have an interest in operating in a legal environment that is human rights compliant, consistent due process and rule of law norms. Companies should explore all legal options for challenging requests that are excessively intrusive — such as requests for shutdowns of entire services or platforms, website takedowns that are clearly targeted at criticism or dissent or customer data requests that cover broadly unspecified users. 111 69. Like any decision to bring legal proceedings, companies may take into account a range of considerations, such as the “potential beneficial [human rights] impact, the likelihood of success, the severity of the case, cost, the representativeness of the case and whether the case is part of a larger trend”.112 However, companies should assign substantial overall weight to human rights considerations in their decision-making processes and carefully assess both the potential benefits and risks to human rights. For example, companies should be inclined to challenge overbroad requests where there is a reasonable likelihood of success, even if these challenges might be resource intensive; on the other hand, companies might pursue alternative options if a challenge is likely to create adverse precedent or backlash and undermine expression and privacy. 5. Transparency 70. Transparency is a key feature of the digital access industry’s responsibility to respect. Information about government activities that require corporate assistance or involvement should be disclosed to the maximum extent allowed by law. Companies should be mindful that such information is primarily used by civil society to challenge human rights abuses in court, register grievances before domestic or international mechanisms on behalf of users or seek alternative means of accountability. Accordingly, such disclosures should be regular and ongoing, and in an accessible format that provides appropriate context. 71. Even if local law limits full transparency, companies should nonetheless disclose all relevant and publishable information. For example, if companies are prohibited from disclosing the origin or basis of a shutdown request, they should nevertheless seek to provide regular updates about the services affected or restored, the steps they are taking to address the issue and explanations after the fact. Innovative transparency measures, such as the publication of aggregate data and the selective withholding of information, 113 also mitigate the impact of gag orders and other non-disclosure laws. Companies should disclose all the local laws with which they comply and, where possible, challenge any law or regulation that prevents or hinders them from being transparent to users and the general public.114 72. Companies should disclose their policies and actions that implicate freedom of expression. Relevant disclosures include data retention and use policies, network management practices and the sale and purchase of network filtering and interception technologies.115 Companies should also disclose information about the frequency, scope and subject matter of due diligence processes and a summary of high-level findings. In general, companies should consult the growing number of resources that study valuable transparency indicators and other transparency best practices. Users, civil society and peer companies should also be consulted on the design and implementation of transparency measures. 111 112 113 114 115 Yael Ronen, “Big Brother’s little helpers” (February 2015), p. 81. Global Network Initiative, “Implementation guidelines”. For example, when “Telia Company was required to suspend services, the company did not state that this was the result of technical problems”, Telecommunications Industry Dialogue submission, p. 14. Telecommunications Industry Dialogue, “Information on country legal frameworks pertaining to freedom of expression and privacy in telecommunications” (2016). Ranking Digital Rights submission. 19