A/HRC/32/38 such orders.48 The British Investigative Powers Bill would prohibit telecommunication service providers from disclosing, among other things, “the existence and contents” of government orders to retain customers’ communications data. 49 In other States, ambiguous laws and regulations make it difficult for corporations to determine what kinds of information they are permitted to disclose. In South Africa, for example, private disclosures of government requests for customers’ data are prohibited,50 but it is unclear whether the same restriction extends to content removal requests. 51 65. In the context of the private sector, service providers and content-hosting platforms often disclose at least some information about the circumstances under which they remove content or comply with government requests for customer data. There is wide variation, however, in whether and how they convey interpretations or explanations of State regulations and terms of service, and internal processes for implementation and enforcement. There are also gaps in corporate disclosure of statistics concerning the volume, frequency and types of request for content removals and user data, whether because of State-imposed restrictions or internal policy decisions. In any case, companies are more likely to disclose statistics concerning government requests than private requests. There has also been far less research into the extent to which other intermediaries (for example, financial or e-commerce intermediaries) and companies disclose information concerning content removals and requests for customer data. 66. Ongoing debate about the minimum standards for corporate disclosures and relevant best practices reflects uncertainty about the appropriate balance between transparency and competing values, such as individual security and trade secrecy. While there is growing consensus that corporations should disclose information about how restrictions are interpreted and enforced, there is less agreement about how this should be done. Similarly, there is widespread agreement about the importance of quantitative transparency, but it is less clear how such information should be contextualized, presented and made accessible. D. Remedies 67. Restrictions on freedom of expression online occur on a daily basis and frequently involve corporate conduct, whether compelled by law or pursuant to corporate policy and practice (for example, as reflected in terms of service). Common examples of such restrictions include unlawful or otherwise questionable content removals, service restrictions and account suspensions, and data security breaches. 68. Under article 2 (3) of the International Covenant on Civil and Political Rights, States parties must ensure that persons whose rights under the Covenant have been violated have an effective remedy. The Guiding Principles on Business and Human Rights anticipate that corporations should provide remedial and grievance mechanisms that are legitimate, accessible, predictable, equitable, rights-compatible, transparent, based on dialogue and engagement, and a source of continuous learning.52 There is limited guidance, however, as to how these elements should be operationalized or assessed in the context of information and communications technology. For example, improper removal of web links from search 48 49 50 51 52 18 India, Information Technology (Procedures and Safeguards for Blocking for Access of Information by Public) Rules, 2009, rule 16. Investigatory Powers Bill, Cl. 84 (2). South Africa, Regulation of Interception of Communications and Provision of CommunicationRelated Information Act 70 of 2002, sect. 42 (1). South Africa, National Key Points Act 102 of 1980, sect. 10 (c). Guiding principles, chap. III (A) (31).