A/HRC/32/38 States 85. States bear a primary responsibility to protect and respect the right to exercise freedom of opinion and expression. In the information and communication technology context, this means that States must not require or otherwise pressure the private sector to take steps that unnecessarily or disproportionately interfere with freedom of expression, whether through laws, policies, or extralegal means. Any demands, requests and other measures to take down digital content or access customer information must be based on validly enacted law, subject to external and independent oversight, and demonstrate a necessary and proportionate means of achieving one or more aims under article 19 (3) of the International Covenant on Civil and Political Rights. Particularly in the context of regulating the private sector, State laws and policies must be transparently adopted and implemented. 86. Governments must also adopt and implement laws and policies that protect private development and the provision of technical measures, products and services that advance freedom of expression. They must ensure legislative, policymaking and other relevant norm-setting processes concerning rights and restrictions on the Internet in order to provide the private sector, civil society, the technical community and academia meaningful opportunities for input and participation. Private sector 87. States place undeniable pressures on the private information and communication technology sector that often lead to serious restrictions on the freedom of expression. The private sector, however, also plays independent roles that may either advance or restrict rights, a point the Human Rights Council well understood by adopting the Guiding Principles on Business and Human Rights in 2011 as general guidance in that field. Private entities should be evaluated on the steps they take both to promote and undermine freedom of expression, even in hostile environments unfriendly to human rights. 88. Among the most important steps that private actors should take is the development and implementation of transparent human rights assessment procedures. They should develop and implement policies that take into account their potential impact on human rights. Such assessments should critically review the wide range of private sector activities in which they are engaged, such as the formulation and enforcement of terms of service and community standards on users’ freedom of expression, including the outsourcing of such enforcement; the impact of products, services and other commercial initiatives on users’ freedom of expression as they are being developed, including design and engineering choices, and plans for differential pricing of or access to Internet content and services; and the human rights impact of doing business with potential government customers, such as the operation of telecommunication infrastructure or the transfer of content-regulation or surveillance technologies. 89. It is also critical that private entities ensure the greatest possible transparency in their policies, standards and actions that implicate the freedom of expression and other fundamental rights. Human rights assessments should be subject to transparent review, in terms of their methodologies, their interpretation of legal obligations and the weight that such assessments have on business decisions. Transparency is important across the board, including in the context of content regulation, and should include the reporting of government requests for takedowns. 90. Beyond adoption of policies, private entities should also integrate commitments to freedom of expression into internal policymaking, product engineering, business 22