A/HRC/29/32 cloud services and many other corporate actors, often described as intermediaries, promote, regulate or compromise privacy and expression online. Intermediaries may store massive volumes of user data, to which Governments often demand access. Encryption and anonymity may be promoted or compromised by each of these corporate actors. 28. A full exploration of the role of corporations to protect their users’ security online is beyond the scope of the present report, which is focused on State obligations. However, it remains important to emphasize that “the responsibility to respect human rights applies throughout a company’s global operations regardless of where its users are located, and exists independently of whether the State meets its own human rights obligations” (see A/HRC/27/37, para. 43). At a minimum, corporations should apply principles such as those laid out in the http://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdfGuiding Principles http://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdfon Business and Human Rights, the Global Network Initiative’s Principles on Freedom of Expression and Privacy, the European Commission’s ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights and the Telecommunications Industry Dialogue Guiding Principles, which encourage corporations to commit to protect human rights, undertake due diligence to ensure the positive human rights impact of their work and remediate adverse impacts of their work on human rights. In the future, the Special Rapporteur will focus on the roles corporations should play in preserving individual security to exercise freedom of opinion and expression. IV. Evaluating restrictions on encryption and anonymity A. Legal framework 29. The permissible limitations on the right to privacy should be read strictly, particularly in an age of pervasive online surveillance — whether passive or active, mass or targeted — regardless of whether the applicable standards are “unlawful and arbitrary” under article 17 of the International Covenant on Civil and Political Rights, “arbitrary” under article 12 of the Universal Declaration, “arbitrary or abusive” under article 11 of the American Convention on Human Rights, or “necessary in a democratic society” under article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (see A/HRC/13/37, paras. 14–19). Privacy interferences that limit the exercise of the freedoms of opinion and expression, such as those described in this report, must not in any event interfere with the right to hold opinions, and those that limit the freedom of expression must be provided by law and necessary and proportionate to achieve one of a handful of legitimate objectives. 30. No restrictions may be imposed on the right to hold opinions without interference; restrictions under article 19 (3) of the Covenant only apply to expression under article 19 (2). In environments where one’s opinions, however held online, result in surveillance or harassment, encryption and anonymity may provide necessary privacy. Restrictions on such security tools may interfere with the ability of individuals to hold opinions. 31. Restrictions on encryption and anonymity, as enablers of the right to freedom of expression, must meet the well-known three-part test: any limitation on expression must be provided for by law; may only be imposed for legitimate grounds (as set out in article 19 (3) of the Covenant); and must conform to the strict tests of necessity and proportionality. 32. First, for a restriction on encryption or anonymity to be “provided for by law”, it must be precise, public and transparent, and avoid providing State authorities with 11