A/HRC/23/40 become massive repositories of personal information that are then accessible to States upon demand. Corporate actors have adopted specifications that enable State access or intrusion, collect excessive and revelatory information, or restrict the application of encryption and other techniques that could limit access to information by both the companies and governments. The private sector has also often failed to deploy privacy-enhancing technologies, or has implemented them less than secure ways that do not represent the state of the art. 75. In the most serious circumstances, the private sector has been complicit in developing technologies that enable mass or invasive surveillance in contravention of existing legal standards.50 The corporate sector has generated a global industry focused on the exchange of surveillance technologies. Such technologies are often sold to countries in which there is a serious risk that they will be used to violate human rights, particularly those of human rights defenders, journalists or other vulnerable groups. This industry is virtually unregulated as States have failed to keep pace with technological and political developments. 76. States' human rights obligations require that they not only respect and promote the rights to freedom of expression and privacy, but protect individuals from violations of human rights perpetrated by corporate actors. In addition, States should exercise adequate oversight in order to meet their international human rights obligations when they contract with, or legislate for, corporate actors where there may be an impact upon the enjoyment of human rights.51 Human rights obligations in this regard apply when corporate actors are operating abroad.52 77. States must ensure that the private sector is able to carry out its functions independently in a manner that promotes individuals’ human rights. At the same time, corporate actors cannot be allowed to participate in activities that infringe upon human rights, and States have a responsibility to hold companies accountable in this regard. VIII. Conclusions and recommendations 78. Communications techniques and technologies have evolved significantly, changing the way in which communications surveillance is conducted by States. States must therefore update their understandings and regulation of communications surveillance and modify their practices in order to ensure that individuals’ human rights are respected and protected. 79. States cannot ensure that individuals are able to freely seek and receive information or express themselves without respecting, protecting and promoting their right to privacy. Privacy and freedom of expression are interlinked and mutually dependent; an infringement upon one can be both the cause and consequence of an infringement upon the other. Without adequate legislation and legal standards to ensure the privacy, security and anonymity of communications, journalists, human rights defenders and whistleblowers, for example, cannot be assured that their communications will not be subject to States’ scrutiny. 50 51 52 20 For some examples of surveillance technology designed by the private sector and utilized in Libya, Bahrain, the Syrian Arab Republic, Egypt and Tunisia, see European Parliament, Directorate-General for External Policies, Policy Department, After the Arab Spring: New Paths for Human Rights and the Internet in European Foreign Policy (2012), pp. 9-10. Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework, Principle 5. Human Rights Committee, Concluding Observations, Germany, December 2012.