A/HRC/23/40 B. Facilitating private, secure and anonymous communications 88. States should refrain from compelling the identification of users as a precondition for access to communications, including online services, cybercafés or mobile telephony. 89. Individuals should be free to use whatever technology they choose to secure their communications. States should not interfere with the use of encryption technologies, nor compel the provision of encryption keys. 90. States should not retain or require the retention of particular information purely for surveillance purposes. C. Increasing public access to information, understanding and awareness of threats to privacy 91. States should be completely transparent about the use and scope of communications surveillance techniques and powers. They should publish, at minimum, aggregate information on the number of requests approved and rejected, a disaggregation of the requests by service provider and by investigation and purpose. 92. States should provide individuals with sufficient information to enable them to fully comprehend the scope, nature and application of the laws permitting communications surveillance. States should enable service providers to publish the procedures they apply when dealing with State communications surveillance, adhere to those procedures, and publish records of State communications surveillance. 93. States should establish independent oversight mechanisms capable to ensure transparency and accountability of State surveillance of communications. 94. States should raise public awareness on the uses of new communication technologies in order to support individuals in properly assessing, managing, mitigating and making informed decisions on communications-related risks. D. Regulating the commercialization of surveillance technology 95. States should ensure that communications data collected by corporate actors in the provision of communications services meets the highest standards of data protection. 96. States must refrain from forcing the private sector to implement measures compromising the privacy, security and anonymity of communications services, including requiring the construction of interception capabilities for State surveillance purposes or prohibiting the use of encryption. 97. States must take measures to prevent the commercialization of surveillance technologies, paying particular attention to research, development, trade, export and use of these technologies considering their ability to facilitate systematic human rights violations. 22