A/HRC/27/37 challenge such measures) thus become critical issues in determining access to effective remedy. States take different approaches to notification: while some require post facto notification of surveillance targets, once investigations have concluded, many regimes do not provide for notification. Some may also formally require such notification in criminal cases; however, in practice, this stricture appears to be regularly ignored. There are also variable approaches at the national level to the issue of an individual’s standing to bring a judicial challenge. The European Court of Human Rights ruled that, while the existence of a surveillance regime might interfere with privacy, a claim that this created a rights violation was justiciable only where there was a “reasonable likelihood” that a person had actually been subjected to unlawful surveillance.35 41. Second, effective remedies will involve prompt, thorough and impartial investigation of alleged violations. This may be provided through the provision of an “independent oversight body […] governed by sufficient due process guarantees and judicial oversight, within the limitations permissible in a democratic society.”36 Third, for remedies to be effective, they must be capable of ending ongoing violations, for example, through ordering deletion of data or other reparation.37 Such remedial bodies must have “full and unhindered access to all relevant information, the necessary resources and expertise to conduct investigations, and the capacity to issue binding orders”.38 Fourth, where human rights violations rise to the level of gross violations, non-judicial remedies will not be adequate, as criminal prosecution will be required.39 IV. What role for business? 42. There is strong evidence of a growing reliance by Governments on the private sector to conduct and facilitate digital surveillance. On every continent, Governments have used both formal legal mechanisms and covert methods to gain access to content, as well as to metadata. This process is increasingly formalized: as telecommunications service provision shifts from the public sector to the private sector, there has been a “delegation of law enforcement and quasi-judicial responsibilities to Internet intermediaries under the guise of ‘self-regulation’ or ‘cooperation’”.40 The enactment of statutory requirements for companies to make their networks “wiretap-ready” is a particular concern, not least because it creates an environment that facilitates sweeping surveillance measures. 35 36 37 38 39 40 14 See Esbester v. the United Kingdom, application No. 18601/91, Commission decision of 2 April 1993; Redgrave v. the United Kingdom, application No. 202711/92, Commission decision of 1 September 1993; and Matthews v. the United Kingdom, application No. 28576/95, Commission decision of 16 October 1996. “Joint declaration on surveillance programs and their impact on freedom of expression”, issued by the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression and the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights, June 2013 (available from www.oas.org/en/iachr/expression/showarticle.asp?artID=927&lID=1), para. 9. See for example European Court of Human Rights, Segersted-Wiber and others v. Sweden, application No. 62332/00, 6 June 2006. See also CCPR/C/21/Rev.1/Add. 13, paras. 15-17. A/HRC/14/46. Basic Principles and Guidelines on the Right to a Remedy and Reparation for Victims of Gross Violations of International Human Rights Law and Serious Violations of International Humanitarian Law (General Assembly resolution 60/147, annex). See European Digital Rights, “The Slide from ’Self-Regulation’ to Corporate Censorship”, Brussels, January 2011, available at www.edri.org/files/EDRI_selfreg_final_20110124.pdf.