A/HRC/13/37 in some areas of policymaking and, in later policies, were not considered at all. Many of the investigative powers given to law enforcement agencies under anti-terror laws are granted to these agencies to conduct investigations unrelated to terrorism. Meanwhile, States are following each other’s lead on policy without considering the human rights implications. Many of the policies outlined above were introduced first as extraordinary, but then soon became regional and international standards. Collectively, such interference is having significant negative impacts on the protection of the right to privacy, as there is limited access to legal safeguards. Without a rigorous set of legal safeguards and a means to measure the necessity, proportionality, or reasonableness of the interference, States have no guidance on minimizing the risks to privacy generated by their new policies. The Special Rapporteur has identified the legal safeguards that have emerged through policymaking, jurisprudence, policy reviews and good practice from around the world. 1. The principle of minimal intrusiveness 49. Some interference with the private lives of individuals is more intrusive than others. Constitutional protection of property and people has been extended over the past 50 years to include communications,76 information that is related to a biographical core77 and a right to the confidentiality and integrity of information-technological systems.78 These protections require States to have exhausted less-intrusive techniques before resorting to others. The United Kingdom Parliament’s Home Affairs Committee reviewed and adapted these ideas for modern data-centred surveillance systems into the principle of dataminimization, which is closely linked to purpose-specification.79 In its review, the Parliamentary committee recommended that Governments “resist a tendency to collect more personal information and establish larger databases. Any decision to create a major new database, to share information on databases, or to implement proposals for increased surveillance, should be based on a proven need”. The Special Rapporteur contends that States must incorporate this principle into existing and future policies as they present how their policies are necessary, and in turn proportionate. 2. The principle of purpose specification restricting secondary use 50. Whereas data protection law should protect information collected for one purpose being used for another, national security and law enforcement policies are generally exempted from these restrictions. This is done through secrecy provisions in lawful access notices, broad subpoenas and exemption certificates such as national security certificates, which exempt a specific database from adhering to privacy laws. The Special Rapporteur is concerned that this limits the effectiveness of necessary safeguards against abuse. States must be obliged to provide a legal basis for the reuse of information, in accordance with constitutional and human rights principles. This must be done within the human rights framework, rather than resorting to derogations and exemptions. This is particularly important when information is shared across borders; furthermore, when information is shared between States, protections and safeguards must continue to apply.80 76 77 78 79 80 18 See United States Supreme Court, Katz v. United States, 1967. See footnote 74. See German Constitutional Court decision No. 370/07, 27 February 2008. See the United Kingdom Parliament’s Home Affairs Committee, A Surveillance Society? Fifth report of the session 2007–2008, 8 June 2008. See, for instance, with regard to passenger name records, the article 29 Data Protection Working Party’s opinion 8/2004 on the information for passengers concerning the transfer of PNR data on flights between the European Union and the United States of America, 30 September 2004. GE.09-17804