A/HRC/41/35/Add.3 question. In Brazil, “although the secrecy of communications is protected under the Brazilian Federal Constitution, there is significant dispute around the standards of protection conferred to different types of communications data.” (Internet Lab, 2.) VI. Recommendations to states Explicit Focus on Human Rights 37. Export control frameworks should include an explicit focus on human rights. In particular, States should be required to deny licenses for exports that carry a “substantial risk” that they will be used to harm human rights. (PI, 8) Such standards should be shored up with effective and independent monitoring and oversight mechanisms, sanctions against companies that fail to comply, and human rights due diligence requirements for companies. (GJC, 13; RSF, 5; Privacy International, 8; Amnesty international, 7) The minimum human rights standards companies should meet are detailed below. Increase Transparency 38. To address these issues and develop definitions and standards that are fit for purpose, States should provide more information about their current licensing practices. States should, for example, install “a mechanism of intergovernmental information sharing about the human rights situation in destination countries, previous decisions for certain technologies and countries and about the previous use of surveillance technology in the country.” (RSF, 5) Ongoing and Dynamic Review of Regulatory Standards 39. States should engage in periodic review of relevant frameworks to ensure they cover all relevant surveillance technologies. (IHRB, 19; Privacy International, 8) Furthermore, states must note that as the technology continues to evolve and the challenges become far more complex, updates to the frameworks should take into consideration the expertise of all stakeholders including civil society, researchers, and international human rights advocates. (Privacy International, 8; Citizen Lab, 19) Protecting Security Research 40. In regulating transfers of invasive surveillance tools, States should establish clear definitions of surveillance technology that contain “clear and enforceable” safeguards to protect legitimate security research and communication technologies. (Privacy International, 8) VII. The Human Rights responsibilities of companies 41. Submissions also raise concerns about the lack of corporate human rights accountability. Private surveillance companies routinely deny, or simply ignore, questions about alleged human rights violations, citing concerns about their government clients’ privacy and confidentiality. (Sarah McKune, 4-5) Many companies also do not “have in place policies and practices that are purposefully inline with the Guiding Principles on Business and Human Rights.” (Center for Internet & Society, India (“CIS”), 10) Those that have made minimal commitments to human rights continue to supply surveillance products and services to governments that have a track record of using them to commit human rights abuses. (Sarah McKune, 9) 42. Submissions highlighted a variety of recommendations that would bring companies in line with the UN Guiding Principles; most of these recommendations are reflected in the main report. A few additional points are worth highlighting here. With respect to human rights due diligence, companies should conduct human rights impact assessments and make commitments to refuse entering into business with “countries that have a history of targeting human rights defenders.” (GJC, 14) Additionally, “[r]obust multistakeholder initiatives, rooted in the UN Guiding Principles and in which industry plays a key role, 10