A/HRC/43/29 in transparency and, eventually, accountability (A/73/348, para. 55). 30 According to the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, States should consider avoiding using systems that can have material adverse human rights impacts that cannot be subject to meaningful auditing (ibid.). 31 55. While new technologies are largely driven by the private sector, States have legal obligations under human rights law to protect affected human rights, including through the adoption of necessary legislative measures. New technologies may require traditional approaches to regulation to be refined, in order to reflect the specificities of emerging technologies. Enhancing the capacity of sectoral oversight bodies to address relevant issues raised by the use of new technologies, such as sectoral regulation and oversight, could also help ensure on-target interventions in human rights-critical areas affected by the use of artificial intelligence (A/73/348, para. 42).32 E. Protecting the right to privacy in the context of personal data 56. Many new technologies that hold promise in terms of promoting human well-being rely heavily on the processing of large amounts of personal data. In such an environment, ensuring an adequate level of data privacy is essential in order to prevent human rights violations and abuses, including economic, social and cultural rights. 33 Uninhibited access to health or genetic information, for example, could enable insurers to exclude from coverage those that need health care most urgently. The Human Rights Council has called upon States to develop or maintain and implement adequate legislation, with effective sanctions and remedies, that protects individuals against violations and abuses of the right to privacy, namely through the unlawful or arbitrary collection, processing, retention or use of personal data by individuals, Governments, business enterprises and private organizations (Council resolution 42/15, para. 6 (f)). According to the General Assembly, the adoption and implementation of data protection legislation, regulation and policies could include the establishment of national independent authorities with powers and resources to monitor data privacy practices and investigate violations and abuses, and to provide appropriate remedies (Assembly resolution 73/179, para. 6 (g)). 57. Many States, intergovernmental organizations and other institutions have developed standards for the protection of personal data that can guide the design of personal data governance frameworks and mechanisms. 34 Within the United Nations system, the guidelines for the regulation of computerized personal data files (E/CN.4/1990/72) adopted by the General Assembly in its resolution 45/95, and the personal data protection and privacy principles adopted in 2018 by the High-level Committee on Management, provide a benchmark for rights-respecting processing within the United Nations system. These guidelines and principles underscore a number of important principles, including that the processing of personal data requires an adequate level of transparency, requiring data subjects to be informed about the processing of their personal data and about how to request appropriate access, rectification and/or erasures of those personal data in the case of unlawful, unnecessary or inaccurate entries. Moreover, the processing of personal data should be based on the free and informed consent of the individuals concerned, or another legal basis. It should be relevant, limited and adequate to what is necessary in relation to a specified purpose. Appropriate security measures should be taken to protect personal information against unauthorized disclosure, modification or deletion. 30 31 32 33 34 See also Human Rights Council resolution 42/15, para. 5. See also AI Now Institute, New York University, AI Now Report 2018 (New York, 2018), recommendation 4. See also AI Now Institute, AI Now Report 2018, recommendation 1. See Human Rights Council resolution 42/15, in which the Council notes with concern that automatic processing of personal data for individual profiling may affect the enjoyment of human rights, including economic, social and cultural rights. For a list of relevant international instruments and guidelines, see A/HRC/39/29, para. 28. 13