A/HRC/14/46 practice to maintain an absolute prohibition on the sharing of any information if there is a reasonable belief that sharing information could lead to the violation of the rights of the individual(s) concerned.164 In some circumstances, State responsibility may be triggered through the sharing of intelligence that contributes to the commission of grave human rights violations. Additionally, many national laws require States to evaluate the necessity of sharing particular information from the point of view of their own mandate and that of their counterparts.165 An assessment of whether information-sharing is necessary and relevant to the mandate of the recipient allows intelligence services to uphold the principle of minimization when sharing information, i.e., intelligence services minimize the amount of personal data shared to the greatest extent possible.166 These safeguards help to prevent excessive or arbitrary intelligence-sharing. 48. In view of the possible implications of intelligence-sharing for human rights, it is good practice for intelligence services to screen all outgoing information for accuracy and relevance before sending it to foreign entities.167 Where there are doubts about the reliability of outgoing intelligence, it is either withheld or accompanied by error estimates.168 Finally, it is good practice for all intelligence-sharing to take place in writing and to be recorded; this facilitates subsequent review by oversight institutions.169 Practice 34. Independent oversight institutions are able to examine intelligencesharing arrangements and any information sent by intelligence services to foreign entities. 49. It is good practice for oversight institutions to be mandated to review the agreements upon which intelligence-sharing is based, as well as any arrangements based on such agreements.170 Independent oversight institutions can scrutinize the legal framework and procedural dimensions of intelligence-sharing agreements to ensure that they comply with national laws and relevant international legal standards. As a general rule, oversight institutions are authorized to have access to all information necessary to fulfil their mandate (see practice 7 above). However, within the context of international intelligence-sharing, the third party rule may entail restrictions on oversight institutions’ access to incoming information provided by foreign entities. Oversight institutions are generally considered to be third parties; therefore, they cannot normally have access to information shared with intelligence services by foreign entities. Nevertheless, oversight institutions have a right to scrutinize information sent to foreign entities, and they exercise this right as part of a mandate to oversee all aspects of an intelligence service’s activities (see practice 7 above). Within this context, it is good practice for national law to explicitly require intelligence services to report intelligence-sharing to an independent oversight institution.171 This 164 165 166 167 168 169 170 171 28 Netherlands, Review Committee for the Security and Intelligence Services, review report on the cooperation of the GISS with foreign intelligence and/or security services, p. 24. Canada, Arar Commission, p. 346–347. Croatia (footnote 2), art. 60 (1)(3); Germany (footnote 2), sect. 19, Germany (footnote 106), sect. 7 a (1)1; Switzerland (footnote 2), art. 17 (3). Canada, Arar Commission, pp. 338–339. Netherlands (footnote 20), arts. 41, 59; Canada, Arar Commission pp. 332, 334–336. Netherlands (footnote 20), art. 41. On this obligation in the context of domestic sharing, see South Africa (footnote 2), sect. 3(3). Netherlands (footnote 20), art. 42; Germany (footnote 2), sect. 19 (3)(4); Germany (footnote 106), sect. 7 a (3); Croatia (footnote 2), art. 60(3); Netherlands, Review Committee for the Security and Intelligence Services, review report on the cooperation of the GISS with foreign intelligence and/or security services, pp. 22–23. Canada (footnote 6), art. 17(2); Canada, MacDonald Commission report, p. 1080; Canada, Arar Commission, p. 321; Venice Commission (2007), p. 182. Germany (footnote 106), sect. 7a (5–6); Croatia, Act on Personal Data Protection, art. 34. GE.10-13410