A/HRC/14/46 limit the reasons for opening and keeping personal data files by intelligence services.120 Third, it is established practice in various States that the intelligence services inform the general public about the type of personal data kept by an intelligence service; this includes information on the type and scope of personal data that may be retained, as well as permissible grounds for the retention of personal information by an intelligence service.121 Fourth, various States have made it a criminal offence for intelligence officers to disclose or use personal data outside the established legal framework.122 A final safeguard is that States have explicitly stipulated that intelligence services are not allowed to store personal data on discriminatory grounds.123 Practice 24. Intelligence services conduct regular assessments of the relevance and accuracy of the personal data that they hold. They are legally required to delete or update any information that is assessed to be inaccurate or no longer relevant to their mandate, the work of oversight institutions or possible legal proceedings. 38. States have taken steps to ensure that intelligence services regularly check whether personal data files are accurate and relevant to their mandate.124 Safeguards on the relevance and accuracy of personal data help to ensure that any ongoing infringement of the right to privacy is minimized. In some States, the intelligence services have not only the legal obligation to destroy files that are no longer relevant125 but also files that are incorrect or have been processed incorrectly.126 While intelligence services are ordinarily obliged to delete data that are no longer relevant to their mandate, it is important that this is not to the detriment of the work of oversight bodies or possible legal proceedings. Information held by intelligence services may constitute evidence in legal proceedings with significant implications for the individuals concerned; the availability of such material may be important for guaranteeing due process rights. Therefore, it is good practice for intelligence services to be obliged to retain all records (including original transcripts and operational notes) in cases that may lead to legal proceedings, and that the deletion of any such information be supervised by an external institution (see practice 25 below).127 Practice 25. An independent institution exists to oversee the use of personal data by intelligence services. This institution has access to all files held by the intelligence services and has the power to order the disclosure of information to individuals concerned, as well as the destruction of files or personal information contained therein. 39. In many States, the management of personal data files is subject to regular and continuous oversight by independent institutions.128 These institutions are mandated to conduct regular inspection visits and random checks of personal data files of current and 120 121 122 123 124 125 126 127 128 22 MacDonald Inquiry, p. 519; Netherlands (footnote 20), art. 13. Canada, Privacy Act, sect. 10. An overview of personal information banks maintained by the Canadian Security and Intelligence Services can be found on the website of the Government of Canada (http://www.infosource.gc.ca/inst/csi/fed07-eng.asp). Romania (footnote 15), art. 21. For example, in Ecuador, intelligence services are not allowed to store personal data on the basis of ethnicity, sexual orientation, religious belief, political position or of adherence to or membership in political, social, union, communitarian, cooperative, welfare, cultural or labour organizations; see Ecuador (footnote 15), art. 22. Germany (footnote 2), sect. 14 (2); Germany (footnote 106), sect. 4 (1), sect. (5); Switzerland (footnote 5), art. 15 (1) (5). Germany (footnote 2), sect. 12 (2); Kenya (footnote 16), sect. 28(1). Netherlands (footnote 20), art. 43; Croatia (footnote 2), art. 41(1). Charkaoui v. Canada (Citizenship and Immigration), [2008] 2 S.C.R. 326, 2008 SCC 38, para. 64. Sweden (footnote 27), art. 1; Hungary (footnote 77), sect. 52. See also practices 6–8. GE.10-13410