A/HRC/41/35/Add.4 framework that included training on human rights. The broader discussion on company normative development also noted the risk that increased normative development in the industry could lead governments to move towards weakening encryption standards. 36. One participant argued that technology embeds the values of those who make it. Therefore, there is a need for more awareness raising in engineering schools, to prepare students that will eventually be members of important standards setting bodies. 37. The lack of accountability associated with the use of surveillance was highlighted in relation to litigation surrounding FinFisher technology where an Ethiopian-born U.S. citizen and human rights activist living in the United States sued Ethiopia for monitoring his Skype calls over a four-month period. The litigation ultimately failed when the U.S. Court of Appeals for the District of Columbia Circuit concluded the wiretapping occurred abroad and foreign states are immune from suit in a U.S. court, unless an exception applies. One participant noted that accountability typically comes from customs regulation and without jurisdiction in the U.S. other avenues need to be explored. One concern in the U.S. is that the “harm” from the surveillance or monitoring is difficult to prove. A recommendation was made to look to trademark, unfair completion, and public agency arguments as alternatives to litigation in the United States. 38. The European Union General Data Protection Regulation (GDPR) was discussed as a regulation that can be looked to for industry standards as it includes “hard” language and is implemented by member states. 39. The discussion resulted in a variety of recommendations including the importance of having a competent authority creating and enforcing standards, annual and accurate reporting, and transparency. A multi-stakeholder approach is important. Key questions include: What are the companies we should be targeting here, and what is their due diligence? E. Session 5: breakout brainstorming 40. After having spent a day exploring surveillance and the threats to civil society, participants broke out into smaller groups. Each group was assigned a specific question on how to hold the sale and deployment of private surveillance technologies accountable to human rights standards. Participants were asked to come with concrete outcomes and recommendations. 41. The first breakout group dealt with the issue of litigation in domestic or regional forums. Key questions 42. What are the key challenges with public interest litigation against the sale or use of private surveillance technologies? 43. How might we develop strategies to overcome it? 44. The group identified (i) access to information, (ii) exceptions in data protection laws for intelligence services and (iii) compliance with court decisions to be some of the main challenges associated with public interest litigation against the sale or use of private surveillance technologies. 45. Several participants have pointed out the importance of using access to information laws and that this should apply to companies that collaborate with the government. To address the lack of knowledge of some judges, it has been suggested that they should be provided with adequate training. It was also pointed out that an independent investigation structure should be created in order to solve the issue of the lack of independence of investigative bodies. Several participants also stressed the importance in advocating for upto-date laws, notably in connection with the issue of access to remedy. Finally, there was a general consensus within the group that joint litigation efforts should be improved, given that in most cases multiple jurisdictions are involved. 46. The second breakout group tackled the issue of corporate responsibilities. 7