A/HRC/41/35/Add.4 63. The fourth group worked on the issue of international normative development. Key questions 64. How should international and regional mechanisms support and encourage the development of rights-oriented standards and norms governing the private surveillance industry and the use of these tools? 65. What is the role of regional bodies, such as the OECD, the European Commission and the Inter-American Commission on Human Rights? 66. What is the role of standard-setting organizations (such as the Internet Engineering Task Force or Institute of Electrical and Electronics Engineers) and other technical bodies (such as the International Telecommunications Union)? 67. The participants discussed potential ways to create “best practices” for the private surveillance industry. There was no general consensus on the overall mechanism to establish best practices. Participants noted that in addition to industry self-regulation, looking at the World Wide Web Consortium (W3C) and the Organisation for Economic Co-operation and Development (OECD) could be helpful. The OECD may be particularly useful for developing relevant norms concerning the financial industry. 68. One participant mentioned that governments may create “action plans” on governing private surveillance tools. Participants deliberated on how to identify the desired principles of an action plan and whether or not action plans would be useful. Ultimately, participants agreed that whatever mechanism is used, they should include, at a minimum, strategies for mitigating surveillance-related human rights abuses. But there was no consensus on whether action plans were the most effective way to encourage rights-oriented standards. 69. Other suggestions for normative development included: improving or developing protocols for e-mail communication from States and companies, in order to better distinguish genuine communications from those that are phishing e-mails in disguise. Governments and companies may also consider ways to educate users on avoiding malicious links and suspicious requests. In relation to company responsibility, the participants discussed using human rights impact assessments to increase transparency and awareness. Concerns were raised about the accuracy of such assessments, how such information would be framed, and what companies would overlook. One participant suggested that an independent impact assessment could potentially increase transparency and alleviate concerns. 9