A/HRC/38/47 offline gender discrimination and violence, and that States should enact adequate legislative measures and ensure appropriate responses to address the phenomenon. (c) The right to live free from gender-based violence and the right to privacy and data protection 57. The right to privacy, as recognized under article 12 of the Universal Declaration of Human Rights and article 17 of the International Covenant on Civil and Political Rights, has been challenged in the digital environment. Data protection norms have also been challenged by ICT innovations that have increased the capacity of States and of non-State actors to conduct surveillance, decryption and mass data collection and use, which have an impact on the individual’s rights to privacy. Many forms of online violence are per se acts of gender-based violence that violate women’s and girls’ rights to privacy; for example, the publication or posting online without consent of intimate photographs or Photoshopped images that are sexualized or have been created to humiliate, shame or stigmatize a woman is a violation of a woman’s right to dignity and to live a life free from violence. 58. In a recent report, the Special Rapporteur on the right to privacy highlighted the need to examine cyberviolence against the more vulnerable, including domestic violence enabled by digital devices, risks to the privacy of young children and embedded gender and other biases in algorithms (A/HRC/37/62). 59. With the increasingly massive collection and storage of data by intermediaries and other corporations, the protection of privacy is crucial. In 2013, the General Assembly has expressed deep concern at the negative impact that surveillance and interception of communications may have on human rights, as in the case of its resolution 68/167. Companies that collect and store massive amounts of data should, like data banks, bear the responsibility to protect their customers’ personal data. The General Data Protection Regulation adopted by the European Union will, inter alia, require companies to implement reasonable data protection measures to protect consumers’ personal data and privacy against loss or exposure. It will also assert extraterritorial jurisdiction, given that it is applicable to all companies in the European Union as well as to international companies that collect or process personal data from subjects residing in it. 60. Encryption and anonymity, separately or together, create a zone of privacy to protect freedom of expression and to facilitate the freedom to seek, receive and impart information and ideas, regardless of frontiers. Anonymity online is an important role for women and others at risk of discrimination and stigma, in that it allows them to seek information, find solidarity and support and share opinions without fear of being identified. This holds particularly true for individuals who face discrimination and persecution based on their sexual orientation and gender identity (see A/HRC/29/32). 61. On related matters, a recent judgment by the Court of Justice of the European Union, commonly referred to as Google v. Spain, 35 established the “right to be forgotten” for victims, according to which individuals may request to be delisted from search results produced on the basis of a search term that includes their name when the data associated with their name is “inadequate, irrelevant or no longer relevant” for the purposes of data processing and if the information does not pertain to a public figure or is not of public interest. States’ human rights obligations to prevent and combat online violence against women and girls 3. 62. States have a human rights obligation to ensure that both State and non-State agents refrain from engaging in any act of discrimination or violence against women. States have a direct responsibility concerning violence perpetrated by agents of the State itself. They also have due diligence obligations to prevent, investigate and punish acts of violence against women committed by private companies, such as Internet intermediaries, in accordance with article 2 (e) of the Convention on the Elimination of All Forms of Discrimination 35 See https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62012CJ0131. 13