A/HRC/35/22 design phase and at regular intervals throughout the life cycle of the product or service, taking into account factors such as technology and infrastructure changes and associated security vulnerabilities, alterations in consumer behaviour, and modifications of the legal, political and social environment where companies operate. 100 2. Incorporating human rights safeguards by design 59. As with every major technology development, design and engineering choices reflect public policy considerations, and should be guided by respect for human rights. For example, network slicing, a key 5G technology, could enable mobile providers to manage network traffic more efficiently and cater to the ever-expanding range of consumer needs in the Internet of Things (IoT) era. At the same time, networks could also be “sliced” into fast and slow lanes that prioritize access to some Internet applications over others, potentially interfering with net neutrality. Accordingly, companies should ensure that innovations in network equipment and technology — particularly those with multiple uses — are designed and deployed so as to be consistent with freedom of expression and privacy standards.101 60. Companies should assume an active and engaged role in developing expression and privacy enhancing measures. For example, digital security measures that detect and prevent distributed denial-of-service attacks and hacking should be implemented in a manner that targets malicious traffic without compromising legitimate interactions among individuals, organizations and communities. Configuring network equipment to minimize unnecessary information collection about users — given local legal and routing requirements — effectively pre-empts overbroad data requests, since companies cannot turn over information they do not have.102 Even if user information is logged, meaningful limits on whether and for how long they are retained also restrict the scope of personal and sensitive data available for third party access. 3. Stakeholder engagement 61. Human rights engagement with governments, corporate partners and other stakeholders may prevent or mitigate human rights violations down the line. Companies that deal directly with governments should push for human rights safeguards in operating licences and sales contracts, such as assurances that network equipment will not be accessed or modified without the company’s knowledge (which can be for the purpose of facilitating human rights abuses). Timely intervention during litigation (such as amicus filings in cases brought by civil society groups or peer companies against censorship or surveillance laws) and human rights-oriented lobbying in legislative and policymaking processes may also advance legal protections for freedom of expression and privacy. 62. Arrangements with corporate partners should enable all parties to uphold their human rights responsibilities. In particular, such arrangements should be designed to ensure that subsidiaries, joint venture partners, suppliers and distributors will abide by whatever freedom of expression and privacy policies the company has in place. For example, when local operations receive unconventional censorship or surveillance requests, company policy should ensure that these requests are escalated to global management for review. 103 Whistle-blowing mechanisms should be made available to both employees and contractors. To the extent that companies are already in business relationships that raise human rights concerns, they should seek to build leverage over time to prevent or mitigate harm. 104 63. Companies may also enhance respect for human rights through collaborative action. Such collaboration includes joint outreach and advocacy with peer companies; engagement 100 101 102 103 104 Business and Social Responsibility, “Applying the Guiding Principles on Business and Human Rights to the ICT industry”, Version 2.0: Ten lessons learned, A briefing paper (September 2012), p. 9. ARTICLE 19, “Our 5G future: Light at the end of the tunnel or Internet fast-lane for the elite?” (15 September 2016). Electronic Frontier Foundation, “User privacy for ISPs and accidental ISPs”. Telecommunications Industry Dialogue submission, pp. 13 and 16. SHIFT, “Using leverage in business relationships to reduce human rights risks” (New York, November 2013). 17