A/HRC/35/22 with regional or international bodies, including human rights mechanisms and economic institutions; and membership in industry associations and multi-stakeholder initiatives. 105 Regular consultations with users, civil society and affected rights holders can also mobilize public support for company efforts to resist government overreach. Cross-sector collaboration strengthens the normative force of agreed upon human rights best practices and standards, intensifying pressure on both governments and peer companies to comply. 4. Mitigation strategies106 64. To the extent that companies handle content regulation and user data requests, specific policies and practices to mitigate the harms of government restrictions may be adopted. Ensure that requests for content restrictions and customer data are in strict compliance with the law 65. Companies should ensure that all requests for content restriction and customer data comply not only with procedural and legal requirements specified under local law, but also internationally established due process standards.107 Given the intrusion on human rights, such requests should be authorized by independent and impartial courts or adjudicatory bodies. Furthermore, companies should require that requests be made in writing and present a clear explanation of the legal basis, and the name, title and signature of the authorizing official. Companies should also seek to verify that the relevant official or government entity is authorized to issue this request.108 These formalities should be requested even if they are not required by law. Additionally, companies should preserve a written record of all communications between them and the requester relating to each request and logs of access to user data when executing the request, provided that such a record does not pose undue privacy risks.109 Interpreting the scope of government requests and laws 66. Vague and open-ended government requests and legal frameworks make it difficult for companies to determine whether they are in compliance with local law. However, companies can mitigate this uncertainty by adopting company-wide policies that direct all business units, including local subsidiaries, to resolve any legal ambiguity in favour of respect for freedom of expression, privacy and other human rights. Such policies are based not only on the provider’s human rights responsibilities, but also the State’s obligation to comply with applicable human rights laws and relevant protections under local law (such as constitutional, criminal procedure and data protection laws). 67. In practice, companies should as far as possible interpret requests in a manner that ensures the least restriction on content and access to customer data. For example, when requests appear overbroad, Global Network Initiative recommends that companies seek clarification on their scope and obtain appropriate modifications.110 105 106 107 108 109 110 18 Telecommunications Industry Dialogue submission, p. 12; and Global Network Initiative submission, p. 7. The guidance provided in this section benefited greatly from the Telecommunications Industry Dialogue submission and the Global Network Initiative, “Implementation guidelines for the principles on freedom of expression and privacy“. See, for example, the Manila Principles on Intermediary Liability and the International Principles on the Application of Human Rights to Communications Surveillance, co-authored by a number of nongovernmental organizations. Global Network Initiative, “Implementation guidelines“, pp. 5-6; also Telecommunications Industry Dialogue submission, pp. 8-10. Telecommunications Industry Dialogue submission, pp. 8-9. Ibid.