A/HRC/41/35 these cases as well. Moreover, as in the Doe case noted above, courts may be unwilling to entertain lawsuits against foreign sovereigns. While the rules for such suits vary, States should interpret the norms of sovereign immunity to ensure that their courts may entertain suits against foreign Governments. C. Obligations of Governments licensing export of surveillance technology 57. The Wassenaar Arrangement is not the final word on the control of exports of surveillance technologies; the enforcement of control lists depends upon national implementation. Neither does the Arrangement involve the participation of all major exporting countries: Israel, a major player in the surveillance technology market, claims that it is “fully compliant” with the Arrangement, although it has yet to become a participating State. 69 It is also a limited framework, since, notwithstanding its important objectives related to regional and international peace and security, it does not have a human rights orientation. Nonetheless, given that the Arrangement establishes standards that carry the expectation of broad implementation and compliance, participating States should leverage this valuable forum to impose rights-based limitations on the transfer of surveillance technologies. 58. In order to improve its role in developing global export standards, participating States would benefit from a human rights working group that could propose and consider standards for exports that integrate human rights concerns in technology transfers. But whether it adopts such a working group or other mechanism, it should develop a framework under which the licensing of any technology would be conditional upon a national human rights review and companies’ compliance with the Guiding Principles on Business and Human Rights, as discussed below. As Privacy International put it, participating States, as well as other exporting Governments, should deny licensing “where there is a substantial risk that those exports could be used to violate human rights, where there is no legal framework in place in a destination governing the use of a surveillance item, or where the legal framework for its use falls short of international human rights law or standards”.70 To ensure compliance when export licences are denied on this basis, the surveillance technologies in question should be incorporated into existing sanctions regimes. 71 59. While such standards would be valuable additions to the Wassenaar Arrangement, the ability of the public or specific civil society organizations to monitor their implementation will depend on stronger transparency obligations at the national and international levels. The Arrangement itself should promote such transparency by setting clear and enforceable guidelines for intergovernmental information-sharing and public disclosures concerning licensing standards, decisions to authorize, modify or reject licences, incidents or patterns of misuse of surveillance technologies and related human rights violations, and the treatment of digital vulnerabilities. National export laws should also allocate sufficient resources for public record-keeping and accessibility concerning export licensing decisions, and mandate relevant government agencies to solicit public input and conduct multi-stakeholder consultations when they are processing applications of export licences. Finally, States should also establish safe harbours for security research and exempt encryption items from export control restrictions.72 D. Companies’ implementation of the Guiding Principles on Business and Human Rights 60. Given the extraordinary risk of abuse of surveillance technologies, the granting of export licences should be prohibited under domestic law unless a company regularly 69 70 71 72 See Wassenaar Arrangement, “IL – Israel cybersecurity export control policy” (PowerPoint presentation), June 2016. Privacy International submission, p. 8. Ibid., pp. 3–4. Ibid., p. 5. 17