A/HRC/41/35 on many areas of human rights law and thus many mandates of special procedures – interfere with fundamental human rights. V. Recommendations 66. For States: (a) States should impose an immediate moratorium on the export, sale, transfer, use or servicing of privately developed surveillance tools until a human rights-compliant safeguards regime is in place; (b) States that purchase or use surveillance technologies (“purchasing States”) should ensure that domestic laws permit their use only in accordance with the human rights standards of legality, necessity and legitimacy of objectives, and establish legal mechanisms of redress consistent with their obligation to provide victims of surveillance-related abuses with an effective remedy; (c) Purchasing States should also establish mechanisms that ensure public or community approval, oversight and control of the purchase of surveillance technologies; (d) States that export or permit the export of surveillance technologies (“exporting States”) should ensure that the relevant government agencies solicit public input and conduct multi-stakeholder consultations when they are processing applications for export licences. All records pertaining to export licences should be stored and made available to the greatest extent possible. They should also establish safe harbours for security research and exempt encryption items from export control restrictions; (e) Exporting States should join the Wassenaar Arrangement and abide by its rules and standards to the extent that these are consistent with international human rights law; (f) States participating in the Wassenaar Arrangement should develop a framework by which the licensing of any technology would be conditional upon a national human rights review and companies’ compliance with the Guiding Principles on Business and Human Rights. Such a framework could be developed through a specially established human rights working group. Additionally, they should set clear and enforceable guidelines on transparency and accountability with respect to licensing decisions, surveillance-related human rights abuses and the treatment of digital vulnerabilities. 67. For companies: (a) Private surveillance companies should publicly affirm their responsibility to respect freedom of expression, privacy and related human rights, and integrate human rights due diligence processes from the earliest stages of product development and throughout their operations. These processes should establish human rights by design, regular consultations with civil society (particularly groups at risk of surveillance), and robust transparency reporting on business activities that have an impact on human rights; (b) Companies should also put in place robust safeguards to ensure that any use of their products or services is compliant with human rights standards. These safeguards include contractual clauses that prohibit the customization, targeting, servicing or other use that violates international human rights law, technical design features to flag, prevent or mitigate misuse, and human rights audits and verification processes; (c) When companies detect misuses of their products and services to commit human rights abuses, they should promptly report them to the relevant domestic, regional or international oversight bodies. They should also establish effective 20