A/HRC/32/38 restrictions fail to meet the standard of article 19 (3), individuals enjoy the right to an effective remedy under article 2 (3) of the Covenant. 8. Individuals enjoy the full range of other rights online as well, such as privacy, religious belief, association and peaceful assembly, education, culture and freedom from discrimination. States have both a negative obligation to refrain from violating rights and a positive obligation to ensure enjoyment of those rights. These positive obligations may require public authorities to take steps to protect individuals from the actions of private parties.6 B. A framework for private sector responsibilities 9. Human rights law does not as a general matter directly govern the activities or responsibilities of private business. A variety of initiatives provide guidance to enterprises to ensure compliance with fundamental rights. The Human Rights Council endorsed the Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework (see A/HRC/17/4 and A/HRC/17/31). Reflecting existing human rights law, the Guiding Principles reaffirm that States must ensure that not only State organs but also businesses under their jurisdiction respect human rights.7 10. The Guiding Principles provide a framework for the consideration of private business responsibilities in the information and communications technology sector worldwide, independent of State obligations or implementation of those obligations. For instance, the Guiding Principles assert a global responsibility for businesses to avoid causing or contributing to adverse human rights impacts through their own activities, and to address such impacts when they occur and seek to prevent or mitigate adverse human rights impacts that are directly linked to their operations, products or services by their business relationships, even if they have not contributed to those impacts. 8 11. Due diligence, according to the Guiding Principles, enables businesses to identify, prevent, mitigate and account for how they address their adverse human rights impacts. 9 In the digital environment, human rights impacts may arise in internal decisions on how to respond to government requests to restrict content or access customer information, the adoption of terms of service, design and engineering choices that implicate security and privacy, and decisions to provide or terminate services in a particular market. 12. As a matter of transparency, the Guiding Principles state that businesses should be prepared to communicate how they address their human rights impacts externally, particularly when concerns are raised by or on behalf of affected stakeholders. 10 The United Nations High Commissioner for Human Rights has also urged information and communications companies to disclose risks and government demands transparently (see A/HRC/27/37). Meaningful disclosures shed light on, among other things, the volume and context of government requests for content removals and customer data, the processes for handling such requests, and interpretations of relevant laws, policies and regulations. 6 7 8 9 10 See general comment No. 31 (2004) on the nature of the general legal obligation imposed on States parties to the International Covenant on Civil and Political Rights. Other norms of international law may apply directly to the activities of private actors, such as the criminalization of crimes against humanity, war crimes and acts of genocide under international humanitarian law. Guiding Principles on Business and Human Rights, chap. I (A) (1). Ibid., chap. II (A) (11)-(13). Ibid., chap. II (A) (17). Ibid., chap. II (B) (21). 5