A/HRC/43/52 49. States should ensure that employee records are not exempt from privacy and data protection regulation. O. Social security protection 50. States and non-State actors should recognize that all individuals, regardless of their gender, have the right to social security, the right to privacy in relation to receipt of that protection and the right to lawful processing of their personal information collected as part of the process of receiving such protection. 51. States should ensure that: (a) All necessary legislative, administrative and other measures are taken to ensure that social security programmes and strategies enable the development of the personality and promote social and economic inclusion regardless of gender, without undue intrusion into the personal circumstances of recipients; (b) Regulation of the receipt of social security benefits and assistance incorporates a human rights framework that stresses privacy, dignity, choice, self-respect, autonomy and self-determination, is grounded in law and is conducted transparently; (c) The digitalization of welfare arrangements is accompanied by careful and transparent consideration of gender impacts, with programmes designed to promote and teach prerequisite digital skills; reasonable access to necessary equipment and effective online access; genuine non-digital options to gain access to benefits; consultation with intended users; and participatory evaluation; (d) Effective action is taken to prevent societal biases relating to gender from being embedded through automated decision-making in social welfare programmes and systems, including predicting risk; (e) Record system arrangements and data-collection practices, including crossmatching, data sharing and cross-verification across data sets underlying the creation, auditing and maintenance of data relating to gender are compliant with best practice data protection regulation; (f) Access is provided to effective appeal mechanisms and remedies for exclusion from social security programmes or targeting and harassment based on gender; (g) Where the provision of benefit and social assistance systems involves private entities, measures are taken to make sure that: (i) Gender privacy protections are included in such contracts and contain remedial measures for breaches of such provisions; (ii) No conflicts exist between the public interests that the systems serve and the private interests of corporations and their owners. P. Security and surveillance 52. States and non-State actors should: (a) Protect the privacy of digital communications and enjoyment of the right to privacy by all individuals, regardless of their gender, by promoting tools such as encryption; (b) Ensure that restrictions to the right to privacy, including through mass or targeted surveillance, requests for personal data or limitations on the use of encryption, pseudonymity and anonymity tools: (i) Are on a case-specific basis; (ii) Do not discriminate on the basis of gender or other factors, such as indigeneity; (iii) Are reasonable, necessary and proportionate as required by law for a legitimate purpose and ordered only by a court. 23