A/HRC/27/37 between right and restriction, between norm and exception, must not be reversed.”17 The Committee further explained that “it is not sufficient that the restrictions serve the permissible purposes; they must also be necessary to protect them.” Moreover, such measures must be proportionate: “the least intrusive instrument amongst those which might achieve the desired result”.18 Where there is a legitimate aim and appropriate safeguards are in place, a State might be allowed to engage in quite intrusive surveillance; however, the onus is on the Government to demonstrate that interference is both necessary and proportionate to the specific risk being addressed. Mass or “bulk” surveillance programmes may thus be deemed to be arbitrary, even if they serve a legitimate aim and have been adopted on the basis of an accessible legal regime. In other words, it will not be enough that the measures are targeted to find certain needles in a haystack; the proper measure is the impact of the measures on the haystack, relative to the harm threatened; namely, whether the measure is necessary and proportionate. 26. Concerns about whether access to and use of data are tailored to specific legitimate aims also raise questions about the increasing reliance of Governments on private sector actors to retain data “just in case” it is needed for government purposes. Mandatory thirdparty data retention – a recurring feature of surveillance regimes in many States, where Governments require telephone companies and Internet service providers to store metadata about their customers’ communications and location for subsequent law enforcement and intelligence agency access – appears neither necessary nor proportionate.19 27. One factor that must be considered in determining proportionality is what is done with bulk data and who may have access to them once collected. Many national frameworks lack “use limitations”, instead allowing the collection of data for one legitimate aim, but subsequent use for others. The absence of effective use limitations has been exacerbated since 11 September 2001, with the line between criminal justice and protection of national security blurring significantly. The resulting sharing of data between law enforcement agencies, intelligence bodies and other State organs risks violating article 17 of the Covenant, because surveillance measures that may be necessary and proportionate for one legitimate aim may not be so for the purposes of another. A review of national practice in government access to third-party data found “when combined with the greater ease with which national security and law enforcement gain access to private-sector data in the first place, the expanding freedom to share that information among agencies and use it for purposes beyond those for which it was collected represents a substantial weakening of traditional data protections.”20 In several States, data-sharing regimes have been struck down by judicial review on such a basis. Others have suggested that such use limitations are a good practice to ensure the effective discharge of a State’s obligations under article 17 of the Covenant,21 with meaningful sanctions for their violation. 17 18 19 20 21 CCPR/C/21/Rev.1/Add.9, paras. 11 – 16. See also European Court of Human Rights, Handyside v. the United Kingdom, para. 48; and Klass v. Germany, para. 42. CCPR/C/21/Rev.1/Add.9, paras. 11 – 16. See opinion of the Advocate-General Cruz Villalón of the Court of Justice of the European Union in joint cases C-293/12 and C-594/12, which suggests that the Directive 2006/24/EU (on the retention of data generated or processed in connection with the provision of electronic communications services) is “as a whole” in violation of the Charter of Fundamental Rights of the European Union because it fails to impose strict limits on such data retention. See also CCPR/C/USA/CO/4, para. 22. Fred H. Cate, James X. Dempsey and Ira S. Rubinstein, “Systematic government access to privatesector data”, International Data Privacy Law, vol. 2, No. 4, 2012, p. 198. See A/HRC/14/46, annex, practice 23. 9