States should adopt laws protecting privacy of personal information.
- Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).
- The gathering and holding of personal information on computers, data banks and other devices, whether by public authorities or private individuals or bodies, must be regulated by law. Effective measures have to be taken by States to ensure that information concerning a person’s private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant.
- In implementing these Guidelines, Member countries should: (…) b) adopt laws protecting privacy.
- The Human Rights Council, (…) 17. Urges States to adopt, implement and, where necessary, reform laws, regulations, policies and other measures concerning personal data and privacy protection online in order to prevent, mitigate and remedy the arbitrary or unlawful collection, retention, processing, use or disclosure of personal data on the Internet that could violate human rights.
- The General Assembly (...) 6. Calls upon all States: (...) (g) To consider adopting and implementing data protection legislation, regulation and policies, including on digital communication data, that complies with their international human rights obligations, which could include the establishment of national independent authorities with powers and resources to monitor data privacy practices, investigate violations and abuses and receive communications from individuals and organizations, and to provide appropriate remedies.
- States should adopt strong data protection laws and update electoral and other relevant laws to limit the pervasive tracking and targeting of individuals and their activities online.
- The legal framework should prohibit the collection, use or dissemination of personal data or information in any manner for any purpose other than the exercise of suffrage rights. In particular, care should be given to provisions that relate to fingerprints, photographs and personal identification numbers, as well as to ethnicity or other factors that could lead to discrimination or place the voter at risk of personal harm.
- Domestic legislation of the state must contain data protection provisions for the regulation of the automatic processing of personal data.
- Citizens need to be protected in the processing of personal data particularly during the election period when large amounts of personal data are processed, including those available in the electoral registers. As regards the registers data privacy has to be balanced against the transparency required for electoral integrity.