Digital Rights Foundation

More about our partner

Change

Influence key stakeholders

Content

Stories

Media

DRF 2.png

Summary

Pakistan’s vision of becoming a “Digital Nation” reflects an aspiration to digitise public life. The Digital Nation Pakistan Act 2025 aims to centralise the country’s digital governance, including digital services, data systems and cybersecurity.

Open Letter to Facebook and Google

tech-admin — Thu, 28 Jan 2021 15:49:02 +0000

Target Profile

Google

Facebook

Audiences and Purpose

Change

We campaign for solutions

Content

ryul-davidson-PcyrQsX5f4w-unsplash.jpg

Summary

Privacy International is part of a 60+ coalition calling on Facebook and Google to provide equal and better transparency regarding political advertising on their platforms globally.

Media

Key points

We believe it is necessary for both Google and Facebook to:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

This letter is also available in Spanish.

Dear Mr. Zuckerberg and Mr. Pichai,

In the past few years, you have pioneered important transparency tools to help your platform users understand, learn about and contextualise the political advertising they see. We agree that advertiser verification processes and ad repositories are key safeguards against online manipulation and misinformation. However, we are saddened to observe that these benefits have not been equally distributed among your global user base.
Each platform operates fluctuating and often widely differing transparency standards for different countries. While some users benefit from seeing political advertising in an ad repository, others do not. Where some users are offered detailed information about a political ad, others are not. There are no legitimate or otherwise publicly disclosed reasons justifying this difference in treatment.
The combined effect of these inconsistent policies is to create a two-tiered user base within each platform, with a wide regulatory gap separating the transparency haves and have-nots. We first highlighted these problems in 2019. While some progress has been made since, we are disappointed to conclude that the transparency divide persists.
Online transparency should not be a privilege of the few, but the right of all. To that end, the changes we believe are necessary are as follows:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

Uganda

Region of Operation

Africa

Website

Link: https://digitalrightsfoundation.pk/protecting-your-digital-rights-during-the-covid-19-outbreak/

Our campaign

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

The role of social media and search platforms in political campaigning and elections has come under scrutiny. Concerns range from the spread of disinformation, to profiling of users without their knowledge, to micro-targeting of users with tailored messages, to interference by foreign entities, and more. Significant attention has been paid to the transparency of political ads, and more broadly to the transparency of online ads.

Notably, in the lead up to the 2019 EU Parliamentary elections Facebook, Google, and Twitter, as well as the Interactive Advertising Bureau and others, agreed to take a series of steps to prevent online disinformation on their respective platforms. These measures are reflected in a self-regulatory Code of Practice on Disinformation and the companies provided the European Commission with monthly updates on their progress.

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

Learn more

Democratic engagement is increasingly mediated by digital technology, from campaigning to election results transmission. These technologies rely on collecting, storing, and analysing personal information to operate. They raise novel issues and challenges for all electoral stakeholders on how to protect our data from exploitation.

Digital Rights Foundation - Protecting digital rights during the COVID-19 outbreak

staff — Wed, 20 May 2020 11:13:13 +0000

Digital Rights Foundation - Protecting digital rights during the COVID-19 outbreak staff Wednesday, May 20, 2020

Our partners from Digital Rights Foundation in Pakistan wrote a piece analysing cases of privacy violations, misinformation, hate speech and other cases. As they said, the situation with regards to the Coronavirus is still developing in the country and Digital Rights Foundation, are keeping an eye out for the developments regarding the disease and also assessing how the digital rights sphere is being affected.

Location

More about our partner

Tracking the Global Response to COVID-19

See more examples

Civil society's Covid response

Date

Friday, March 13, 2020

Content

Educational

Stories

An open letter to Google

tech-admin — Wed, 08 Jan 2020 15:19:16 +0000

Target Profile

Google

Audiences and Purpose

Influence key stakeholders

Change

We campaign for solutions

Content

Pi-Android-mock-up-3-1-photo correct.png

Summary

Privacy International and over 50 other organisations have submitted a letter to Alphabet Inc. CEO Sundar Pichai asking Google to take action against exploitative pre-installed software on Android devices.

Media

Key points

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

Note: This letter is also available in French and Spanish

Dear Mr. Pichai,

We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.

And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.

These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store.

These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.

We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.

The changes we believe are needed most urgently are as follows:

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.

We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

Yours sincerely,

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Latin America

Website

Asociación por los Derechos Civiles

Coding Rights

Coding Rights is a Brazilian-based think tank that aims to advance the enforcement of human rights in the digital world. Its goal is to ensure that policy-making affecting technological development and digital rights is informed by actual technological knowledge, and that technological development is guided by fundamental human rights.

Country of Operation

Brazil

Region of Operation

Latin America

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Region of Operation

Asia

Website

DRF

Foundation for Media Alternatives

The Foundation for Media Alternatives (FMA) is a non-profit service institution that supports citizens and communities—in particular civil society organisations and other development stakeholders—in their strategic use of Information and Communication Technologies (ICTs). It was founded in 1987 and is based in Manila.

Country of Operation

Uganda

Region of Operation

Africa

Website

Influence key stakeholders

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

When you buy a brand new lower cost phone (like a Tecno Y2 or MYA 2 for example), it's likely to come pre-installed with insecure apps and an outdated operating system. What this means is that your or your loved ones could be left vulnerable to security risks or to having their data exploited.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Lettre ouverte à Google

tech-admin — Tue, 07 Jan 2020 15:23:23 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

Content

Pi-Android-mock-up-1-1-photo.png

Summary

Privacy International et plus de 50 autres organisations ont soumis une lettre au PDG d'Alphabet Inc., Sundar Pichai, demandant à Google de prendre des mesures contre les logiciels préinstallés sur les appareils Android qui exploitent les données des utilisateurs.

Media

Key points

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Vous pouvez trouver la lettre ci-dessous. Ajoutez votre voix à cette campagne en signant notre pétition si vous pensez qu'il est temps que Google cesse d'activer l'exploitation.

Ce contenu est également disponible en anglais et en espagnol.

Cher M. Pichai,

Nous, les organisations signataires, sommes d’accord avec vous :
la vie privée n’est pas un luxe, offert seulement à ceux qui en ont les moyens.

Pourtant, les « Android Partners » – qui utilisent la marque déposée Android – fabriquent des téléphones avec des applications préinstallées qui ne peuvent pas être supprimées (connues sous le nom de bloatware). Ces applis rendent les utilisateurs très vulnérables : leurs données sont collectées, partagées et exposées sans leur consentement ou même sans qu’ils en aient conscience.

Ces téléphones portent le label « Google Play Protect » alors qu’une étude montre que 91 % des applis préinstallées ne sont pas proposées sur Google Play – Google App Store.

Ces applis préinstallées peuvent avoir certaines autorisations du fabricant qui les laissent fonctionner en-dehors du système de sécurité Android. Ces autorisations, définies par l’appli elle-même (incluant l’accès au microphone, à la caméra et à la géolocalisation), ne déclenchent aucune notification d’alerte de sécurité d’Android. Les utilisateurs n’ont absolument pas connaissance de ces intrusions majeures.

Nous sommes préoccupés par le fait que les utilisateurs de téléphones bon marché sont livrés à ces pratiques commerciales inquiétantes dans le monde.

Les changements que nous demandons en urgence sont les suivants :

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Nous, les signataires, pensons que ces changements justes et raisonnables auraient un impact considérable pour des millions de personnes dans le monde, qui ne devraient pas avoir à renoncer à leur vie privée et à leur sécurité en achetant un smartphone.

Nous vous demandons, puisque vous êtes un acteur influent du système, de mieux protéger les personnes et d’empêcher les fabricants de les utiliser abusivement, dans cette course effrénée aux bas prix des smartphones.

Je vous prie d'agréer, Monsieur, l'expression de nos sentiments distingués.

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

Country of Operation

Uganda

Region of Operation

Africa

Website

Safeguarding Peoples' Dignity

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

#IWD2019 Online gender-based violence: a privacy matter?

staff — Thu, 07 Mar 2019 16:33:42 +0000

#IWD2019 Online gender-based violence: a privacy matter? staff Thursday, March 7, 2019

For International Women’s Day 2019, Privacy International looks at some of the key themes around the intersection of gender rights and the right to privacy and we review the work we and our partners have done on those topics.

When dealing with cases of non-consensual sharing of intimate images, often known as ‘revenge porn,’ or doxxing, where a person’s personal details are shared publicly, the link between privacy and online-gender-based violence is very clear. Privacy violations are used to oppress women and gender diverse people. But those cases are not the only way in which privacy and gender-based violence are linked.

Gender-based online violence: No place to hide

Survivors of online gender-based violence talking about their experience tend to describe a degree of abuse that becomes impossible to escape. In a world where technology has become inseparable from the physical world and we rely on it in our everyday lives, the abuse ends up impacting every aspect of our lives. This inescapability is key to understanding how the experience of harassment and online gender-based violence is related to privacy.

The right to privacy was first addressed as such in a legal context with American lawyers Samuel Warren and Louis Brandeis defining it as “the right to be let alone.” Online gender-based is an attempt by an abuser to never let their target alone, to deny them a private space, be it online or offline, to the extent that such a distinction is even still feasible.

And with the further development and roll out of connected devices, the future of online-gender-based violence will carry new opportunities for abuse. Interviewed in Privacy International’s report on Gender and Privacy, Leonie Tanczer, lecturer at UCL’s Department of Science, Technology, Engineering and Public Policy, told us: “While now harassment can take place on platforms such as Twitter or through the interference with very distinct devices such as my tablet, in the very near future one will be able to tamper with my connected driverless car, my smart lock, or just troll me through my dozen Internet-connected devices.”

Online-gender-based violence cannot be divorced from the social context in which it happens. It is now an isolated phenomenon happening online but the reflection of patriarchal structures that allow men (in most cases) to feel entitled to harass women and gender-diverse people online.

Online harassment targeting women and LGBTIQ persons

SMEX – our partner in Lebanon – have looked at the specific context of online harassment against women and LGBTIQ individuals in Lebanon. Their report highlights the adversarial role of the authorities, which are preventing survivors – in particular LGBTIQ individual – from handling online blackmail and privacy threats in a safe and sustainable way. But most of all their interviewees believed that “that the most effective long-term solutions to online privacy threats involves changing the current societal and legal landscape and promoting an environment that is safe and inclusive both offline and online, for women and members of the LGBTIQ communities.”

Legal frameworks restricting the expression of sexuality

The Foundation for Media Alternatives (FMA) – our partner in the Philippines – noted a similar trend with a legal framework that remained gender-insensitive, sometimes “restricting full expression of one’s sexuality” despite a rise in the number of privacy violations online that target women and LGBTQIA+ individuals in the Philippines. In their report, FMA demands and change and condemns “centuries-old cultural assimilation of a patriarchal worldview, further skewed by restrictions imposed by organized religion [that] has made Filipino notions and standards of privacy inherently unfair to women and the LGBTQIA+ community.”

The need for a principle and comprehensive approach

In Chile, our partner Datos Protegidos also noted the need for a change in the legal framework in their nine recommendations (in Spanish) for a safer internet for women and the LGBTIQ+ community in Chile. In particular, they propose to change to the Chilean cybercrime law, adding new penalties for non-consensual image sharing and compensations proportional to the abuse that survivors have experienced.

Datos Protegidos also stresses the need for trainings of law enforcement to insure they are qualified to adequately handle online-gender based violence. This is an issue that Privacy International has observed across the world: civil society organisations working on the issue of online-gender-based violence all raised the issue of law enforcement’s lack of familiarity and/or capacity when it comes to responding to survivors’ complaints.

Ride sharing apps from a gender perspective

We highlighted earlier the new forms online-gender-based harassment will take, as we step into a world where the border between online and offline becomes blurry and the online/offline divide becomes irrelevant.

Our partner in Pakistan, the Digital Rights Foundation explore an aspect of this question in their report on ride-sharing apps. The report looks at the various forms of harassment consumers had experienced when using those apps and the complaint mechanisms in place. Based on surveys and interviews, the report found out complaint mechanism was the only recourse for women who feel unsafe on the apps.

The need for a gendered right to privacy

All of these cases show that with technologies transforming our experience of the world, we will need a right to privacy well suited to protect women and gender diverse people from new forms of abuses, which will keep emerging as long as the patriarchal structures that fuel gender-based violence remain unchallenged.

We want a right to privacy that will help deconstructing and smashing those structures and we are looking for your contribution to that fight, not just on women’s day, but for the years to come. Will you join us?

Learn more

Gender

Internet of Things

Our fight

Location

More about our partner

Foundation for Media Alternatives

When Social Media makes you a target

SMEX

Our campaign

Content

Communications Surveillance

Data Privacy Week: Privacy in Public Spaces

staff — Wed, 30 Jan 2019 09:10:04 +0000

Data Privacy Week: Privacy in Public Spaces staff Wednesday, January 30, 2019

The Privacy International Network is celebrating Data Privacy Week, where we’ll be talking about how trends in surveillance and data exploitation are increasingly affecting our right to privacy. Join the conversation on Twitter using #dataprivacyweek.

In the era of smart cities, the gap between the internet and the so-called physical world is closing. Gone are the days, when the internet was limited to your activities behind a desktop screen, when nobody knew you were a dog.

Today, the objects surrounding us and those we carry with us, are increasingly connected to the internet. Even our bodies, through apps and devices that track our physical data, are now connected.

This new reality is transforming our public spaces. Many cities in particular have become heavily surveilled by governments and companies alike. This has real consequences for our democracies and deny us room for dissent and protest.

In 2018, the Privacy International Network conducted extensive research and advocacy on the issue of privacy in public spaces. Today, as part of Data Privacy Week, we look at some of the work that has been published.

Our fight for transparency on the use of IMSI Catchers

An IMSI catcher is an intrusive piece of technology that can be used to locate and track all mobile phones that are switched on in a certain area. It can be used to track attendees of a political demonstration or a public event like a football match. IMSI catchers represent an enormous invasion of our right to privacy, and potentially our rights to free expression and free assembly.

In 2018, we filed an appeal before the First-tier Tribunal in the UK to challenge a series of decisions by the Information Commissioner’s Office upholding the refusal of various police forces to disclose information about their purchase and use of IMSI catchers.

The case emerged from a series of Freedom of Information (FOI) requests submitted by PI to police forces across the UK to find out which ones among them had purchased IMSI catchers. All of the bodies refused every category of the FOI requests on grounds that they could “neither confirm nor deny” whether they held information responsive to the request.

Drones

Drones are now seemingly ubiquitous, deployed by countries to ostensibly promote safety and security in public spaces. But what, really, is the impact of drones on ordinary citizens, specifically on their right to privacy?

In the Philippines, drones have been used to support military operations, traffic management, infrastructure inspection, and more. However, a report by the Foundation for Media Alternatives highlights that this expansion in use has not been matched by adequate legal safeguards, and calls on policymakers to act soon to limit the dangers to human rights.

Indiscrete cameras and failed surveillance projects

Fundación Karisma published their analysis on a failed CCTV surveillance project that was meant to be implemented in Bogotá's public transport system.

Why are we talking about a surveillance project that didn't work instead of celebrating that fact? Because we must analyse and debate these projects to debunk some common myths when they are proposed. Governments have a tendency to oversimplify the complexity and costs involved in surveillance projects, embarking on initiatives that violate human rights and don't live up to their promises.

Eye on crime – investigations on the purchase of CCTV cameras in South Africa

Nowadays, CCTV has seemingly become an integral part of crime control and urban development policy, promoted by police forces and politicians as a primary solution for civic dysfunction. In 2018, we supported the publication of two investigations by Heidi Swart on the purchase of CCTV cameras in Johannesburg and Cape Town in the South African online newspaper Daily Maverick.

In September, Swart revealed how the purchase of new high-tech surveillance cameras in Johannesburg – featuring facial recognition – could lead to false arrests, the targeting of innocent citizens and discrimination against minorities.

Later that year, Swart shed light on the hidden cost of the 1,500 CCTV cameras and surveillance drones deployed in Cape Town.

Punjab government’s Safe Cities project: Safer city or over policing?

In Pakistan, the Punjab government finalised its Safe Cities initiative in early 2018, which saw the installation of 8,000 CCTV cameras around the capital with the aim of improving urban policing through ICTs. The Digital Rights Foundation examined the project from a human rights perspective, and found that a lack of regulation could result in it eventually being used as a tool to justify increased surveillance in public spaces.

Our cities are turning into increasingly surveilled spaces, where there is no longer such a thing as strolling anonymously down the streets. The PI Network will continue documenting the realities of surveillance and keep pushing back against projects that negatively affect our human rights.

Learn more

Smart Cities

Policing and Technology

What PI is fighting for

Modernise the Rule of Law and Strengthen Surveillance Safeguards

Location

More about our partner

Privacy International v. Information Commissioner's Office (IMSI Catcher FOIA)

Fundación Karisma

Our legal action

Content

Social Media Surveillance

Data Privacy Week: Confronting the Corporate Gaze

staff — Tue, 29 Jan 2019 08:47:26 +0000

Data Privacy Week: Confronting the Corporate Gaze staff Tuesday, January 29, 2019

It is no mystery that data exploitation is part of most consumer-oriented tech companies’ business models. A big part of our lives is recorded and exploited, from our web searches, to our personal communications, location, and our shopping habits, just to name a few data points, to generate even more data about us, through the observation of the data trail we leave behind.

Our lives are then not only under the scrutiny of governments and their (mass) surveillance activities, but also under the eyes of corporations looking to extract value from our data and interactions. All of this is happening at a global scale, and in many cases with little or non-existent safeguards.

The Privacy International Network is working to expose companies that fail to protect their customers’ data, analysing their terms of service and practices, exploring how users perceive social media platforms, and studying how these platforms are being leveraged for intelligence purposes.

Telecommunications: How do they (not) defend our data?

How transparent are telecommunication companies about their collaboration with law enforcement agencies? Red en Defensa de los Derechos Digitales (R3D) posed that question in their report “Who does not defend your data” (available in Spanish). It examines a new federal telecommunications law in Mexico that imposed obligations for telecommunications companies to collaborate with law enforcement agencies, many of them poorly drafted and undermining the right to privacy.

In Uganda, Unwanted Witness had a similar question. They researched the existing legal framework on telecommunications and privacy to explore how companies were protecting their customers’ data. Their subsequent report is pretty self-explanatory: Your Communication and Personal Data is not Safe Anymore, and highlights the lack of regulation to protect the rights of the users of telecom companies and Internet Service Providers, which is compounded by the absence of data protection legislation.

(In)visible followers: Social and state surveillance enabled by social media

Our relationship with social media is becoming increasingly complex: while providing new audiences to promote our messages and defend our causes, it also enables unprecedented levels of surveillance of our actions.

7iber focused their attention on that tension, investigating why people in Jordan are increasingly migrating from Facebook to Twitter (available in Arabic). Their research found that, among other factors, users' perception of social surveillance from their families on Facebook had triggered that decision.

Meanwhile, the Argentina-based Asociación por los Derechos Civiles researched the use of open source intelligence in their report “Followers we don’t see” (available in Spanish). They analysed the government's monitoring of social media to investigate crimes, and detailed how this ‘cyber patrolling’ had eroded the right to privacy and freedom of expression, creating a chilling effect for social media users.

In some cases the scale of the surveillance is bigger. In a report launched this week, 7amleh, a partner organisation from Palestine, describes how the Israeli government restricts key telecommunications infrastructure in Palestine, including access to frequencies and key network equipment. This control of key infrastructure facilitates violations of Palestinians’ right to privacy and freedom of expression.

Digital platforms: How accountable are they?

Finally, there is the question of the accountability of digital platforms. Two members of the PI Network have studied this issue: Dejusticia, in Colombia, researched the accountability of Google and other big Internet companies, while Digital Rights Foundation (DRF) prepared a report about ride-sharing apps in Pakistan.

After analysing privacy policies from more than 30 companies with business models based on data exploitation, Dejusticia found that their practices were not properly addressed by the current personal data framework (available in Spanish). Moreover, they concluded that many of these practices, like user profiling, need to be further addressed by legislative and regulatory reform.

In Pakistan, DRF prepared a detailed study on the practices of Uber and Careem in the country, highlighting the need for better complaints mechanisms and security procedures, which are particularly necessary from a gender perspective and the specific impacts that such policies have over women. They also found that both companies’ privacy policies lack basic guarantees such as data breach disclosures and contain unspecified data sharing provisions, among other flaws.

Countering the hidden data ecosystem

Alongside the work of its partners, Privacy International has been active in countering corporate exploitation. Last year, we presented a complaint against seven companies for wide-scale and systematic infringements of data protection law.

We also launched a report outlining how how apps on Android share data with Facebook, finding that at least 61 percent of the apps that were tested automatically transfer data to Facebook the moment a user opens the app, regardless of whether people have a Facebook account or not.

The fight to confront and counter the corporate gaze is only beginning, and we will keep working with the Network to expose and push back against exploitative practices that impact our privacy, freedom, and autonomy.

Learn more

Data Protection

What PI is fighting for

Expose Data Exploitation: Data, Profiling, and Decision Making

Our fight

Safeguarding Peoples' Dignity

Location

Jordan

Palestine

Mexico

More about our partner

Dejusticia

La Asociación por los Derechos Civiles

Red en Defensa de los Derechos Digitales

Our campaign

Our data is not for trade

When Big Brother Pays Your Benefits

When Social Media makes you a target

Content

Develop Protections Against Data Intensive Systems in the Global South

From smart cities to safe cities: normalising the police state?

staff — Wed, 15 Aug 2018 17:50:29 +0000

From smart cities to safe cities: normalising the police state? staff Wednesday, August 15, 2018

The idea of a “smart city” is primarily a marketing concept, used to sell data-intensive technologies under the pretext of improving the functioning of cities. This could include injecting ‘smart’ tech into delivering services, public safety, environmental monitoring, traffic control, among other possible applications.

One in particular aspect of smart cities has been consistently problematic: how these projects are used to boost law enforcement and policing under the guise of public safety. A report published by Privacy International last year featured case studies from Rio de Janeiro and Davao city, highlighting how these projects aren’t really improving public safety nor improving crime rates, but exacerbating inequalities and repressing public manifestations.

As a result of these projects, cities are transforming into monitored spaces, where an individual’s autonomy is steadily shrinking. The right to privacy in a connected city is also affected, since people are no longer expected to control how their data is collected, processed, and shared, but instead, are exposed to both government and corporate surveillance from the moment they leave their homes. In other words, smart cities are just a fancy name for turning urban centres into high-tech Panopticons.

The case of the Government of Punjab (Pakistan) goes a step further. The project isn’t even branded as a “smart city”, but “safe cities”. While the “smart city” name already involves indiscriminate surveillance and data collection, it still evokes a sense of opportunity to improve the life conditions of the inhabitants of a city through the use of technology.

According to the analysis of our partner in Pakistan, Digital Rights Foundation, the concept of “safety” behind the project is not necessarily aligned with most people’s expectations around safety, which involves public spaces being welcoming of everyone.

Instead, the “safe cities” project implies a further shift towards mass policing and surveillance. This raises even more questions and concerns around its impact on human rights such as privacy, freedom of movement, and non-discrimination, while exploiting people’s fears and concerns.

The idea that just by procuring more digital technologies for law enforcement purposes abuses of power will stop and safety will be improved, is flawed. Without more transparency, accountability, strong privacy policies, meaningful oversight, and limits to power, more technology will only deepen these systemic problems and reinforce current power imbalances.

In sum, the shift in branding “smart cities” as “safe cities” is a worrying development. Not because both concepts are too different in practice, given that often the difference lies only in the name. The problem lies in how this discursive shift normalises how governments tend to focus on deploying new technologies for surveillance and policing under vague conceptions of safety and security, with human rights only as an afterthought, all without making anybody (but a handful of people) any safer.

Digital Rights Foundation report titled “Punjab Government’s Safe Cities Project: Safer City or Over Policing?” can be found here.

Learn more

Smart Cities

What PI is fighting for

Location

Asia

More about our partner

Content

Personal Data Protection Bill in Pakistan: it’s important to get it right!

staff — Tue, 14 Aug 2018 17:36:14 +0000

Change

Content

Impact

We welcome the effort by the Pakistani Ministry of Information Technology and Telecommunications to regulate the processing of personal data in Pakistan, and take measures to guarantee the right to privacy as guaranteed under Article 14(1) of the Constitution: “[t]he dignity of man and, subject to law, the privacy of home, shall be inviolable.”

This legislative development is crucial and timely as Pakistan continues to embrace innovative governance initiatives and deploy data-intensive systems which have taken the form of a biometric national identity system known as NADRA, a biometric verification voter system, biometric SIM card registration as well as smart city projects such as the Punjab Safe City project, in Islamabad and Lahore in 2016, amongst others.

To find out more about privacy and data protection in Pakistan please refer to our ‘ State of Privacy’ and ‘State of Surveillance’ briefings.

Whilst data protection is only one piece of the puzzle which must be complemented by other legal safeguards to regulate any activities which include the processing of personal data as well as respect for rule of law and protection of international human rights standards, a comprehensive data protection framework constitutes a foundational mechanism for individuals to exercise their right to privacy.

Working with its partner the Digital Rights Foundation, Privacy International has presented to the Pakistani Ministry of Information Technology and Telecommunications an initial analysis of the Personal Data Protection Bill presented for consultation. While comprehensive in some respects, the Personal Data Protection Bill has a number of significant shortcomings.

We recommend that to effectively protect privacy and meet internationally recognised data protection standards, full consideration must be given to the areas of concern and improvements presented below and developed in more detail in our submission under each Part of the Bill:

To include public bodies and government-held personal data: The scope of the law should not be restricted to commercial transactions;
Expanding the definition of “personal data”: As a central component of the law, the definition of personal data must be reviewed to encompass all personal data held by both private and public bodies without the caveat of “commercial transactions” attached to it;
Define the scope of the Act clearly: It is essential for the law to clearly define its material and territorial scope to ensure that the rights of data subjects are protected regardless of where their data is processed or held;
Definition of consent: Given that consent of the data subject is one of the major grounds for processing of personal data, it is important that consent be defined clearly in section two, and that the definition adopted ensures that consent must be explicit, free, informed, proactive and specific;
The definition of “sensitive personal data”: Biometric and genetic personal data must be included within the definition of sensitive personal data. This is particularly relevant in Pakistan where various biometric data-intensive systems have been deployed;
Safeguards against mass surveillance: Data processing by law enforcement agencies and investigative and intelligence bodies must be included within the scope of the law to ensure those activities are regulated. These authorities should be subject to data protection obligations as well as the standards of necessity and proportionality enshrined in international human rights law;
International data sharing: Data processing and sharing activities by Pakistani data controllers and foreign entities must be regulated by this Bill and higher standards should be in place to govern such transfers;
Limit broad powers given to the Federal Government to make exemptions: Exemptions to the Act should be limited and we recommend that the Bill be amended to limit broad discretionary powers awarded to the Federal Government, and to ensure that any deviations from the Act be subject to an open, inclusive and transparent legislative process.

We look forward to informing the next steps of the consultative process opened by the Pakistani Ministry of Information Technology and Telecommunications in the hope that the process will be inclusive, transparent and well-defined.

To find out more about our work in this area, please visit our website:

Repeating Image and Text

Location

Pakistan

Asia

Democracy portfolio country

Off

More about our partner

Digital Rights Foundation

Country of Operation