“The gathering and holding of personal information on computers, data banks, and other devices, whether by public authorities or private individuals or bodies, must be regulated by law.” - UN Human Rights Committee, General Comment No. 16, 1988 Underpinning the obligations of those who process