Navigating the Dataverse: Privacy, Technology ... - The ICHRP

Where foreign companies hold the personal data of locals, for example, or
local employees are subject to workplace monitoring by foreign employers,
local law may not provide local employees with adequate protection with regard
to their employers.
Like so much that is valuable, personal data tends to flow northwards. It is clearly of immense
value to the power centres of the North, public and private. Local capacity to monitor or
control such information flows is also much reduced. Citizens of developing countries are
likely to have little say over the acquisition or use of their data by states and corporations that
have access to the products of overseas data-processing centres. Even where governments
wish to impose controls on foreign firms that are vital to their economic prospects, only the
most wealthy and technically-savvy states may be able to do so. 121
Law
Early internet hype notwithstanding, as Jack Goldsmith and Timothy Wu point out, we do not
live in a borderless world. 122 Indeed, as physical as well as virtual fences and firewalls go
up globally, the world has never been so bounded. National and international laws together
structure the way information, ideas and people circulate, work and conduct their lives.
The interface between national and international law has been much discussed and
need not concern us here. It is nevertheless worth noting that even if one accepts the
(still controversial) proposition that international law does and should protect individuals
directly, the specific concerns that comprise our subject in this Discussion Paper are not
well articulated in international law. The human right to privacy is interpreted narrowly and
unevenly in international fora, a victim of conflicting ideas about what privacy actually
“is” (more on this in Chapter 5). In other respects, international provisions relevant to
the protection of privacy are found principally in international economic law where they
mainly protect private sector activity and provide secrecy from government intrusion.
In fact, protections of this kind are relatively scarce at international level (existing
primarily in trade and investment law), but are nevertheless quite common in national
law. They are sometimes termed “transnational” because, unlike international law, which
emanates in principle from state consent, these norms are rather promoted at national
level in reforms recommended by financial institutions or development agencies around
the world. 123 Their appearance in domestic legal systems tends to respond to global
investment priorities rather than those of local private citizens.
A first concern is that protections of this kind do not necessarily extend to “private
persons” themselves – being designed rather to protect commercial secrets or
intellectual property. In addition, they may have a reverse effect, sealing the personal
data of individuals behind protected corporate walls, possibly inaccessible (or unknown)
to the data-subject him- or herself.
121 The better known examples are France, in the Yahoo! case, China and Saudi Arabia. All three cases
involved blocking information from abroad rather than protecting local information from capture or use
abroad. In neither China nor Saudi Arabia is it self-evident that the state’s interest extends to protecting
the personal data of citizens, and in both cases, western opinion viewed blocking actions as censorship
or repression. In the France case, it is noteworthy that France’s leverage depended on the availability of
Yahoo! assets in France.
122 Jack Goldsmith and Timothy Wu, Who Controls the Internet: Illusions of a Borderless World, Oxford
University Press (2006).
123 See generally Humphreys (2010). On the distinction between “international” and “transnational” see
Chapter 6, below.
42 Navigating the Dataverse: Privacy, Technology, Human Rights