Analysis: who should become the first UN rapporteur on privacy?

 Human Rights CounciBy Simon Davies

Back in March, the UN Human Rights Council (HRC) adopted a resolution to appoint a Special Rapporteur on Privacy. This was a landmark decision – and one that is well overdue.

The role will be pivotal. A Special Rapporteur has the potential to create clarity and focus on a massively complex issue that is evolving at breathtaking speed. There’s a vast opportunity for that role to create global leadership for awareness and reform.

Thirty people have thrown their hats into the ring as candidates for this position. They represent 23 countries, eleven of which are European. India is strongly represented with three candidates, Pakistan with two and the US with two. Perhaps surprisingly, only three South American nations are on the list, compared to a slightly stronger showing from Africa and the Middle East (with four candidates). Even more surprising, no-one applied from Britain, France, Australia, Mexico, Russia or South East Asia.

EPIC's Marc Rotenberg: one of a tiny handful of candidates with credibility in law, technology and advocacy

EPIC’s Marc Rotenberg: one of a tiny handful of candidates with credibility in law, technology and advocacy

Unfortunately, many candidates have no actual experience of privacy and appear to have merely cut and pasted their CV into the application form, perhaps in the hope that geopolitical dynamics will fluke them into the role. Others have extremely strong credibility in the arena (one or two of whom have laboured in the field for a quarter of a century).

In an attempt to learn more about the options open to the HRC, I’ve scrutinised the application documents for all thirty candidates. On the basis of this reading, I believe the shortlist for this position deserves to be tiny – and that the HRC needs to make a, perhaps, controversial choice.

Saying there are “thirty” candidates isn’t strictly true. According to the application forms, seven of the candidates are (in my view) so utterly devoid of any experience or credentials in this field that they should be knocked out even before the first round. Their involvement in privacy, in general terms, extends to bumping into privacy advocates on a mailing list or speaking at a couple of conferences on the topic.

Such weak and opportunistic candidates are par for the course, but in this case the HRC should be quite ruthless about its selection criteria. This appointment is an important matter. The status of privacy rights is reflected in the fact that the HRC resolution was carried with no votes in opposition (there were, however, twelve abstentions, with a small number of countries such as Saudi Arabia speaking out against the resolution).

In many respects, the HRC voting outcome is not surprising. What is surprising, however, is the staggeringly small number of applicants for the role. While it’s not unusual for the candidate list for UN Special Rapporteurs to contain less than eight or ten people, the huge popularity and pervasiveness of the privacy issue should have attracted a far larger number of applicants. 

Assuming that serving regulators, government lions, the theory purists and those with no qualifications are knocked out of the running, the shortlist plummets to around six names. Remove the technology illiterates and you’re down to three.

To some extent, civil society has failed to engage this opportunity. Only nine of the thirty applicants are generally known to the privacy community – and only four of those are privacy activists, even in the broadest sense of the term. The author of this article knows only fourteen of the applicants, either personally or by name recognition. The remaining sixteen are (more or less) off the international advocacy radar screen.

That’s not to say that this role should be defined as a job for activist campaigners – certainly not. But in the view of many observers, the position of rapporteur needs to be – in itself – an advocacy role. Obviously the task requires a deep understanding of global dynamics, research, politics and technology – but in essence, the elements that define privacy reform are motivational and proactive.

A group of leading civil society organisations – Privacy International, the ACLU, Amnesty International, the ICJ, Access, APC, EFF and Article 19 – have helpfully published their own agreed criteria for the selection process. This rigorous checklist reflects the immense challenge facing the first privacy rapporteur and sets out conditions that ensure integrity and competence. The HRC should take note of this contribution. If the it imagines that a newbie can crack the likes of the UK security establishment and Google, it needs to get real.

Such a checklist is critically important. For example, in a field driven by technological imperatives, only five of the applicants appear to have an (even slightly) deep knowledge of technology – something of a handicap, in view of the role. This job is, after all, described as the rapporteur for privacy “in the digital age”. These five applicants have a collective knowledge of data mining, security, circumvention and Privacy by Design. Only two have a more detailed knowledge of the full spectrum of technologies.

Of equal significance, over half the applicants have staked their claim purely on academic credentials. One key question facing the HRC is whether a track record of theory and post-analysis is an adequate basis to lead the international community on the heady pace of practical real-time privacy issues, particularly in the absence of any knowledge of technology. The vast majority of academic applicants are legal experts with no technology interface and almost no civil society connection.

This leads onto another key aspect of the job. Special Rapporteurs have an investigative function. In an environment famed for secrecy and obfuscation, the ability to conduct deep-drilling is critically important.

There’s a small handful of applicants – former prosecutors and senior government advisors in prosecution cases – who could, in theory, perform that investigatory function. However it’s doubtful whether such candidates would easily attract the trust of the broader stakeholder communities – certainly in civil society. It’s even more doubtful whether those people have the personal capacity to embrace the narrative and courage needed to take privacy forward in the way that is required. I could be wrong of course, but the selection board should be sceptical.

Assuming that serving regulators, government lions, the theory purists and those with no qualifications are knocked out of the running, the shortlist plummets to around six names. Remove the technology illiterates and you’re down to three.

In my view, the HRC should seriously consider eliminating the academic legal purists who have no technology experience, no investigative history and little networking connection with civil society (that’s around half of them).

The HRC has a penchant for appointing academics to the role of Special Rapporteur, but in the past these candidates often had a strong track record as advocates or investigative researchers. In the case of the privacy rapporteur, what’s needed is a Ben Emmerson (human rights and counter terrorism rapporteur) or a Juan Mendez (torture rapporteur). In other words, someone with history and courage.

Perhaps the time has come for civil society to go through the list and aggressively support the few competent candidates. You can bet that governments will be lobbying for their preferred names.