Individuals must be able to realise right to remedy for privacy violations in data protection: UN expert

In the digital age, States must not only respect and refrain from violating the right to privacy and data protection, but their obligations include positive measures to promote the effective enjoyment of these rights, a UN expert said today.

In a report to the Human Rights Council, the UN Special Rapporteur on the right to privacy, Ana Brian Nougrères conducted a comparative analysis of data protection and privacy laws across a geographically diverse selection of States: Australia, Ecuador, Singapore, South Africa and Spain.

“These five states were studied as their respective legislation expressly recognise the right of individuals to be the owners of, and have control over, their personal information. The states analysed regulate, to a greater or lesser extent certain aspects of the remedy of reparation, which is available to the individual who has suffered damages as a result of a breach of data protection and privacy legislation,” Brian Nougrères said.

“To safeguard their dignity, individuals must have sufficient means and mechanisms at their disposal to be able to assert their right to privacy.”

“I examined whether individuals can effectively exercise control over the use of their data, understand the legal mechanisms available to them for the enforcement of their rights, their restitution and, where appropriate, the reparation of the damage generated by the improper use of the information that impacts them,” she said.

“The mere recognition of a legal standard on the right to personal data protection does not guarantee the effectiveness or enjoyment of that right without the existence of an accessible and effective protection system.”

Brian Nougrères said States must establish a system to safeguard the right to personal data protection so that data subjects are aware of the processing to which their personal data are subjected, can exercise proper control over their data and, in the event of a violation, can opt for a remedy with a view to reparation or restitution or compensation for the damage caused.

The Special Rapporteur noted that in some States laws allow individuals options to turn to the administrative supervisory authority, use alternative means of dispute resolution, or challenge the decision before the courts.

“I welcome the fact that some States are advancing access to remedies by legislating to recognise new rights, including those linked to automated and digitalised data processing or exercised in the context of the Internet or social media,” the Special Rapporteur said.

The expert made three key recommendations to States. Firstly, she urged States to Establish, update and adopt legal frameworks that provide accessible and appropriate remedies for the effective protection for violations of personal data protection. She also called on States to identify and consider adopting aspects of other countries’ data protection and privacy legislation that may offer stronger guarantees for the effective realisation of privacy rights in the digital age.

“States must also promote and foster human rights information and education in personal data protection and privacy, so that individuals understand how to can exercise their rights and, as necessary, avail themselves of remedies to ensure their effective enjoyment,” the Special Rapporteur said.

The expert also presented findings from her country visit to Lithuania (2022) to the Human Rights Council.