Corporate Accountability News Highlights is a regular series by Ranking Digital Rights highlighting key news related to tech companies, freedom of expression, and privacy issues around the world.
India’s Supreme Court reviews biometric database program
A woman receives an iris scan to enroll in the Aadhaar database (Photo by Biswarup Ganguly, licensed CC BY 3.0)
This week, India’s Supreme Court began its final hearings to consider the legality the government’s controversial biometric database program, reviewing nearly 30 petitions filed against the program over the past several years. Under the program, known as Aadhaar, individuals must enroll in a database—which requires submitting scans of their fingerprints and irises—in order to obtain a variety of government services, including paying taxes or receiving government subsidies. The Department of Telecommunications also requires telecommunications companies to collect Aadhaar numbers for new mobile customers, and has given current mobile phone users until March 31, 2018 to re-verify their SIM cards with their Aadhaar number to continue to receive service.
Privacy advocates have raised concerns over Aadhaar, especially after recent news highlighting privacy and security issues relating to the program. In December 2017, Bharti Airtel’s license to carry out Aadhaar-based SIM verification was suspended after it was discovered that it had been using this process to open bank accounts for mobile customers without their informed consent. The Tribune, an Indian newspaper, recently revealed that reporters were able to gain access to the database after paying about $8 USD to an anonymous individual who was selling access online. The Tribune reported that after entering an individual’s Aadhaar number they were able to view his or her personal information including name, address, postal code, photo, phone number, and email.
As noted in the 2017 Corporate Accountability Index recommendations, governments should work with the private sector and civil society to ensure that legal and regulatory frameworks make it possible for companies to respect digital rights. This includes respecting the right to anonymous online activity. Governments should refrain from requiring companies to document users’ identities when it is not essential to the provision of service. As UN Special Rapporteur for Freedom of Expression David Kaye has stated, anonymity is essential for individuals to exercise their right to freedom of expression, and deserves strong protections.
Lawmakers in Vietnam consider data localization bill
Lawmakers in Vietnam are considering a new data localization bill that would force international companies to store all data on Vietnamese users within the country. The bill would also require companies with more than 10,000 users in Vietnam to open a local office. An earlier version of the bill required internet companies to install servers within Vietnam; this provision has been stricken from the current version, though the data localization requirement remains. “Installing domestic servers or not is not important, the important point is we must be able to control all information going in and out,” said Dinh The Cuong, head of the Ministry of Defense’s Department of Information Technology, according to VnExpress. The bill is scheduled to be voted on in May.
Privacy advocates have cautioned that mandatory data localization laws can allow governments to increase their access and control over individuals’ online activities, raising the potential for human rights abuses. This is particularly the case for Vietnam, which was rated “Not Free” by Freedom House’s most recent Freedom on the Net report, which highlighted a rise in arrests and prosecutions of bloggers in 2017. Human rights advocates have raised similar concerns over Russia’s data localization law, which came into effect in 2015, and with which foreign companies are being pressured to comply.
Internet, mobile, and telecommunications companies have a responsibility to respect their users’ human rights. This includes not only assessing the freedom of expression and privacy risks associated with a company’s own products and services, but also how laws may affect freedom of expression and privacy in jurisdictions where they operate. Companies should incorporate these assessments into their decision-making processes, and should also commit to push back against inappropriate or overbroad government requests for user data.
Investors push Facebook and Twitter about content policies
Two investor groups have recently filed shareholder proposals asking Facebook and Twitter to take more responsibility for managing content on their platforms. The groups, New York State Common Retirement Fund and Arjuna Capital, said the platforms’ content policies “seem reactive, not proactive” and that the companies have not adequately responded to concerns about these policies.
Earlier this month, Apple shareholders issued a public letter to the company’s board of directors with concerns about the impact the company’s devices may have on children and teen users. While Apple is not legally required to respond to public letters, Facebook and Twitter are required to respond to proposals issued by shareholders.
Investors have a crucial role to play in holding companies accountable. As noted in our 2017 investor research note, it is important for investors to be aware of potential material risks related to digital rights issues. Lack of transparency about what content or user activity is or is not allowed on digital platforms as a factor that can corrode user trust in internet platforms. As highlighted in the research note, until recently, most of the companies evaluated in the Index did little to acknowledge many of the strategic challenges they face when shaping and enforcing policies around controversial content, including misinformation, hate speech, and extremist content. As companies consider and make changes to better address these complex issues, it is important to ensure that their policies and practices are respecting users’ rights.
