Corporate Accountability News Highlights is a regular series by Ranking Digital Rights highlighting key news related to tech companies, freedom of expression, and privacy issues around the world.
Journalists urged to quit iCloud China
Apple store in Shanghai, China. Photo by myuibe [CC BY 2.0], via Wikimedia Commons
Apple is making the migration to comply with new regulations which require cloud services to be operated by Chinese companies and user data stored locally. Starting from February 28, Guizhou-Cloud Big Data (GCBD), a company owned by the local Guizhou provincial government, will be operating iCloud in mainland China. Although Apple said that it had strong data privacy and security protections in place, and “no backdoors will be created into any of [their] systems,” GCBD will still have access to all user data according to a newly added clause to the iCloud China user agreement. This has raised concerns that the Chinese government will be able to easily spy on users.
Companies should conduct regular, comprehensive human rights risk assessments that evaluate how laws affect freedom of expression and privacy in the jurisdictions in which they operate as well as assessments of freedom of expression and privacy risks when entering new markets or launching new products. Companies should also seek ways to mitigate risks posed by those impacts. The 2017 Corporate Accountability Index found that Apple did not disclose if it conducted these types of assessments. However Apple recently published a new “Privacy Governance” policy stating that it conducts privacy-related impact assessments, although it does not disclose if its due diligence process includes evaluating freedom of expression risks.
Facebook on trial in France for censoring nude portrait
Facebook has landed in court in France after deactivating the account of a teacher who posted a photo of Gustave Courbet’s 1866 painting “L’Origine du monde,” which depicts a woman’s genitals, back in February 2011. The teacher sued Facebook for violating his right to freedom of expression by deactivating his account without notice. He is seeking €20,000 ($25,000) in damages, and the restoration of his account.
In court, Facebook lawyers denied that the account was suspended over the painting. They also argued that the account cannot be restored since the company keeps data from deleted accounts for only 90 days. For five years, Facebook fought to avoid trial at a French court arguing that its terms and conditions, to which all users of its platform must agree, state that any legal disputes must be settled in California. However, in February 2016, a French court of appeal ruled otherwise. Facebook made changes to its rules in 2015 clarifying that depictions of nudity in artwork were acceptable. However, the company still faces accusations of censoring artwork it deems inappropriate.
Companies should be transparent about their process for enforcing their terms and rules by disclosing information such as the types of content or activities they do not allow, and the processes they use to identify infringing content or accounts. Companies should also disclose and regularly publish data about the volume and nature of actions taken to restrict content or accounts that violate their rules. Research from the 2017 Index showed that most companies, including Facebook, do not publish such data. Of the 22 internet, mobile, and telecommunications companies evaluated in the 2017 Index, only three–Google, Microsoft, and Twitter–published any information at all on their terms of service enforcement.
New data-sharing regulations for ride-hailing apps in Jordan
The Jordanian government has adopted new licensing conditions for ride-hailing apps. Under these conditions, apps that provide ride hailing services are required to provide the authorities with any requested user data stored in their databases, including information related to ‘’the driver, the car, the rider and the trip.’’ Currently Uber and Careem, a Middle East based ride-hailing company, operate in Jordan.
Companies should disclose information about their process for responding to government requests for user data including their processes for responding to non-judicial government requests and court orders, and the legal basis under which they comply with requests. In addition, companies should publicly commit to push back on inappropriate or overbroad government requests. Companies should also disclose and regularly publish data about these requests including, listing the number of requests received by country and number of accounts and pieces of content affected, and specifying the legal authorities making the requests.
