Corporate Accountability News Highlights is a regular series by Ranking Digital Rights highlighting key news related to tech companies, freedom of expression, and privacy issues around the world.

Facebook and Google face first GDPR complaints

Facebook and Google are already facing their first complaints for non-compliance with the EU’s sweeping new data protection rules that came into force on May 25.

The General Data Protection Regulation (GDPR), which regulates the processing of personal data of EU residents, gives individuals new rights to control how their data is being processed and used, including by businesses and organizations.

These changes include the rights to move one’s data from one company or service to another and the right to request the data a company or organisation holds on individuals. Data processors are also required to provide individuals with clear information on how their data is being processed including the purposes for processing their data, where that data comes from, for how long it will be stored, and whether it will be transferred outside the EU or shared with third parties.

The GDPR officially came into effect on May 24, 2016, giving companies roughly two years to prepare before the new rules came into force this May. Companies have been rolling out changes. Immediately after the regulations came into force, Austrian privacy activist Alex Schrems filed four complaints against Facebook, Instagram, WhatsApp, and Google’s Android for GDPR violations regarding limited user consent options. Schrems stated that while the GDPR requires “informed and specific consent,” the  services impose a form of “forced consent” because users have to either agree to their privacy policies or lose complete access to these services.

Internet, mobile, and telecommunications companies should be transparent about how they handle user information including which user information they collect and share and for what purposes, how they collect that information and with whom they share it, and for how long they retain it. Companies should also give users options to control how their information is used, including for targeted advertising.  

The 2018 Corporate Accountability Index found that companies do not disclose enough information about how they handle user information and that users remain largely in the dark about what information about them is collected and shared, with whom, and for what purposes.

(more…)

Internet and mobile companies operating in politically restrictive or developing markets disclose hardly any information about policies affecting users’ freedom of expression and privacy, leaving users in these regions particularly vulnerable to unknown human rights risks, according to several new studies using the Ranking Digital Rights Corporate Accountability Index methodology.

Researchers who were involved in these studies gathered at RightsCon in Toronto on May 18 to discuss results of their research on companies in Africa, China, the Middle East, and Russia, and to discuss how RDR’s Index methodology can be used to encourage corporate accountability and transparency in developing economies and challenging political environments.

Session participants were among a growing number of researchers and advocacy groups around the world who are adapting the Index methodology to evaluate local and regional internet and telecommunications companies on their disclosed commitments to users’ freedom of expression and privacy.

In 2018, the digital rights group Internet Without Borders  published a report analysing the terms of service and privacy policies of Orange in Senegal and Safaricom, a Vodafone subsidiary, in Kenya. Beirut-based digital rights group Social Media Exchange (SMEX) produced a study applying the Index methodology to evaluate 66 mobile operators in the Arab region. The Russian internet freedom NGO RosKomSvoboda used a select number of Index indicators to evaluate the transparency of four network mobile operators in Russia and used technical testing to evaluate how companies implement their policies in relation to content blocking. Researchers with the Hong Kong Transparency Report conducted an analysis of how laws in China help or hinder companies from being more transparent regarding policies and practices measured by Index indicators.

This type of research gives advocacy groups an opportunity to start a conversation around digital rights issues and to engage the private sector, particularly in countries and regions where awareness about the impact ICT businesses have on people’s rights is lacking, according to participants. “Our report has opened up a conversation with companies, and even encouraged changes in some of them,” according to Julie Owono, executive director of Internet Without Borders. “For example, some Orange subsidiaries are now offering training for users on their privacy rights,’’ she said.

‘’Transparency isn’t a part of Russian business culture,’’ Sarkis Darbinyan, one of the co-authors of the RosKomSvoboda report, said. Although it has been challenging for them to directly engage with these operators, RosKomSvoboda researchers have been able to ‘’engage somewhat’’ with companies by asking them questions at public events, according to Darbinyan.

Research using the Index methodology can also help digital rights groups and activists focus on areas in which companies can be more transparent about their policies even in legally and politically challenging environments. For example, researchers with the Hong Kong Transparency Report found several areas in which the law does not prevent Chinese internet companies from disclosing information about policies affecting users’ rights, particularly in terms of users’ privacy.

‘’Tencent and Baidu scored quite poorly in the 2018 Index, but even under Chinese law, they could significantly improve [their] digital rights disclosures,’’ Ben Zhou of the Hong Kong Transparency Report said. Tencent and Baidu were among 22 internet, mobile, and telecommunications companies evaluated by RDR’s 2018 Corporate Accountability Index on their public commitments and disclosed policies affecting users’ freedom of expression and privacy.

We encourage digital rights groups and researchers to use and adapt the Index methodology to produce local research evaluating the human rights policies and practices of companies and services in their regions.

 

MacKinnon speaking at the RightsCon session on documenting ICT companies’ impact on civic freedoms

Why does Ranking Digital Rights evaluate companies’ respect for users’ rights? Because when companies are insufficiently transparent and accountable about how their policies affect users’ freedom of expression and privacy, real people can be harmed. We believe it is important to document these people’s stories, so that companiesas well as governments that regulate themcan better understand how their policies and practices affect users around the world.

Documenting the impact of human rights violations caused directly or indirectly by ICT companies is key to raise awareness and to hold to account those responsible, whether they are governments, companies, or non-state actors. For this reason, at RightsCon in Toronto last week we held a session called “Documenting ICT companies’ impact on civic freedoms and human rights defenders.’’ Ranking Digital Rights director Rebecca MacKinnon moderated a conversation with people who lead projects that work to document what happens to people around the world when company policies and practices fail to respect their rights.

MacKinnon pointed out that while RDR evaluates and compares company policies by publishing an annual Corporate Accountability Index, we seek to strengthen the connection between our data and analysis about company policies and disclosures, and the stories of people affected by these companies’ policies and practices.

Internet users around the world face a number of threats and restrictions that put their rights to privacy and freedom of expression online at risk including network shutdowns, content takedowns by social media platforms, judicial threats and arrests, and mass surveillance programs.

“It is important to document those cases to provide evidence to businesses and decision makers about the scale of those attacks,’’ Ana Zbona from the Business and Human Rights Resource Centre (BHRRC) said. ”Documentation can lead to results in terms of raising awareness, and can also have an impact both on national level and with individual cases,’’ she added. The BHRRC has a database of attacks which documents attacks against defenders in the field of business and human rights.

Peter Micek from Access Now said that through his organization’s Shutdown Stories project they collect and publish stories of users and communities affected by network shutdowns. These stories, he said, can be used in advocacy campaigns as well as formal efforts to obtain remedy.

Documenting these violations, however, can be challenging due to lack of transparency from both governments and businesses. According to Jessica Anderson from onlinecensorship.org, a project that documents cases of content takedowns by social media platforms, collecting evidence about these harms from a wide range of communities and users is not easy. She noted that while data crowdsourced from users who had their content removed or accounts suspended ‘’give us a lot of insight into user perspective on content moderation, they are very hard to verify.” In addition, reports received through the onlinecensorship.org portal lack sufficient diversity since they are very US focused even though the website is also available in both Arabic and Spanish.

Another challenge is ensuring that communities and users providing evidence and stories are not put at risk. ‘’One of the big challenges is how do we talk about these things in a meaningful way and do something positive with it instead of putting them at risk,’’ Ellery Biddle director of Global Voices Advocacy said. Her organization is building a platform called “Threatened Voices,” that will enable the collection and reporting of detailed cases. “The idea of the project is to show patterns,” she said. For example: “What does it mean that many people are being arrested for their Facebook posts? What does Facebook need to do about it?”

Ranking Digital Rights and Global Voices are currently working together to produce a toolkit that will offer guidance and resources to digital rights advocates who want to document and report on cases of online harms involving internet and telecommunications companies. By making it easier for digital rights communities to document violations of technology users’ rights around the world, we do not only aim to hold to account those responsible. We also hope that if more stories and cases are collected systematically, companies and policymakers will better understand the human cost of digital rights violations and how corporate as well as government policies need to change. In addition, by compiling more information about people whose freedom of expression and privacy and other rights are violated when using ICTs, we believe that civil society, governments, and companies will be better equipped to construct better systems of grievance and remedy for victims of these violations.

 

 

This week, members of the Ranking Digital Rights team will be in Toronto, Canada, for the sixth annual RightsCon conference, organized by Access Now. We are organizing and participating in several RightsCon sessions, and are looking forward to discussions with human rights and technology advocates and experts from around the world.

On Wednesday May 16 at 10:30am, Rebecca MacKinnon will be speaking in the session “A Decade of Progress: Where Do We Go Next?” In this session, speakers will reflect on progress that has been made in the business and human rights space over the last decade, identify strategies and tactics that have best fueled this progress, and reflect on how to approach human rights challenges and opportunities in the ICT sector in the years to come.

On Wednesday May 16 at 4pm, join us for “Documenting ICT companies’ impact on civic freedoms & human rights defenders,” a workshop we are co-hosting with the Business and Human Rights Resource Centre in which we will brainstorm how the digital rights community can a) collaborate to better document the impact of ICT company policies and practices on freedom of expression and privacy, and b) work with companies and governments to improve grievance and remedy mechanisms for individuals and organizations whose rights have been violated. Rebecca MacKinnon will moderate the session, with speakers Ana Zbona (Business and Human Rights Resource Center), Ellery Biddle (Global Voices), Jessica Anderson (Onlinecensorship.org), and Peter Micek (Access Now).

On Thursday May 17 at 12pm, Laura Reed will be speaking in the session “This Panel May Contain Sensitive Content: Automated Filtering and the Future of Free Expression Online.” In this session, participants will discuss risks of the move to automation in communications governance, the underlying values we seek to preserve, and how we can better communicate with both the public and policymakers about these developments.

On Friday May 18 at 12pm, join us for “Tactics for advancing digital rights in developing economies and challenging political contexts: an RDR perspective.” In this session, researchers and advocates will discuss how RDR’s methodology can be adapted and used for digital rights advocacy in contexts in which the private sector may be more responsive to stakeholder engagement and public pressure than the government. Speakers will share their experiences from conducting this research, covering countries including China, Russia, and regions of Sub-Saharan Africa and the Middle East. Laura Reed will moderate the session, with speakers Afef Abrougui (RDR), Sergei Hovyadinov (RDR), Benjamin Zhou (Hong Kong Transparency Report), and Julie Owono (Internet Sans Frontières).

The full conference program is available here. Members of our team will be at RightsCon for the entire conference, so feel free to get in touch if you’d like to connect: info@rankingdigitalrights.org.

Corporate Accountability News Highlights is a regular series by Ranking Digital Rights highlighting key news related to tech companies, freedom of expression, and privacy issues around the world.

Egypt approves controversial ride-hailing bill  

Cairo traffic. Photo by Gigi Ibrahim [CC BY 2.0 via Flickr]

The Egyptian parliament has approved a bill that would regulate ride-hailing apps operating in the country. The new law requires ride-hailing companies to store data locally and to retain user data for 180 days and share it with authorities “on request.” An earlier version of the bill had provisions giving authorities real time access to passenger and trip information, but those provisions were amended due to privacy concerns.

Uber and the Dubai-based ride-hailing app Careem already operate in Egypt. Egypt is Uber’s bigger market in the Middle East with 4 million riders and 157,000 drivers in 2017. Careem operates across 12 Middle Eastern countries countries and Pakistan. The company recently announced a breach that affected 14.5 million riders and drivers.

The two companies will have six months to comply with the new regulations. Despite the Egyptian government’s history of abusing its surveillance powers, both Uber and Careem welcomed the bill’s adoption. “This is a major step forward for the ride-sharing industry as Egypt becomes one of the first countries in the Middle East to pass progressive regulations,” Uber said.

Egypt is the second country in the region to pass legislation regulating such services. Earlier, this year Jordan adopted licensing conditions requiring ride-hailing services to provide the authorities with any requested user data stored in their databases, including information related to ‘’the driver, the car, the rider and the trip.’’

Companies should conduct regular, comprehensive human rights risk assessments that evaluate how laws affect freedom of expression and privacy in the jurisdictions in which they operate as well as assessments of freedom of expression and privacy risks when entering new markets or launching new products. Companies should also seek ways to mitigate risks posed by those impacts.

The 2018 Corporate Accountability Index found that internet, mobile and telecommunication companies do not disclose sufficient information about whether not they conduct such assessment, with eight companies failing to reveal any information at all.

(more…)