India’s Supreme Court reviews biometric database program, lawmakers in Vietnam consider data localization bill, investors push Facebook and Twitter about content policies

Corporate Accountability News Highlights is a regular series by Ranking Digital Rights highlighting key news related to tech companies, freedom of expression, and privacy issues around the world.

India’s Supreme Court reviews biometric database program

A woman receives an iris scan to enroll in the Aadhaar database (Photo by Biswarup Ganguly, licensed CC BY 3.0)

This week, India’s Supreme Court began its final hearings to consider the legality the government’s controversial biometric database program, reviewing nearly 30 petitions filed against the program over the past several years. Under the program, known as Aadhaar, individuals must enroll in a database—which requires submitting scans of their fingerprints and irises—in order to obtain a variety of government services, including paying taxes or receiving government subsidies. The Department of Telecommunications also requires telecommunications companies to collect Aadhaar numbers for new mobile customers, and has given current mobile phone users until March 31, 2018 to re-verify their SIM cards with their Aadhaar number to continue to receive service.

Privacy advocates have raised concerns over Aadhaar, especially after recent news highlighting privacy and security issues relating to the program. In December 2017, Bharti Airtels license to carry out Aadhaar-based SIM verification was suspended after it was discovered that it had been using this process to open bank accounts for mobile customers without their informed consent. The Tribune, an Indian newspaper, recently revealed that reporters were able to gain access to the database after paying about $8 USD to an anonymous individual who was selling access online. The Tribune reported that after entering an individual’s Aadhaar number they were able to view his or her personal information including name, address, postal code, photo, phone number, and email.

As noted in the 2017 Corporate Accountability Index recommendations, governments should work with the private sector and civil society to ensure that legal and regulatory frameworks make it possible for companies to respect digital rights. This includes respecting the right to anonymous online activity. Governments should refrain from requiring companies to document users’ identities when it is not essential to the provision of service. As UN Special Rapporteur for Freedom of Expression David Kaye has stated, anonymity is essential for individuals to exercise their right to freedom of expression, and deserves strong protections.Continue Reading

Why should investors care about digital rights?

When companies fail to respect users’ privacy and freedom of expression, users clearly pay a price, but they are not alone.

Luis Villa del Campo via Wikimedia Commons (CC-BY 2.0)

Building on the Ranking Digital Rights 2017 Corporate Accountability Index, our inaugural Investor Research Note analyzes how investors may be affected when companies fail disclose adequate commitments and policies affecting users’ rights.

With it we aim to build investor awareness of potential material risks related to digital rights in order to inform investment research and decisions, and to support investor engagement with companies on these issues. We address:

  • How digital rights provide a framework for evaluating risks associated with the management and use of content and personal data by companies.
  • How the financial implications of digital rights issues are growing, reshaping how investors should think about risk profiles of companies that provide services affecting consumer privacy, data security, and management of content affecting users’ freedom of expression.
  • How investors can use RDR’s Corporate Accountability Index as a leading indicator for what are potentially the most material digital rights business and investment risks.

Continue Reading

RDR en Español

We are pleased to announce that the Ranking Digital Rights 2017 Corporate Accountability Index report highlights, as well as the América Móvil and Telefónica “report cards,” are now available in Spanish, thanks to our partners at Global Voices Translation Services.  

In a guest blog post (below), Gisela Pérez de Acha, contributing researcher with Ranking Digital Rights and a policy analyst with digital rights NGO Derechos Digitales based in Chile, reviews key highlights of the Index report and explains the importance of corporate accountability regarding policies affecting users’ freedom of expression and privacy.Continue Reading

RDR launches 2018 Corporate Accountability Index research cycle

Ranking Digital Rights (RDR) is pleased to announce that research for the 2018 Corporate Accountability Index begins this month.

A team of 30 researchers based around the world will contribute to the 2018 Index research. The 2018 Index applies the same methodology to evaluate the same 22 companies ranked in the 2017 Index. This will enable us to produce comparative results and track changes to company performance.

Click here to view or download the full 2018 Index methodology, with indicator guidance and glossary.

Findings of the 2018 Index will be released in April 2018. Companies’ scores and accompanying analysis will be generated through a rigorous process of cross checking, peer review, company feedback, and quality control.

Stay tuned for more updates from the RDR team!

2017 Corporate Accountability Index Launch Event: Can the internet sustain human rights?

People around the world increasingly rely on the internet and digitally networked devices in all aspects of their lives. But do we have a global information ecosystem in which future generations’ rights can be respected?

Unfortunately, the answer is “no,” according to our research. Ranking Digital Rights (RDR) on March 23 launched its 2017 Corporate Accountability Index which ranks 22 of the world’s most powerful telecommunications, internet and mobile companies disclosed commitments and policies affecting user’s freedom of expression and privacy. Findings showed that companies did not disclose enough information about policies affecting users’ rightsand as a result most of the world’s internet users lack the information they need to make informed choices.  

Click image to watch video of the full event. (Photo by Niels ten Oever)

“There is tremendous room for improvement by all companies,” said project director Rebecca MacKinnon, despite positive steps by some companies since organization released its inaugural Index in 2015. Only two companiesGoogle and Microsoftscored more than 60 percent on this year’s Index, with the remaining 20 companies evaluated receiving failing grades.

This year’s Index included an evaluation of the “mobile ecosystems” controlled by Apple, Google and Samsung. Findings showed that Apple’s iOS, Google’s Android, and Samsung’s implementation of Android all offered poor disclosure of policies affecting users’ freedom of expression and privacy. This is a particular concern given that most of the world’s new internet users are coming online with smartphones.  

MacKinnon also highlighted that companies overall struggled to disclose policies affecting users’ freedom of expression. For example, all telecommunications companies evaluated had insufficient disclosure on their policies for responding to requests for network shutdowns. Telefónica and Vodafone tied for the highest score on this indicator, but these companies still fell short. None of the telecommunications companies evaluated provided any information on the number of network shutdown requests with which they complied.

Companies that disclosed data breach-related policies.

While companies tend to focus more on privacy and security than freedom of expression, there are nonetheless serious gaps. On the indicator measuring company disclosure of their policies for responding to data breaches, only three out of all 22 companies evaluated, disclosed any information. This is troubling given recent news of various high-profile data breaches, and this issue is of particular concern for users and investors alike.

MacKinnon was joined for a panel discussion by Melissa Brown, Partner at Daobridge Capital and Arvind Ganesan, Director of Business and Human Rights at Human Rights Watch. Moderating the discussion was Niels ten Oever, Head of Digital at Article 19, and Open Technology Institute Director Kevin Bankston.

Panelists discussed whether rankings like the Index can motivate companies to change their policies make policy change. Does highlighting differences in company performance promote competition and a “race to the top”? Do companies that perform better do so because of their business models, because they have been exposed to public scrutiny for longer, or because of other factors?

As speakers noted, there have already been some improvements since the first Index in 2015. Bankston pointed out that in the 2015 report, not a single company received any credit for disclosure of data about content takedowns due to the company’s terms of service enforcement. In the 2017 Index, three companies received some credit on this indicator, and just this week Twitter released its latest transparency report, for the first time including some data on terms of service takedowns.

“With that domino falling, if the trend goes the way it usually does, this is going to become a common practice in the next five or ten years, and that will be due in no small part to the work of Ranking Digital Rights,” said Bankston.

Many people in the audience were concerned about poor company disclosure of the user information they collect, share, and retain. “If someone built a profile on me based on my use of Google, Facebook, AT&T, and my iPhone ecosystem, what kind of profile could be built about me? I need to have enough information that I have some sense of that so that I can then make informed choices. And right now, people are much too far in the dark on that.” One person asked whether it is harder to get companies to change when opacity about the handling of user information is connected to companies’ business model. Another audience member who works for  a company not covered by the Index responded: “If you don’t have people trusting you, you don’t have a business.”

The impetus for change can come not only from civil society activists and policymakers but also from investors. As Daobridge’s Capital’s Melissa Brown pointed out, investors are not monolithic:  some focus on human rights issues in general but few truly understand digital rights issues. However, Brown believes that the Index shows the extent to which “companies are outsourcing privacy and security risks to users,” without giving users enough information to understand or protect themselves against the risks. Over the long run, privacy and security will become “increasingly material” to investors, Brown said.

Fortunately, the Index provides a roadmap for companies to improve. Of course, the 2017 Index is just the beginning of the conversation. We look forward to continuing this dialogue, starting with RightsCon in Brussels next week!

A webcast of the event is available here.