Digital Rights and the Outer Limits of International Human Rights Law

Abstract

This article explores the extent to which key normative and institutional responses to the challenges raised by the digital age are compatible with, or interact with, changes in key features of the existing international human rights law (IHRL) framework. Furthermore, the article claims that the IHRL framework is already changing, partly due to its interaction with digital human rights. This moving normative landscape creates new opportunities for promoting human rights in the digital age, but might also raise new concerns about the political acceptability of IHRL. Following an introduction, Section B of the article will describe the development of digital human rights, using a “three generations” typology. Section C will explain how new developments in the field of digital human rights coincide with broader developments in IHRL, including: the extra-territorial application of human rights, obligations on governments to actively regulate private businesses and the erosion of normative boundaries separating specific human rights treaties from other parts of IHRL and international law. These two segments are followed by concluding remarks.

A. Introduction

While human rights theory often presents human rights as pre-political, imbued with natural law features—including norms derived from natural rights philosophy, religious beliefs, pure reason, or putative human capabilities—which transcend time and place.¹ International human rights law (IHRL) has always involved more concrete and contingent dimensions, anchored in a specific time and place, and in a particular political, economic, technological and cultural context.² This is because the evolution of international law depends on distinct political “acts of recognition” carried out through the adoption of legal specific instruments and through actual state practice, and shaped, in turn, as much by practical considerations about the actual needs and expectations of political constituencies as by high theory about what the contents of human rights law should be. As a result, it is not surprising that Vasak was able to situate his “three generations of IHRL” typology in specific historical epochs,³ corresponding to dramatic political, economic, technological and cultural developments: Revolutions against absolute monarchs or foreign kings informed by ideas of the age of enlightenment; the rise of the welfare state in the aftermath of the industrial revolution; and national emancipation in the age of decolonization influenced by ideas of international solidarity and national self-determination. In the same vein, the Universal Declaration of 1948, which largely serves as a normative road map for the international human rights movement, explicitly addressed some of the specific societal and technological challenges of the time, such as ensuring access to media across frontiers, protecting trade unions, and promoting technical education.⁴ The same can be said for the 1966 Covenants, which addressed basic features of modern social-democratic states, including the need to establish a system for social insurance and to ensure fair and free periodic elections.⁵

In all cases involving the articulation and adoption of international declarations and treaties, a process of social recognition had occurred. In the course of those processes, human rights were transformed from abstract moral ideas or claims into a particular set of legal rights and obligations, or, in the case of soft law instruments, into concrete social expectations and policy recommendations. Such acts of transformation are often responsive to the changing needs and expectations of specific constituencies, to the new risks and challenges individuals and societies confront due to changing economic, technological, and cultural conditions. They are also responsive to actual historical experiences of abuse of power and injustice that support the introduction of new rights that are typically designed to empower individuals and groups of individuals at the expense of government institutions.

Arguably, the contemporary “digital revolution” and its related offshoots represent yet another technological development with major economic, political, and cultural ramifications.⁶ Like others before it, this revolution also invites a process of normative transformation involving the translation of abstract ideas about “digital rights” or “principles for the digital age” into concrete legally-recognized human rights norms through a process of law-interpretation and law-making—i.e., through the articulation of new legally binding or soft law instruments. The UN Human Rights Council and General Assembly have approached the challenge of adapting IHRL to the digital age by adopting a slew of non-binding resolutions that advocate the extension of offline human rights to activities and interactions online.⁷ The EU Commission has also issued a Declaration on Digital Rights and Principles for the Digital Age in which it took the necessary steps to ensure respect for the rights of individuals both offline and online.⁸ This approach avoids the perception of cyberspace as an IHRL-free “black hole,” and continues a long-standing tradition of adjusting existing human rights to new and changing societal conditions.⁹

To be sure, the process of adaptation of old IHRL norms to new situations sometimes requires introducing significant changes in the scope and contents of pre-existing IHRL norms and in the manner of their application to previously unforeseen circumstances. For example, there is little doubt that the underlying rationales supporting freedom of expression apply both offline and online,¹⁰ and that protection of the internationally recognized right to receive and impart information, “through any media,” should cover the dissemination of contents on social media and other digital platforms.¹¹ Still, the different societal and technological contexts for the exercise of freedom of expression in a digital environment may invite a stronger regulatory response, especially with regard to offensive speech. That may be necessary due to the greater risks attendant to online hate speech (caused by differences in the speed, scope, and scale of dissemination of harmful online contents),¹² and the apparent “failure” of the online “marketplace of ideas” to effectively address the problem of disinformation (partly because of the distorting effects of algorithmic filter bubbles and echo-chambers that create incentives to disseminate controversial content).¹³

At times, the adaptation of the scope and content of offline rights to an online environment might require the development of new theoretical justifications for the right in question. For example, theories pertaining to the right to online privacy reveal a transition from protecting individuals against unjustified intrusion of their private and intimate spaces to protecting and managing personal information in both private and public settings.¹⁴ Theories about privacy must increasingly consider how to shield individuals against undue manipulation of their wishes, thoughts, and opinions.¹⁵

Yet, in some cases, the normative gap between offline human rights and the needs and interests of online users reaches a troubling extent, suggesting that adaptation of an existing right is no longer feasible or would lead to “hopelessly inadequate” results.¹⁶ In those circumstances, the development of new human rights—such as the right not to be subject to algorithmic decisions¹⁷ or the right to be forgotten¹⁸—might be warranted.

Navigating between old and new norms involves difficult legal policy dilemmas. Creating new norms of IHRL does not necessarily require the introduction of a new IHRL framework, but it underscores the shortcomings of the existing framework. Yet, acknowledging the unsuitability of existing offline rights without there being a readily available new set of human rights to afford protection to online users creates the risk that individuals would be left neither here nor there—i.e., facing a protection gap. At the same time, sticking with the existing IHRL norms, even as they are increasingly viewed as inappropriate, also results in under-protection of online needs and interests. Worse still, it sends to states, technology companies, and other stakeholders a dangerously reassuring message that they may continue to proceed in a “business as usual” mode of operation.

Yet, there are certain aspects of digital human rights that invite a reconsideration of some key features of IHRL: The predominance of the territorial model for the application of human rights obligations; the focus on responsibility of governments for human rights violations, as opposed to transnational companies and other non-state actors; and the propensity of IHRL bodies to apply IHRL instruments in isolation from other legal instruments.¹⁹ This article explores the extent to which key normative and institutional responses to the challenges raised by the digital age are compatible with, or interact with, changes in the said aforementioned key features of the existing IHRL framework. In fact, this article claims that the IHRL framework is already changing in this regard, partly due to its interaction with digital human rights. These already-unfolding changes may create new opportunities for promoting human rights in the digital age, and could render the policy choice between change and stability of -IHRL- irrelevant. At the same time, the moving normative landscape might raise new concerns about the political acceptability of -IHRL- to states.

Following this introduction, Section B will describe the development of digital human rights, using the “three generations” typology that I have developed elsewhere (together with Daphna Dror-Shpoliansky).²⁰ Section C will explain how new developments in the field of digital human rights coincide with broader developments in IHRL, including the extra-territorial application of human rights, obligations on governments to actively regulate private businesses, and the erosion of normative boundaries separating specific human rights treaties from other parts of IHRL and international law. These segments are followed by concluding remarks.

B. The Three Generations of Digital Human Rights

I have suggested elsewhere—in an article co-written with Dafna Dror Shpoliansky—that IHRL bodies and stakeholders tend to respond to the challenges to the rights and needs of online users brought about by new digital technology via three principal sets of responses, which can be described as representing three “generations” of digital human rights.²¹ The first generation involves a radical reinterpretation of existing human rights in order to allow them to meet the new conditions of the digital age.²² The second generation involves the development of new digital human rights, corresponding to the new needs and interests of online users.²³ These second generation rights have no close parallels in the offline world. The third generation involves the recognition of new rights-holders and new duty-holders.²⁴

The first generation of digital rights involves a dynamic reinterpretation of some of the basic elements comprising the definition of relevant offline rights, a new approach towards their manner of application, and, at times, a new theory justifying the existence of the right in question. This latter extension implies that first generation rights may, in some respects, be the continuation in name only of the original offline right. Online freedom of expression, mentioned above, is one example of a first generation digital right. The scope of the right has been expanded by international bodies to cover online expression,²⁵ and it has been argued that this digitally-reconfigured right to freedom of expression now encompasses a derivative right to access the Internet.²⁶ At the same time, the application of limitations to freedom of expression has been advocated by human rights office holders more forcefully than before, given the unique manner in which offensive content is disseminated online and the distorting impact on public discourse caused by online disinformation.²⁷ Due to the heightened risk associated with offensive online speech, digital platforms have been encouraged by states and international bodies to develop and enforce effective content moderation rules.²⁸ The shift from the traditional hands-off position of IHRL bodies, which were generally skeptical towards speech regulation by governments,²⁹ to a more pro-regulatory stance, also reflects a change in the theoretical assumptions underlying freedom of expression and a fundamental shift in social conditions. In the offline world, the dominant condition was that of information scarcity, which suggested a need to release more information into a more-or-less unstructured market of ideas and information. But in the online world the paradigm appears to involve an excess of information in which socially harmful content might crowd out socially useful information. The result of this has been a claim in favor of structuring proactively an effective market of ideas and information. This would involve regulation that ensures that information disseminated online will be conducive to a well-informed and civilized public discourse.³⁰

Another example of a first-generation digital human right is the right to online privacy. Here, too, the content of the right has undergone many changes, as did its manner of application and underlying theory. For example, the center of gravity of legal practices aimed at upholding the right to privacy has shifted from protecting individuals against intrusions of their private intimate spaces to protection of their personal data.³¹ Now, with the rise of big data, the focus has shifted even farther from protecting information qualified as “private” in nature towards protection of all identifiable information, including publicly available information, from which private information can be gleaned.³² These developments in law-interpretation and law-application are supported, as already noted, by a change in the theory underpinning privacy. The theoretical shift involves a move away from a dominant conception of privacy as a right to be left alone,³³ to notions of privacy involving the right to exercise control over personal data and its derivative uses,³⁴ including controlling inter-personal information flows³⁵ and preventing attempts to manipulate individuals’ thinking process.³⁶

Like first generation rights, second generation rights can also be implemented within the existing IHRL framework. The difference between the two generations is that the former involves, at least nominally, the invocation of existing offline rights, whereas the latter entails the introduction of new digital rights. Among rights proposed or actually developed as part of this development, one may mention the following: An independent new right to access the Internet,³⁷ which stems from an understanding of access to the Internet as a prerequisite for the enjoyment of a broad range of digital rights and interests (far exceeding the traditional right to seek, receive and impart information); a new right to informational self-determination,³⁸ which acknowledges that the manner of representation of personal information online constitutes an extension of the human person and should be effectively controlled by the relevant data subject; and the new right not to be subject to automated decisions in important matters, which protects the right and interest of individuals to be free from arbitrary and non-accountable exercise of de facto power through algorithms and to exist in a non-datafied form.³⁹

These first and second generation human rights do not require a formal change in the IHRL framework. Still, they stand in considerable tension with that framework. This is because the enjoyment of digital rights is heavily dependent on the conduct of private companies—especially Internet service providers and online Internet platforms.⁴⁰ The business model and technology these companies utilize might have a more significant impact on the ability to enjoy digital human rights than governmental regulation. The effects of this private conduct can extend to determining access to Internet sites; to the collection, retention, and retrieval of personal information; to targeting the dissemination of information to particular individuals; to the facilitation of data portability; and to decisions regarding content moderation policies, differential privacy, and algorithmic transparency. Yet, despite the new privatized reality governing the enjoyment of rights, IHRL bodies continue to focus on reviewing the legality of government conduct rather than on the business operations of private companies.⁴¹ Furthermore, because technology companies tend to operate on a global level, using international supply-chains and infrastructure sites, their dependence on any particular host or home state might be minimal. Naturally, this limits states’ ability to, and interest in, controlling these companies’ activities. As a result, the model of indirect regulation of businesses in order to advance human rights concerns, a model that is built around addressing the regulatory and adjudicatory powers of the relevant states, has limited traction in the real world of digital technology.⁴²

The third generation of digital rights involves, unlike the first and second generations, a move away from the traditional IHRL paradigm. It entails the recognition of digital rights held by online persons that are separate from the rights enjoyed by the physical persons that created them. Such a move in the direction of creating new legal personalities is supported by policy rationales comparable to those that led in private law to the granting of legal rights to corporations and other legal entities.⁴³ The third generation of rights also involves the direct imposition of obligations on Internet service providers, online platforms, and other technology companies.⁴⁴ Such new rights and obligations go beyond the traditional state-centric configuration of -IHRL- that revolves only around rights for natural persons and concomitant obligations for states. Furthermore, because they are not necessarily linked to the state, the contents of third generation rights can focus on issues that uniquely appertain to relations between online users—digital persons—and online platforms or service providers, such as digital identity or legacy,⁴⁵ and net neutrality.⁴⁶

The upshot is that the development of digital IHRL marks a significant shift from traditional IHRL, both in terms of introducing new human rights and in challenging fundamental features of the current system of IHRL protections. The success or failure of these paradigmatic changes is tied up with other, broader, changes to IHRL, some of which have influenced and been influenced by the emergence of digital human rights. These broad changes and their implications for the development of digital human rights are discussed in Section C below.

C. Digital Rights and Changes in IHRL

The body of IHRL norms which developed out of the 1948 Universal Declaration of Human Rights has traditionally concentrated on the interplay between governments and the individuals and groups subject to their authority, aiming to curb abuse of power by the former in ways that interfere with the enjoyment of basic rights by the latter. Because states and their governments are largely creatures defined by territorial sovereignty and territorial jurisdiction, the traditional approach to IHRL also had a strong territorial focus. The interplay between a government and the governed typically occured inside the relevant state’s borders. The traditional approach to IHRL also had a strong focus on regulating governmental conduct—implicitly, and at times, explicitly, considering governments as a potential source of threat to human rights.⁴⁷ Given its narrow geographical and substantive focus, it is not surprising that human rights law has tended to take a backseat when confronted with other, more specific bodies of international law, such as international humanitarian law (IHL), which are not limited in the same geographical and substantive way. That allows them, for example, to address the extra-territorial activity of non-state actors.⁴⁸ Still, as shown below, most of these traditional features of IHRL are currently in the process of becoming eroded or transformed. Such developments facilitate the development of digital human rights and are, at the same time, facilitated by them, at least to some extent.

I. Digital Human Rights and Extraterritoriality

The territorial focus of IHRL is eroding. The European Court of Human Rights (ECtHR), together with the European Commission of Human Rights, have taken the lead in developing the notion of extra-territorial jurisdiction in certain cases involving effective control over areas—such as in cases involving belligerent occupation⁴⁹— and the exercise of state agent authority over individuals—such as in the cases of foreign detention facilities or provision of consular services.⁵⁰ Still, the Court has maintained the position that extra-territorial application of the European Convention on Human Rights (-ECHR-) remains exceptional in nature.⁵¹ Furthermore, it has rejected the proposition that the mere capacity to interfere with the enjoyment of a right entails jurisdiction over the right holder.⁵²

Other human rights bodies have embraced a more functional approach towards the extra-territorial application of -IHRL-. These include the Inter-American Court of Human Rights (I/A -CHR-), which in its 2017 Advisory Opinion on Human Rights and the Environment focused on the degree of control exercised by states over activities taking place inside their territories but which nonetheless cause trans-boundary environmental harm.⁵³ Similarly, the Human Rights Committee (H.R.C.), in its General Comment 36 of 2018, developed a jurisdictional standard covering conduct with extraterritorial effects that has “direct and reasonably foreseeable impact” on the enjoyment of the right to life.⁵⁴ Finally, in 2021, the Committee on the Rights of the Child embraced “reasonable foreseeability” of impact as the test for exercising extra-territorial jurisdiction in a climate change case.⁵⁵

At least in the case of the H.R.C., the development of a functional jurisdictional standard appears related to the emergence of digital human rights, and stemmed from engagement by the Committee with the right to privacy in connection with the extra-territorial application of online surveillance practices. In its 2014 review of the fourth periodic report of the United States, the Committee raised concerns about media reports describing surveillance activities undertaken by -US- security agencies both inside and outside U.S. territory. These episodes included the collection of bulk data and metadata, and the alleged wiretapping of European leaders.⁵⁶ The Committee recommended that the U.S. take the necessary measures to ensure that “any interference with the right to privacy complies with the principles of legality, proportionality, and necessity, regardless of the nationality or location of the individual whose communications are under direct surveillance.”⁵⁷ It appears that the functional orientation of the recommendation reflected an awareness on the part of the Committee of the need to expand the scope of protection afforded by the ICCPR so that it would remain relevant as a meaningful constraint on state power in an age in which such power has been increasingly applied globally through new technology such as online surveillance technology or unmanned drones—the extra-territorial use of drones was another topic discussed in the same US periodic review session.⁵⁸

II. Digital Human Rights and Positive Obligations

The traditional distinction between civil and political rights, on the one hand, and economic, social, and cultural rights, on the other hand, was manifested in a reading of the ICCPR that focused on negative obligations and a reading of the Internation Covenant on Economic, Social and Cultural Rights (ICESCR) that focused on positive rights.⁵⁹ That paradigm also has been significantly eroded in recent decades. In particular, the ECtHR and the H.R.C. have developed an extensive caselaw—for the Committee this includes its Concluding Observations and General Comments—that require governments to take active steps to protect individuals from measures undertaken by private actors that prevent them from enjoying their rights. These include crime prevention steps,⁶⁰ environmental regulation,⁶¹ and welfare interventions.⁶² Given the significant role played by technology companies in facilitating the enjoyment of digital human rights, including online free speech, online privacy and the right to be forgotten, it is hardly surprising that human rights officials, such as the UN Special Rapporteurs for Freedom of Expression and Privacy, have turned their attention increasingly towards the regulatory role of governments vis-à-vis technology companies.⁶³

The move in the direction of imposing positive obligations on states in relation to putative violations mediated through private actors has two components of particular relevance to the realm of digital human rights. The first involves efforts to strengthen corporate responsibility through the Business and Human Rights platform. The second involves the extraterritorial reach of the human rights obligations of technology exporting countries.

Following the publication of the Ruggie Principles,⁶⁴ and the UN Guiding Principles on Business and Human Rights,⁶⁵ negotiations have been taking place under the auspices of the UN towards the conclusion of an international legally binding instrument on business and human rights.⁶⁶ The current draft instrument concentrates on the duty of states to regulate businesses, requiring them to exercise “human rights due diligence,” to impose legal liability for human rights abuses, to see to it that remedies are provided to victims, and to engage in international cooperation in the implementation of the instrument.⁶⁷ No doubt, such a framework would also apply to technology companies whose activities affect the enjoyment of digital human rights, and, in particular, to those operating online platforms, providing Internet services and developing AI products.⁶⁸

Another development relates to efforts to indirectly regulate private business enterprises by imposing positive duties to do so on their home states. It revolves around the expectation that states in which multi-national corporations (MNCs) are incorporated or headquartered should protect foreign victims harmed by MNC conduct by regulating their extra-territorial activities, including through the imposition of export controls. As already indicated, the 2017 Inter-American Court advisory opinion confirmed the existence of state obligations to ensure that activities originating from within their territory and having trans-boundary environmental impact would not infringe the human rights of individuals located elsewhere.⁶⁹ The Committee on the Rights of the Child has taken a similar approach with respect to the alleged failure of states to take adequate preventive and precautionary measures to address climate change.⁷⁰ These decisions seem to mirror parallel developments in domestic jurisprudence relating to the regulation of extra-territorial impacts caused by the activities of locally-based private businesses.⁷¹

The H.R.C. has had the opportunity to review the matter of export of digital products manufactured by private companies in its review of Italy in 2017. The Committee expressed concern about “allegations that companies based in the State party have been providing online surveillance equipment to Governments with a record of serious human rights violations and about the absence of legal safeguards or oversight mechanisms regarding the export of such equipment.”⁷² It therefore recommended that “measures are taken to ensure that all corporations under its jurisdiction, in particular technology corporations, respect human rights standards when engaging in operations abroad.”⁷³ The matter of export controls relating to surveillance technology has also been taken up by the UN Special Rapporteur on Freedom of Expression, who has reported on the harmful effects on political expression of resort by governments to spyware programs, and called for a moratorium on the export of such technology.⁷⁴

III. Digital Human Rights and Systemic Integration

The boundaries between IHRL and other branches of international law are also disappearing. In the past, IHRL treaty-monitoring bodies have tended to concentrate on interpreting and applying only the specific instrument with which they were entrusted. They seldom referred to other IHRL treaties or to state obligations arising out of other branches of international law, such as international humanitarian law (IHL), international refugee law, or international environmental law.⁷⁵ This “tunnel vision” approach has changed, and in recent decades there has been increased interest—in IHLR scholarship and practice—in the application of the principle of systemic integration (article 31(3)(c) of the Vienna Convention on the Law of Treaties)⁷⁶ and in giving effect to the 1993 Vienna Declaration formula concerning the indivisibility, interdependence, and interrelatedness of all human rights.⁷⁷ Consequently, IHRL treaty monitoring bodies now refer more frequently in their work to state obligations emanating from other international instruments. As a result of this development, the reach of their decisions and their potential normative influence has been extended.⁷⁸

A similar phenomenon can be identified in connection to the application of digital rights. The prevalence of abusive online conduct, including criminal cyber-attacks, cyber-terrorism, and military cyber-attacks, has resulted in declarations about digital human rights mentioning concerns such as cyber security and to the need for a safe online environment.⁷⁹ This suggests an increased possibility for establishing links between IHRL and other legal instruments relating to cyberspace, such as the Budapest Convention on Cybercrime⁸⁰ and the EU General Data Protection Regulation (GDPR),⁸¹ and between IHRL and international regulatory processes concerned with cyber security, such as the Wassenaar process for regulating dual use exports of technology.⁸²

In the same vein, experts bodies and civil society groups dealing with the effects of the use of AI on IHRL have been paying close attention to the process taking place under the auspices of the Conference for Disarmament with respect to autonomous weapon systems,⁸³ as well as to broader regulatory developments in the field of AI, such as the Draft EU AI Regulations⁸⁴ and the White House’s blueprint for an AI Bill of Rights.⁸⁵ In other words, as in other fields of IHRL, the more digital technology becomes embedded in a variety of legal, political, and economic contexts, the less feasible it would be to regulate its human rights implications in isolation from other bodies of domestic, regional, and international law as well as bodies of self-regulation and co-regulation.

D. Concluding Remarks

The rise of digital human rights law—in response to the fast changes relating to the introduction of and adaptation to new technology—is changing the nature of IHRL. The consequences of this have been the radical reinterpretation of existing human rights norms, the emergence of new digital human rights, and the extension of human rights law to new right-holders and duty-holders. Furthermore, developments relating to digital human rights are also contributing to, and are influenced by, broader changes in -IHRL-. This includes a functional approach to the extra-territorial application of -IHRL-, the expansion of positive obligations relating to the conduct of private companies, and the growing inclination to construe -IHRL- instruments and promote -IHRL- norms in light of other -IHRL- instruments and other international law norms.

One question that remains to be answered, and which exceeds the scope of the present article, is whether the development of digital human rights and the associated changes in the IHRL framework are sufficient to relieve the growing pressure on the enjoyment of human rights posed by new technologies and the structures of power and control that have accompanied their emergence and widespread adoption. The future trajectory of IHRL in the digital age depends to a large extent on the answer to this question. Furthermore, the backlash by certain states against structural changes in IHRL—manifesting themselves, for example, in the new UK Bill of Rights that is supposed to reduce the impact of ECtHR judgments relating to overseas military operations and to positive state obligations⁸⁶—puts in question the political sustainability of the very developments on which the further evolution of digital human rights hinge.