I. Introduction
The internet has evolved from an academic network into the central nervous system of global life, outstripping the legal frameworks designed to safeguard human dignity. The consequences are concrete: surveillance capitalism commodifies the intimate details of human cognition; [1] algorithms entrench discrimination; algorithmic systems reproduce and amplify discrimination along lines of race, gender, and class;[2] cyberattacks disable critical infrastructure; algorithmic systems reproduce and amplify discrimination along lines of race, gender, and class; [3] and digital platforms enable gender-based violence and refugee disempowerment. [4]
The central thesis of this article is that legal frameworks governing technology and human rights suffer from three structural deficiencies: they prioritize State power over platform regulation, respond to harms reactively rather than preventively, and neglect intersectional rights analysis.
Privacy and expression are the cornerstones of democracy [5] and cannot be infringed without satisfying the universal three-part test of legality, legitimate aim, and necessity/proportionality. [6] Drawing on international human rights and comparative constitutional law, the following article argues how the existing legal frameworks are structurally inadequate to govern digital power disparities and that there is a requirement to move towards a rights-by-design model.
II. Privacy Law in the Age of Pervasive Data Collection
Privacy is a foundational prerequisite for the exercise of other fundamental rights, including freedom of expression, association, and political participation. Any form of arbitrary or unlawful interference with privacy, is strictly prohibited. [7] The European Union’s General Data Protection Regulation (GDPR),[8] security exception and the ECtHR[9] jointly expose the central paradox: the same frameworks that codify privacy rights contain the instruments of their own erosion.
Any interference with privacy must satisfy the three-part test.[10] The legality requirement is not merely formal, the law must be clear enough to notify citizens when authorities may take secret measures. [11] Vague surveillance statutes, even those formally enacted, do not satisfy the legality requirement. [12]
Surveillance must also satisfy strict necessity and proportionality requirements. The ECtHR Grand Chamber required ‘end-to-end safeguards’ for bulk interception: independent authorization, oversight of selection criteria and notification, where feasible. [13]
The UN Special Rapporteur on Privacy confirmed that arbitrary surveillance, interception, and data collection are ‘highly intrusive practices that violate privacy and undermine democracy, even when conducted extraterritorially or on a mass scale.’ [14] Furthermore, data retention periods are also subject to scrutiny, with 12–24 months may be deemed disproportionate. [15]
GDPR is a key instrument that represents the most ambitious attempt to operationalize privacy as a legal right in the digital age. Its extra-territorial reach under Article 3 has made it the de facto global standard, [16] a phenomenon Bradford has termed the ‘Brussels Effect’.[17] The GDPR’s principles of data minimization,[18] purpose limitation [19] and accountability [20] represent a structural departure from the notice-and-consent paradigm.
Yet the GDPR’s limitations are equally instructive. Schwartz and Peifer have argued that the Regulation’s fundamental rights framing is undermined by its commercial enforcement architecture. [21] More fundamentally, the GDPR operates within a framework of individual rights and consent that is structurally incapable of addressing the collective dimension of data harm i.e., ways in which aggregated data enables algorithmic discrimination, political manipulation and systemic power asymmetries that no individual complainant can effectively challenge.
III. The Fragmentation of Digital Governance Frameworks
Internet governance remains the most conspicuous gap in the international legal order. Unlike trade (WTO), aviation (Chicago Convention), [22] or telecommunications (ITU), [23] the internet has no binding multilateral framework which has resulted in a patchwork of national laws, private platform rules and non-binding soft law that disadvantages individuals and developing States relative to powerful States and multinational corporations.
The 2005 Tunis Agenda, established the Internet Governance Forum and enshrined the multistakeholder model.[24] Proponents argue it appropriately reflects the internet’s technical architecture and avoids capture by states hostile to free expression. [25] Although HRC affirmed that ‘the same rights that people have offline must also be protected online’, [26] the resolution’s non-binding character renders it aspirational rather than operative.
Consequently, major digital platforms wield enormous power. Facebook, Google, and Twitter/X set rules that affect billions, but their content policies are private contracts, not constitutional obligations. The State action doctrine shields them from human rights duties.
IV. Algorithmic Injustice: How Technology Amplifies Gender Inequality
Gender and technology are deeply intertwined, not accidentally but by design. Tech is built and run by institutions that mirror gender inequality. This observation, theorized by feminist legal scholars such as Danielle Citron in ‘Hate Crimes in Cyberspace’, [27] has been empirically confirmed by data demonstrating that women, girls, LGBTQ+ individuals, and gender non-conforming persons bear a disproportionate burden of technology-facilitated violence. Image-based sexual abuse i.e., sharing intimate images without consent, is a stark example of tech amplifying gender violence. Some countries, including England and Wales, have criminalized it,[28] but legal responses have been inadequate. The CEDAW Committee has recognized this as gender-based violence and urged states to enforce laws online.[29]
AI systems trained on historical data don’t just mirror past discrimination, they amplify it. The landmark ‘Gender Shades’ study found that facial recognition misclassified dark-skinned women up to 34.7% more often than light-skinned men. [30] This isn’t just a technical glitch, it has real consequences in policing, borders, and hiring.
While the EU AI Act [31] bans some high-risk uses, including biometric systems that infer sensitive traits, its risk-based approach leaves lower-risk systems which can still discriminate at scale, largely unchecked. [32] Real change would require building equality into algorithms from the start and auditing for bias across race, gender, disability, and class before deployment.
V. The Dark Side of Digital Humanitarianism
Data protection in humanitarian settings is a legal patchwork. The Handbook on Data Protection in Humanitarian Action[33] is the leading scholarly work on this issue, proposing principles rooted in ICRC and human rights law. The ICRC[34] and UNHCR[35] have their own internal rules on data protection, but these aren’t legally binding and can’t replace binding international law.
Perhaps most alarmingly, the Rohingya crisis illustrated the risk of data sharing between humanitarian agencies and state authorities in ways that compromise refugee protection. Biometric data collected to protect refugees can be used to persecute them, undermining the core principle of non-refoulement. [36] Privacy protections apply regardless of nationality or status, and international law makes clear that refugees and asylum seekers are covered. [37] But the gap between law and practice remains dangerously wide.
VI. Conclusion
The foregoing analysis demonstrates the intersection of law, technology, and human rights is the defining governance challenge of our era. The three-part test, is routinely ignored by States, leading to unchecked discretion and data collection without safeguards. Meaningful reform demands incorporating human rights into digital systems from conception, not after harm. This paradigm rests on three pillars: human rights impact assessments, analogous to environmental impact assessment [38] algorithmic transparency: disclosing training data, decision criteria, and error rates for judicial review; and treating dominant platforms as exercising public functions subject to human rights obligations. [39] The task of the 21st century jurisprudence is to rebuild rights for the digital age, so that, human dignity remains, online and offline, ‘the foundation of freedom, justice, and peace in the world.’[40]
Bibliography
A. International Legal Instruments
Convention on International Civil Aviation (opened for signature 7 December 1944, entered into force 4 April 1947) 15 UNTS 295.
Convention on the Elimination of All Forms of Discrimination Against Women (opened for signature 18 December 1979, entered into force 3 September 1981) 1249 UNTS 13.
Convention Relating to the Status of Refugees (opened for signature 28 July 1951, entered into force 22 April 1954) 189 UNTS 137, art 33.
Constitution of the International Telecommunication Union (opened for signature 22 December 1992, entered into force 1 July 1994) 1825 UNTS 1; Convention of the International Telecommunication Union (opened for signature 22 December 1992, entered into force 1 July 1994) 1825 UNTS 1.
International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171, arts 17, 19.
Universal Declaration of Human Rights, UNGA Res 217A (III) (10 December 1948) UN Doc A/810.
B. Regional Instruments
African Charter on Human and Peoples’ Rights (adopted 27 June 1981, entered into force 21 October 1986) 21 ILM 58.
American Convention on Human Rights (opened for signature 22 November 1969, entered into force 18 July 1978).
Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108, Council of Europe, 1981) and Modernised Convention 108+.
European Convention for the Protection of Human Rights and Fundamental Freedoms (opened for signature 4 November 1950, ETS No 005, entered into force 3 September 1953) arts 8, 10.
C. European Union Legislation
Council Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1, arts 3, 5(1)(b), 5(1)(c), 5(2), 23 (‘GDPR’).
Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services (Digital Services Act) [2022] OJ L277/1.
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2022/2555 (Artificial Intelligence Act) [2024] OJ L1689/1, arts 6(1)–(3), 50, 95, Annex III, recital 53.
D. Domestic Legislation
Criminal Justice and Courts Act 2015, s 33.
Federal Law No 90-FZ of 1 May 2019 ‘On Amendments to the Federal Law “On Communications” and the Federal Law “On Information, Information Technologies and on Information Protection”‘ (Russia).
Online Safety Act 2023.
UK Investigatory Powers Act 2016.
E. UN Reports and Treaty Body Documents
CEDAW Committee, ‘General Recommendation No 35 on Gender-Based Violence Against Women, Updating General Recommendation No 19’ (26 July 2017) UN Doc CEDAW/C/GC/35.
Human Rights Committee, ‘General Comment No 16: Article 17 (Right to Privacy)’ (1988) UN Doc HRI/GEN/1/Rev.9.
Human Rights Committee, ‘General Comment No 31: The Nature of the General Legal Obligation Imposed on State Parties to the Covenant’ (26 May 2004) UN Doc CCPR/C/21/Rev.1/Add.13.
Human Rights Committee, ‘General Comment No 34: Article 19 (Freedoms of Opinion and Expression)’ (12 September 2011) UN Doc CCPR/C/GC/34.
Report of the Special Rapporteur on the Right to Privacy (2017) UN Doc A/HRC/34/L7/Rev1.
Report of the UN High Commissioner for Human Rights, ‘The right to privacy in the digital age’ (30 June 2014) UN Doc A/HRC/27/37.
Report of the UN High Commissioner for Human Rights, ‘Encryption, anonymity and the human rights framework’ (29 June 2015) UN Doc A/HRC/29/32.
Tunis Agenda for the Information Society, WSIS-05/TUNIS/DOC/6(Rev.1)-E (18 November 2005) paras 29, 31, 35, 72–73.
UN Committee on Economic, Social and Cultural Rights, ‘General Comment No 20: Non-discrimination in economic, social and cultural rights’ (2009) UN Doc E/C.12/GC/20.
UN Committee on Economic, Social and Cultural Rights, ‘General Comment No 24 on State Obligations under the International Covenant on Economic, Social and Cultural Rights in the Context of Business Activities’ (10 August 2017) UN Doc E/C.12/GC/24.
UN Human Rights Council, Resolution 32/13, ‘The promotion, protection and enjoyment of human rights on the Internet’ (18 July 2016) UN Doc A/HRC/RES/32/13.
UN Human Rights Council, ‘Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework’ (21 March 2011) UN Doc A/HRC/17/31.
UNHCR Executive Committee, General Conclusion on International Protection No 25 (XXXIII) (20 October 1982) UN Doc A/37/12/Add.1.
F. European Court of Human Rights
Al-Nashif v Bulgaria App No 50963/99 (ECtHR, 20 September 2002) [119].
Avaz Zeynalov v Azerbaijan App Nos 37816/12 and 25260/14 (ECtHR, 22 April 2021) [99].
Big Brother Watch and Others v United Kingdom [GC] App Nos 58170/13, 62322/14 and 24960/15 (ECtHR, 25 May 2021) [350], [442].
Ceylan v Turkey App No 23556/94 (ECtHR, 8 July 1999) [24].
Delfi AS v Estonia [GC] App No 64569/09 (ECtHR, 16 June 2015) [59].
Gachechiladze v Georgia App No 2591/19 (ECtHR, 22 October 2021) [46].
Handyside v United Kingdom App No 5493/72 (ECtHR, 7 December 1976) [49].
Kopp v Switzerland App No 23224/94 (ECtHR, 25 March 1998) [54].
Lohé Issa Konaté v Burkina Faso App No 004/2013 (AfCHPR, 5 December 2014) [126].
Malone v United Kingdom App No 8691/79 (ECtHR, 2 August 1984) [66].
Milosavljevic v Serbia App No 57574/14 (ECtHR, 25 May 2021) [47].
Ooo Informatsionnoye Agentstvo Tambov-Inform v Russia App No 43351/12 (ECtHR, 18 August 2021) [73].
Perinçek v Switzerland App No 27510/08 (ECtHR, 15 October 2015) [124].
Pietrzak and Others v Poland App Nos 72038/17 and 25237/18 (ECtHR, 28 May 2024).
Roman Zakharov v Russia [GC] App No 47143/06 (ECtHR, 4 December 2015) [229].
Rotaru v Romania [GC] App No 28341/95 (ECtHR, 4 May 2000) [48].
Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland [GC] App No 931/13 (ECtHR, 27 June 2017) [143].
The Sunday Times v United Kingdom App No 6538/74 (ECtHR, 26 April 1979) [45], [49].
Valenzuela Contreras v Spain App No 27671/95 (ECtHR, 30 July 1998) [46].
Weber and Saravia v Germany App No 54934/00 (ECtHR, 29 June 2006) [132].
Yezhov and Others v Russia App No 22051/05 (ECtHR, 29 September 2021) [25].
G. Court of Justice of the European Union
Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Ltd v Minister for Communications [GC] (2014) ECLI:EU:C:2014:238 [54].
H. Human Rights Committee Communications
Jong-Kyu Sohn v Republic of Korea Comm No 518/1992 UN Doc CCPR/C/54/D/518/1992 (HRC, 19 March 1994) [10.4].
Malcom Ross v Canada Comm No 736/1997 UN Doc CCPR/C/70/D/736/1997 (HRC, 26 October 2000) [11.2].
Toonen v Australia Comm No 488/1992 UN Doc CCPR/C/50/D/488/1992 (HRC, 31 March 1994) [8.3].
Van Hulst v Netherlands Comm No 903/2000 UN Doc CCPR/C/82/D/903/2000 (HRC, 1 November 2004) [7.3].
Womah Mukong v Cameroon Comm No 458/1991 UN Doc CCPR/C/51/D/458/1991 (HRC, 10 August 1994) [9.7].
I. Inter-American Court and Commission of Human Rights
Francisco Martorell v Chile Case 11.230 Report No 11/96 (IACHR, 3 May 1996) [53]–[55].
Hector Felix Miranda v Mexico Case 11.739 Report No 50/99 (IACHR, 13 April 1999) [43].
Ivcher-Bronstein v Peru IACtHR Series C No 74 (6 February 2001) [154]–[155].
Olmedo Bustos et al v Chile IACtHR Series C No 73 (5 February 2001) [69].
Tristan Donoso v Panama IACtHR Series C No 193 (27 January 2009) [56].
J. Institutional and Policy Documents
International Committee of the Red Cross, Rules on Personal Data Protection (ICRC 2015).
Madeline Kennedy, ‘Tracing the Untraceable: New Technologies that Monitor Displaced Persons and the History of Population Control’ Harvard International Review (24 May 2021) <https://hir.harvard.edu/new-technologies-that-monitor-displaced-persons/> accessed 30 June 2026.
UN High Commissioner for Refugees, Policy on the Protection of Personal Data of Persons of Concern to UNHCR (UNHCR, May 2015) <https://www.refworld.org/policy/strategy/unhcr/2015/120873> accessed 30 June 2026.
K. Books
Bradford A, The Brussels Effect: How the European Union Rules the World (Oxford University Press 2020) 1.
Citron DK, Hate Crimes in Cyberspace (Harvard University Press 2014) 3.
DeNardis L, The Global War for Internet Governance (Yale University Press 2014) ch 1.
Griffiths J, The Great Firewall of China: How to Build and Control an Alternative Version of the Internet (Zed Books 2019).
Kuner C, Marelli M and Papakonstantinou V (eds), Handbook on Data Protection in Humanitarian Action (1st edn, ICRC/Brussels Privacy Hub 2017).
MacKinnon CA, Only Words (Harvard University Press 1993) 15–41.
Malcomson S, Splinternet: How Geopolitics and Commerce Are Fragmenting the World Wide Web (OR Books 2016).
Noble SU, Algorithms of Oppression: How Search Engines Reinforce Racism (NYU Press 2018).
Schmitt MN (ed), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (2nd edn, Cambridge University Press 2017) Rules 100, 103.
Zuboff S, The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power (Profile Books 2019).
L. Journal Articles
Buolamwini J and Gebru T, ‘Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification’ (2018) 81 Proceedings of Machine Learning Research 1.
Schwartz PM and Peifer KN, ‘Transatlantic Data Privacy Law’ (2017) 106 Georgetown Law Journal 115.
[1] Zuboff, S, ‘The Age of Surveillance Capitalism’ (Profile Books, 2019).
[2] Noble, SU, ‘Algorithms of Oppression: How Search Engines Reinforce Racism’ (NYU Press, 2018).
[3] Noble, SU, ‘Algorithms of Oppression: How Search Engines Reinforce Racism’ (NYU Press, 2018).
[4] Kuner & Marelli, Handbook on Data Protection in Humanitarian Action (ICRC/Brussels Privacy Hub, 2017); UNHCR Policy on Protection of Personal Data (2015).
[5] Human Rights Committee, ‘General Comment No 34: Article 19 (Freedoms of Opinion and Expression)’ (12 September 2011) UN Doc CCPR/C/GC/34 [13]; Big Brother Watch and Others v United Kingdom [GC] App Nos 58170/13, 62322/14 and 24960/15 (ECtHR, 25 May 2021) [442].
[6] Van Hulst v Netherlands Comm No 903/2000 UN Doc CCPRC/C/82/D/903/2000 (HRC, 1 November 2004) [7.3]; Valenzuela Contreras v Spain App no 27671/95 (ECtHR, 30 July 1998) [46]; Kopp v Switzerland App no 23224/94 (ECtHR, 25 March 1998) [54]; Rotaru v Romania [GC] App no 28341/95 (ECtHR, 4 May 2000) [48]; Human Rights Committee, ‘General Comment No 16: Article 17 (Right to Privacy)’ (1988) UN Doc HRI/GEN/1/Rev.9 [8]; Tristan Donoso v Panama IACtHR Series C No 193 ( 27 January 2009) [56]; Womah Mukong v Cameroon Comm no 458/1991 UN Doc CCPR/C/51/D/458/1991 (HRC, 10 August 1994) [9.7]; Malcom Ross v Canada Comm no 736/1997 CCPR/C/70/D/736/1997 (HRC, 26 October 2000) [11.2]; Jong-Kyu Sohn v Republic of Korea Comm no 518/1992 CCPR/C/54/D/518/1992 (HRC, 19 march 1994) [10.4]; Avaz Zeynalov v Azerbaijan App nos 37816/12 and 25260/14 (ECtHR, 22 April 2021) [99]; Yezhov and Others v Russia App no 22051/05 (ECtHR, 29 September 2021) [25]; Milosavljevic v Serbia App no 57574/14 (ECtHR, 25 May 2021) [47]; Perinçek v Switzerland App no 27510/08 (ECtHR, 15 October 2015) [124]; Delfi AS v Estonia [GC] App no 64569/09 (ECtHR, 16 June 2015) [59]; Ceylan v Turkey App no 23556/94 (ECtHR, 8 July 1999) [24]; The Sunday Times v UK App no 6538/74 (ECtHR, 26 April 1979) [45]; Handyside v UK App no 5493/72 (ECtHR, 7 December 1976) [49]; Ivcher-Bronstein v Peru IACtHR Series C no 74 (6 February 2001) [154]-[155]; Francisco Martorell v Chile Case 11.230 Report no 11/96 (IACHR, 3 May 1996) [53]–[55]; Hector Felix Miranda v Mexico Case 11.739 Report no 50/99 (IACHR, 13 April 1999) [43]; Olmedo Bustos et al v Chile IACtHR Series C no 73 (5 February 2001) [69]; GC 34 (n 5) [45].
[7] International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171, art 17.
[8] Council Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1, art 23.
[9] Pietrzak v Poland App Nos 72038/17 25237/18 (ECtHR, 28 May 2024).
[10] Van Hulst v Netherlands Comm No 903/2000 UN Doc CCPR/C/82/D/903/2000 (HRC, 1 November 2004) [7.3]; Toonen v Australia Comm No 488/1992 UN Doc CCPR/C/50/D/488/1992 (HRC, 31 March 1994) [8.3];Valenzuela Contreras v Spain App No 27671/95 (ECtHR, 30 July 1998) [46]; Kopp v Switzerland App No 23224/94 (ECtHR, 25 March 1998) [54]; Rotaru v Romania [GC] App No 28341/95 (ECtHR, 4 May 2000) [48].
[11] Sunday Times v United KingdomApp no 6538/74 (ECtHR, 26 April 1979) [49]; Roman Zakharov v Russia [GC] App No 47143/06 (ECtHR, 4 December 2015) [229]; Gachechiladze v Georgia App no 2591/19 (ECtHR, 22 October 2021) [46]; Ooo Informatsionnoye Agentstvo Tambov-Inform v Russia App no 43351/12 (ECtHR, 18 August 2021) [73]; Satakunnan (n 11) [143]; Lohé Issa Konaté v Burkina Faso App no 004/2013 (AfCHPR, 5 December 2014) [126]; Malone v United Kingdom App No 8691/79 (ECtHR, August 2 1984) [66].
[12] Al-Nashif v Bulgaria App No 50963/99 (ECtHR, 20 September 2002) [119]; Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Ltd v Minister for Communications [GC] (2014) ECLI:EU:C:2014:238 [54].
[13] Big Brother Watch and Others v United Kingdom [GC] App Nos 58170/13, 62322/14 and 24960/15 (ECtHR, 25 May 2021) [350].
[14] Report of the Special Rapporteur on the Right to Privacy (2017) UN Doc A/HRC/34/L7/Rev1, 3.
[15] Weber and Saravia v Germany App No 54934/00 (ECtHR, 29 June 2006) [132].
[16] GDPR (n 8), art 3.
[17] Bradford, A, ‘The Brussels Effect: How the European Union Rules the World’ (Oxford University Press, 2020) p 1.
[18] GDPR (n 8), art 5(1)(c).
[19] GDPR (n 8), art 5(1)(b).
[20] GDPR (n 8), art 5(2).
[21] Schwartz, PM and Peifer, KN, ‘Transatlantic Data Privacy Law’ (2017) 106 Georgetown Law Journal, p 115.
[22] Convention on International Civil Aviation (opened for signature 7 December 1944, entered into force 4 April 1947) 15 UNTS 295.
[23] Constitution of the International Telecommunication Union (opened for signature 22 December 1992, entered into force 1 July 1994) 1825 UNTS 1; Convention of the International Telecommunication Union (opened for signature 22 December 1992, entered into force 1 July 1994) 1825 UNTS 1.
[24] Tunis Agenda for the Information Society, WSIS-05/TUNIS/DOC/6(Rev.1)-E (18 November 2005) paras 29, 31, 35, 72–73.
[25] DeNardis, L, ‘The Global War for Internet Governance’ (Yale University Press, 2014) ch 1.
[26] UN Human Rights Council, Resolution 32/13, ‘The promotion, protection and enjoyment of human rights on the Internet’ (18 July 2016) UN Doc A/HRC/RES/32/13, page 2.
[27] Citron, DK, ‘Hate Crimes in Cyberspace’ (Harvard University Press, 2014) p 3.
[28] Criminal Justice and Courts Act 2015, s 33.
[29] CEDAW Committee, ‘General Recommendation No 35 on gender-based violence against women’ (2017) UN Doc CEDAW/C/GC/35.
[30] Buolamwini, J and Gebru, T, ‘Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification’ (2018) 81 Proceedings of Machine Learning Research 1.
[31] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L 2024/1689.
[32] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2022/2555 (Artificial Intelligence Act) [2024] OJ L1689/1, arts 6(1)– (3), 50, 95, Annex III, recital 53.
[33] Christopher Kuner, Massimo Marelli and Vagelis Papakonstantinou (eds), Handbook on Data Protection in Humanitarian Action (1st edn, ICRC/Brussels Privacy Hub 2017).
[34] International Committee of the Red Cross, Rules on Personal Data Protection (ICRC 2015).
[35] UN High Commissioner for Refugees (UNHCR), Policy on the Protection of Personal Data of Persons of Concern to UNHCR (UNHCR, May 2015) https://www.refworld.org/policy/strategy/unhcr/2015/120873 accessed 30 June 2026.
[36] Convention Relating to the Status of Refugees, opened for signature 28 July 1951, 189 UNTS 137, entered into force 22 April 1954, Art 33.
[37] ICCPR, art 17(1) (n 7); GC 34 (n 5) [10].
[38] UN Committee on Economic, Social and Cultural Rights, ‘General Comment No 24 on State Obligations under the International Covenant on Economic, Social and Cultural Rights in the Context of Business Activities’ (10 August 2017) UN Doc E/C.12/GC/24.
[39] UN Human Rights Council, Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework (21 March 2011) UN Doc A/HRC/17/31.
[40] Universal Declaration of Human Rights, UNGA Res 217A (III) (10 December 1948) UN Doc A/810.
