Metadata collection comes under fire in new UN anti-surveillance draft resolution

Germany and Brazil have drafted a new version of an anti-surveillance resolution that the United Nations adopted late last year, this time describing the collection of metadata as a “highly intrusive act.”

The earlier resolution was also the product of German and Brazilian anger over the mass surveillance revelations of NSA leaker Edward Snowden (well, specifically their anger at their leaders being personally spied upon, but we’ll take righteous outrage where we can find it).

However, while it described the monitoring and collection of communications and personal data as a threat to human rights, it didn’t talk about metadata – the logs of who contacted whom and when, or which webpages people visit, as opposed to the contents of those communications and webpages. These details also paint a vivid picture of a person’s activities and networks.

According to a Thursday Reuters report, the new draft says that arbitrary surveillance and collection of metadata “violate the right to privacy and can interfere with the freedom of expression and may contradict the tenets of a democratic society, especially when undertaken on a mass scale.”

Since the UN adopted the first resolution just before Christmas 2013, there have been not one but two reports from high-level officials that have detailed and condemned modern mass surveillance practices. The first came in July this year from human rights high commissioner Navi Pillay, who said data retention laws were disproportionate and “an interference with privacy whether or not those data are subsequently consulted or used.”

Data retention laws – found in countries such as the U.K. and soon Australia too — force communications providers such as ISPs to store metadata for a fixed period so it can be queried by law enforcement and intelligence services.

In October, the UN’s counter-terrorism and human rights special rapporteur, Ben Emmerson, issued another report that attacked many aspects of international mass surveillance, but specifically noted that “it is incompatible with existing concepts of privacy for states to collect all communications or metadata all the time indiscriminately.”

Brazil does not have a mandatory data retention law. The European Union did have one but Germany only implemented it between 2008 and 2010, before its constitutional court struck it down for violating the right to secrecy of correspondence. The EU’s highest court struck down the wider law in April this year for violating fundamental rights, but the U.K. — which uses data retention to spy on journalists and their sources, among other things — not only maintained but expanded its metadata collection practices.

The Reuters piece quoted Germany’s UN ambassador, Harald Braun, as saying the new draft resolution would “help pave the way towards better protection standards.” Apart from adding arbitrary metadata collection to the naughty list, it also urges countries to give people an effective legal remedy when their privacy has been violated by individual or mass surveillance.