private companies.245 surveillance.248 New Zealand businesses also have responsibilities under the OECD Guidelines on the Protection of Privacy and Trans border Flows of Information. They key principles under these Guidelines are set out in Part I. They play a major role in guiding governments and businesses in their efforts to protect privacy and personal data, and regulate transborder data flows. In light of such risks, the UN General Assembly and UN Human Rights Council resolutions on the right to privacy in the digital age has called for Governments to: In New Zealand, the Data Futures Partnership (DFP), an independent group funded by the Government, was set up to identify challenges in the data-use system and to develop guidelines for public and private organisations. The purpose of the guidelines was to encourage organisations to utilise a “social licence” approach to data use. According to the DFP “the Guidelines focus on eight key questions that organisations can answer to explain how they collect and use data, to better build trust with clients and the wider community. The DFP explains: When people trust that their data will be used as they have agreed, and accept that enough value will be created, they are likely to be more comfortable with its use. This acceptance is referred to as a social licence.246 • Refrain from requiring business enterprises to take steps that interfere with the right to privacy in an arbitrary or unlawful way; • Consider appropriate measures that would enable business enterprises to adopt adequate voluntary transparency measures with regard to requests by State authorities for access to private user data and information; • Develop or maintain legislation, preventive measures and remedies addressing harm from the sale or multiple resale or other corporate sharing of personal data without the individual’s free, explicit and informed consent.” • Respect human rights in accordance with the UN Guiding Principles on Business and Human Rights; and • Inform users of the collection, use, sharing and retention of data about them.249 Businesses in New Zealand also have legal human rights obligations and human rights responsibilities in the context of surveillance and interception, particularly if they are required to supply data or user information to the government in response to a request that contravenes the right to privacy. Furthermore, businesses may be at risk of being complicit in human rights abuses if they provide mass surveillance technology or equipment to States without adequate safeguards in place.247 The UN Special Rapporteurs for freedom of expression and counter-terrorism, and the OHCHR have raised concerns about the increasing reliance by States on the private sector to facilitate digital 245 International reports have found that the public is concerned about the use of personal data by private companies as much as they are government agencies. See Independent Surveillance Review: A Democratic License to Operate, Report of the Independent Surveillance Review, Royal United Services Institute for Defence and Security Studies (July 2015) p 35, para 2.24, p 44, para 2.53 https://www.rusi.org/downloads/ assets/ISR-Report-press.pdf 246 http://datafutures.co.nz/our-work-2/talking-to-new-zealanders/ 247 See OHCHR Report, The Right to Privacy in the Digital Age, para 43 248 Report of SR on countering terrorism, Ben Emmerson (23 September 2014) paras 43, 57; Report SR on freedom of expression (30 March 2017). 249 General Assembly Resolution on the Right to Privacy in the Digital Age, A/RES/71/199 (19 December 2016); Resolution 34/7 47