Article 2 of the ICCPR provides that individuals whose rights have been violated must be provided with access to an effective remedy. This requires a process where individuals can submit a complaint to an independent mechanism that is capable of conducting a thorough and impartial review and providing a rights-vindicating outcome (for example through an injunction, reparation, declaration or restitution) in the event a breach is found to have occurred. International human rights law requires States “to provide individuals whose right to privacy has been violated by unlawful and arbitrary surveillance with access to an effective remedy.”182 Furthermore, the UN Guiding Principles on Business and Human Rights provide that States should ensure access to an effective remedy for violations of human rights by private entities.183 Remedies can come in a variety of judicial, legislative or administrative forms. According to the OHCHR, effective remedies will: • be known and accessible to anyone with an arguable claim; • involve “prompt, thorough and impartial” investigation of the alleged violations, often by an independent oversight body; • be capable of ending ongoing violations i.e. through deletion of data or other forms of reparation; and • in cases of gross violations, may require criminal prosecution.184 In New Zealand, the following remedies are available to individuals in the context of surveillance and informational privacy. 5.1 Domestic Privacy Act Under the Privacy Act, the Privacy Commissioner has the power to investigate a matter that is or may constitute interference with privacy. 182 General Assembly Resolution on the Right to Privacy in the Digital Age (18 December 2014). 183 UN Guiding Principles on Business and Human Rights, Pillar 3. 184 OHCHR Report, The Right to Privacy in the Digital Age, paras. 40-41. The Privacy Commissioner can also receive complaints under the Act from anyone who believes that they are affected by a breach of the privacy principles. International human rights law requires States “to provide individuals whose right to privacy has been violated by unlawful and arbitrary surveillance with access to an effective remedy.” The Commissioner will then investigate whether the public or private sector agency has breached the Act.185 If the complainant does not obtain a satisfactory outcome, they can take their case to the Human Rights Review Tribunal (HRRT) which has the power to grant remedies including a declaration of interference with the right to privacy, an order that the agency should not repeat the behaviour or should redress any loss or damages, and compensation.186 Human Rights Commission The Human Rights Act 1993 (HRA) sets out a complaints mechanism for people who believe they have been discriminated against. In the context of the collection of Big Data and the application of algorithms to that data to generate risk outcomes to inform for social policy, an individual could potentially complain to the Commission if they believe that they have been discriminated against, for example on the 185 For example, in April 2018, the Privacy Commissioner found that Facebook breached the Privacy Act because it failed to: properly respond to the complainant’s request for information, acknowledge it was subject to the Privacy Act, and cooperate with the Commissioner’s investigation and statutory demand for information. The Commissioner publicly named Facebook in accordance with his office’s naming policy after first providing Facebook with an opportunity to comment on this finding https://privacy.org.nz/news-and-publications/statements-media-releases/ privacy-commissioner-facebook-must-comply-with-nz-privacy-act/. 186 See Privacy Act 1993, s 85 36