4.1 Oversight and Authorization Even if a limitation on the right to privacy is permitted by law, any measures must be subject to procedural and legal safeguards, via a sufficiently independent and robust oversight and authorisation mechanism. This ensures: authorisation and oversight may occur at three stages of surveillance activities: • when the activity is ordered, • while the activity is carried out, or • after the activity has been terminated.139 • Public trust and confidence in the work of government agencies empowered with privacy-limiting functions, such as intelligence agencies.134 • Information concerning a person’s private life does not fall into the hands of those who are not authorised by law to receive it.135 All three branches of government should be involved in the oversight of surveillance. Mixed models whereby layers of oversight are provided by the administrative (executive), judicial and parliamentary branches of government are considered desirable.140 • Government agencies and their delegates are held accountable for activities that result in arbitrary or unlawful interference with privacy.136 Targeted surveillance, which usually involves traditional methods such as the interception of phone calls, is usually subject to prior judicial or executive authorisation before the measure is carried out and subsequent review of legality by reference to the particular circumstances and the individual whose communications were intercepted.141 Safeguards are accordingly a central requirement in the relevant international frameworks. For example, the OECD has specified that: Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.137 The UN General Assembly has called on States: To establish or maintain existing independent, effective, adequately resourced and impartial judicial, administrative and/or parliamentary domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception and the collection of personal data.138 In the intelligence and security sector, adequate 134 Report of Special Rapporteur on countering terrorism, Martin Scheinin (17 May 2010) para. 13 http://www2.ohchr.org/english/bodies/ hrcouncil/docs/14session/A.HRC.14.46.pdf (“Intelligence oversight institutions serve to foster public trust and confidence in the work of intelligence services by ensuring they perform their statutory functions in accordance with respect for the rule of law and human rights.”). 135 UNHRC, General Comment No. 16, Article 17 (right to privacy) para. 10 (“Effective measures have to be taken by States to ensure that information concerning a person’s private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant.”). 136 Report of Special Rapporteur on countering terrorism, A/69/397 (23 September 2014) para. 45, citing OHCHR Report, The Right to Privacy in the Digital Age, para. 23 137 OECD Guidelines, Security Safeguards Principle 11 138 General Assembly Resolution on the Right to Privacy in the Digital Age (19 December 2016). However, mass surveillance and the collection of metadata are usually subject to much weaker safeguards142 because there is no opportunity for prior authorization (for a brief explanation of metadata see below). Metadata can reveal much information about an individual’s personal life. Therefore, UN experts have recommended strong independent oversight mechanisms should be in place to scrutinise such surveillance.143 The importance of independent intelligence oversight in the New Zealand context was highlighted in the report of the First Independent Review of Intelligence and Security in New Zealand: Independent external oversight is . . . essential to ensure that by working to secure populations 139 Roman Zakharov v. Russia, App. No. 47143/06, European Court of Human Rights, Judgment (4 December 2015) para. 233, http://hudoc. echr.coe.int/eng?i=001-159324 140 OHCHR Report, The Right to Privacy in the Digital Age, para 37; Report of Special rapporteur on countering terrorism, Ben Emmerson (23 September 2014) para 45; Human Rights Resolution A/HRC/27/37. 141 Report of SR on countering terrorism, Ben Emmerson (23 September 2014) paras 46-48; Report of SR on privacy, Joseph Cannataci, A/ HRC/34/60 (24 February 2017) para 25 142 Report of SR privacy, Joseph Cannataci (24 February 2017) para 25. 143 Report of SR countering terrorism, A/69/397 (23 September 2014) paras 46-48; Report of SR privacy, Joseph Cannataci (24 February 2017) para 25 29