Privacy and Data Protection in Times of Armed Conflict

By: Asaf Lubin

On 16 June 2020 the International Committee of the Red Cross (ICRC) released its much-anticipated updated Commentary on the Third Geneva Convention relative to treatment of prisoners of war. To celebrate this launch, the ICRC brought together renowned experts and practitioners to discuss the process of renewing the Commentary, which original version dates back to the 1950s. The speakers seemed to all agree on one thing––that emerging technologies play a huge role in reorienting our interpretations of the Geneva Conventions and their Additional Protocols. As Dr. Jean-Marie Henckaerts, the Head of the Project to update the ICRC Commentaries, further explains:

 

“...developments relating to privacy and data protection […] were not present in the original Commentary because they have been developed over the past decades… There have also been technological developments in areas of communications and medicine. So, I can just give the example of contacts of prisoners with the outside world and with their families, correspondence, and the censoring of their correspondence, these areas have developed greatly over the past decades thanks to developments in technology. Whereas the Third Convention puts the emphasis on telegrams today there are faster measn of communication.” (see minute 14:20-15:20).

 

Consider the specific issue of “special surveillance” of POWs, as just one anecdotal example. Under Article 92 of the Third Geneva Convention, POWs who had attempted to escape and are recaptured may be subject to special surveillance. Such surveillance “must not affect the state of their health, must be undergone in a prisoner of war camp, and must not entail the suppression of any of the safeguards granted them by the present Convention.” As you can see, the Convention’s text offers very limited information as to the specific surveillance tools that may or may not be utilized, the safeguards and restrictions that should be imposed on surveilling authorities, general principles of legality, necessity and proportionality that must be adhered to during the surveillance, or the procedures for ensuring access to justice and remedies for the POW in the case of abuse.

 

To address some of these concerns, the new Commentary now states that certain of these safeguards “can be found in international human rights law.” The ICRC experts, however, stop short of actually defining the scope and nature of the rights to privacy and data protection or their particular application in times of war. This approach is not unique. The International Court of Justice (ICJ) for example in the 2004 Palestinian Wall Advisory Opinion, acknowledged that Article 17 of the International Covenant on Civil and Political Rights (ICCPR), on the right to privacy, applied in the Occupied Palestinian Territories. The Court did not, however, go any further in clarifying why it applied, or in what fashion, or what specific consequences such application had on the issues at hand.

 

This is quite troubling considering that the rights to privacy and data protection did not find any explicit mention, let alone specific protection, in either the Hague Regulations of 1899 and 1907, the Geneva Conventions of 1949, or the Additional Protocols of 1977. Unsurprisingly, the International Committee of the Red Cross (ICRC) Customary IHL database also excludes any real mention of privacy or data protection within the 161 rules it identifies as constituting the common core of humanitarian law binding on all parties to all armed conflicts today. A review of the roles that the rights to privacy and data protection play in regulating wartime military operations is long overdue, especially as they relate to the use of what the ICRC calls “digital technology during armed conflict for purposes other than as means and methods of warfare.” There is a rising increase in the use of new technologies by militaries and non-state armed groups for the purposes of surveillance of civilian populations, of conducting disinformation campaigns, and of launching below-the-threshold cyber intrusions. To keep IHL relevant in the face of developments in the fields of artificial intelligence, quantum computing, and encryption, requires us to have new conversations.

Take the obligation of Hospitals Ships during armed conflict to “afford a reasonable level of security” to the communication of personal health data, as is mandated under Article 34 of the Second Geneva Convention. If the Captain of the USNS Mercy hospital ship of the US Navy is concerned about the data protection obligations they are bound by in communicating sensitive health data during armed conflict, the Captain could not find an answer to this question by flipping through the pages of the Geneva Conventions and Additional Protocols. Nor could the Captain rely on existing IHL commentaries or interpretations to reach a conclusive answer. In this scenario, the Captain might turn to human rights law to try and fill the lacuna, but IHL literature as it currently stands offers very little by way of the proper interpretive models and techniques to be adopted.

In my new paper titled: The Rights to Privacy and Data Protection Under International Humanitarian Law and Human Rights Law (a draft of which is available on SSRN) I explore these questions and others. This paper is to be published as the closing chapter of the upcoming Research Handbook on Human Rights and Humanitarian Law: Further Reflections and Perspectives (edited by Robert Kolb, Gloria Gaggioli and Pavle Kilibarda). In my paper I examine three case studies: (1) data protection obligations triggered by the monitoring of the civilian population in the occupied territories; (2) the restrictions imposed on wartime SIGINT collection for launching military operations; and (3) the obligations imposed on international organizations and criminal courts in the collection of digital evidence for jus post bellum investigations and fact-finding missions. These three cases were selected as they target three different obligation holders: a belligerent occupier, a targeting commander, and post factum investigator or prosecutor.

In reviewing these case studies, the chapter explores the normative foundation and scope of application of the rights to privacy and data protection in IHL. The chapter proceeds in the following order. Section II discusses the nature and scope of the rights to informational privacy and data protection under HRL. Section III examines the application of these rights during armed conflict, under the existing theoretical doctrines surrounding the concurrent application of HRL. This section argues that regardless of which specific doctrine one adopts, the rights to privacy and data protection must be read into our contemporary understanding of IHL. Section IV then moves to discuss the specific application of these rights in each of the three case studies. Section V concludes.

The real goal of this chapter and of this broader research project, is to invite other scholars to explore at greater length the intersection of privacy, data protection, and the laws of IHL. As I write in the conclusion of the piece:

“A whole set of fascinating and thought-provoking questions await those who are willing to jump into the fray. Beyond the questions I discussed in the piece one may additionally seek to dig deeper into the following: what is the scope of the rights of POWs, detainees, refugees, and those internally displaced over their electronic devices and data stored in the cloud? Should the “right to be forgotten” be extended to those who have committed war crimes or crimes against humanity? Can operations of cyber rummaging and theft in another’s private computer network ever be subjected to the prohibition on pillaging? What is the nature and scope of application of the rights to privacy and data protection in the context of non-state armed and insurgency groups? What obligations might IHL be said to impose on internet platforms and tech giants whose services are being augmented not only to abuse privacy but also to limit freedom of expression or assembly or to incite to violence?”

By introducing these questions I hope this chapter will serve as a prompt for a growing body of scholarship that couldn’t be more timely and necessary.

https://csrcl.huji.ac.il/sites/default/files/csrcl/files/sp_lvbyn_tmvnh_dknyt_02.jpg?m=1594020346