The right to privacy at the United Nations: texts and mechanisms

Inclusion and rights · Published 2026-10-22

A metal pole at night carrying several white surveillance cameras pointing in different directions — CCTV cameras on a street pole in Matunga, Mumbai, part of a city-wide surveillance network. Photo: Punit Rajpal, CC0.

Privacy is often discussed as a matter of national data protection law. At the United Nations, it is first of all a human right, set out in the founding texts of international human rights law and developed since 2013 through a series of resolutions on the digital age.

The founding texts

Universal Declaration of Human Rights (1948)

Article 12 states that no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks.

International Covenant on Civil and Political Rights (1966)

Article 17 of the Covenant, which is binding on the states that have ratified it, uses almost the same wording, adding that interference must be neither "arbitrary" nor "unlawful". The Human Rights Committee, the body of independent experts that monitors the Covenant, interpreted this article in its General Comment No. 16 in 1988. It said, among other things, that interference authorised by law must still be reasonable in the circumstances, and that the gathering and holding of personal information on computers and other devices must be regulated by law.

Other treaties

Privacy also appears in the Convention on the Rights of the Child (Article 16), the Convention on the Rights of Persons with Disabilities (Article 22) and the International Convention on the Protection of the Rights of All Migrant Workers (Article 14).

The test for lawful interference

Privacy is not absolute. UN human rights bodies apply a set of conditions that interference must meet, broadly similar to those used by regional courts:

Condition	Meaning
Legality	Based on a law that is accessible, clear and precise enough for people to foresee its application
Legitimate aim	Pursues an aim recognised in human rights law, such as national security, public order or the rights of others
Necessity	Necessary to achieve that aim, not merely useful
Proportionality	The least intrusive option, with harm to privacy in balance with the benefit
Non-discrimination and safeguards	Applied without discrimination, with independent oversight and effective remedies

Privacy in the digital age: the 2013 turning point

Following public disclosures in 2013 about large-scale communications surveillance, the General Assembly adopted resolution 68/167, "The right to privacy in the digital age", on 18 December 2013. It affirmed that the same rights people have offline must also be protected online, including the right to privacy, and asked the UN High Commissioner for Human Rights to report on the subject.

The High Commissioner's 2014 report (A/HRC/27/37) concluded, among other points, that the collection of communications data ("metadata") can itself be an interference with privacy, and that mass surveillance programmes raise serious concerns about necessity and proportionality. Later reports have addressed the role of business enterprises, encryption, and in 2021 artificial intelligence.

The General Assembly and the Human Rights Council have continued to adopt resolutions on privacy in the digital age at regular intervals, expanding their scope to cover issues such as data-driven profiling, biometric technologies and the responsibilities of companies.

The Special Rapporteur on the right to privacy

In April 2015, the Human Rights Council adopted resolution 28/16, creating the mandate of a Special Rapporteur on the right to privacy. Special Rapporteurs are independent experts, not UN staff, appointed for renewable three-year terms. The mandate holder:

gathers information on national practices and trends;
conducts country visits at the invitation of governments;
receives communications about alleged violations and raises them with states;
reports annually to the Human Rights Council and the General Assembly, with thematic reports on topics such as health data, gender and privacy, surveillance and children's privacy.

The mandate's page on the OHCHR website lists current and past reports.

How UN standards relate to data protection laws

UN human rights law sets principles; it does not contain a detailed data protection code. Detailed rules come from regional and national instruments:

the Council of Europe's Convention 108 (1981), the first binding international data protection treaty, open to non-European states and modernised by a 2018 protocol ("Convention 108+");
the EU General Data Protection Regulation, discussed in the explainer on GDPR and health research;
national laws, which have spread to a large majority of countries.

The UN system has also adopted its own Personal Data Protection and Privacy Principles (2018) for how UN organisations themselves handle personal data.

Privacy and the Sustainable Development Goals

The SDGs do not mention privacy explicitly, but several targets depend on it. Target 16.10 calls for public access to information and protection of fundamental freedoms. Target 16.9 on legal identity involves identity systems that hold sensitive data. Target 17.18 calls for more disaggregated data, by income, sex, age, race, ethnicity, migratory status and disability, which is exactly the kind of data whose misuse can harm vulnerable groups. Privacy safeguards are what allow such data to be collected with consent and trust.