What Are Digital Rights? International Human Rights Law Explained
- Edmarverson A. Santos
- 11 hours ago
- 14 min read
Introduction
Digital rights are human rights exercised through digital technologies: privacy, freedom of expression, association, and access to information as they apply to the internet, mobile networks, and the data those systems generate. The term does not name a new legal category. In international law, digital rights are the existing guarantees of the Universal Declaration of Human Rights and the human rights treaties, read into a technological environment their drafters never saw.
The United Nations Human Rights Council settled the basic principle in 2012 when it affirmed that the same rights people have offline must also be protected online (UN Human Rights Council, 2012). That formula, repeated since in General Assembly resolutions, regional instruments, and national charters, is the foundation of the entire field.
It is also where the easy part ends. Applying a treaty drafted in 1966 to bulk interception of communications, platform content moderation, and nationwide internet shutdowns raises questions the offline rules answer only partly. Courts in Strasbourg, Luxembourg, and Abuja have started answering them, and a wave of declarations has tried to consolidate the results.
The framework that has emerged has three layers: binding treaty law, judicial interpretation, and a growing body of soft law. Each carries different legal weight. Confusing them is the most common error in public debate about digital rights and human rights, and keeping them apart is the main task of this area of law.
1. Digital Rights in International Law: Definition and Legal Basis
1.1 Existing rights applied online, not a new catalogue
No treaty called a "digital rights convention" exists. The legal basis lies in instruments adopted decades before the commercial internet. Articles 12 and 19 of the Universal Declaration of Human Rights protect privacy and free expression (UN General Assembly, 1948). Articles 17 and 19 of the International Covenant on Civil and Political Rights, adopted in 1966 and in force since 1976 with more than 170 states parties, turn those guarantees into binding obligations.
The treaty text made the extension to digital technology straightforward. Article 19(2) of the ICCPR protects the freedom to seek, receive, and impart information "regardless of frontiers" and through "any other media" of one's choice. The UN Human Rights Committee confirmed in General Comment No. 34 that this wording covers internet-based and electronic modes of expression, and that states must take account of how far the internet has changed communication practices when regulating it (UN Human Rights Committee, 2011).
In practice, the catalogue litigated under the heading of digital rights includes freedom of expression online, the right to privacy online, data protection, freedom of association and peaceful assembly organized through networks, and non-discrimination in access to digital services (Media Defence, 2020). Economic and social rights have a digital dimension too: education, health care, and work increasingly presuppose connectivity.
1.2 The limits of the offline–online equivalence principle
The equivalence formula understates how much the analysis changes online. The Office of the High Commissioner for Human Rights observed that digital surveillance is no longer limited by scale or duration: a state can now retain and search the communications of an entire population at negligible cost (OHCHR, 2014). Aggregated metadata, the records of who contacted whom, when, and from where, can reveal more than the content it describes. Offline doctrine on searches of correspondence was never built for that.
Some legal systems have responded by recognizing genuinely new entitlements rather than stretching old ones. The EU Charter of Fundamental Rights treats data protection, in Article 8, as a right distinct from privacy. The Court of Justice of the European Union derived a right to have search results de-referenced from EU data protection law in the Google Spain judgment (CJEU, 2014b). These developments belong to particular legal orders, not yet to general international law. Distinguishing what the ICCPR already requires from what reformers propose is essential to any accurate account of digital rights in international law.
2. Freedom of Expression Online
2.1 Article 19 of the ICCPR and General Comment No. 34
Article 19 of the ICCPR has two operative parts. Article 19(1) protects the right to hold opinions without interference, and admits no restriction at all. Article 19(2) protects expression in every form, and General Comment No. 34 applies it expressly to blogs, websites, search engines, and other internet-based platforms (UN Human Rights Committee, 2011). States are also directed to foster the independence of new media and to ensure access to them, which frames access as part of the expressive guarantee rather than a separate policy goal.
Freedom of expression online therefore covers the speaker, the publisher, and the audience. The right to receive information gives readers and listeners their own claim when a state blocks a website, a point that matters in litigation because the censored author is often outside the jurisdiction.
2.2 The three-part test for restrictions
Article 19(3) permits restrictions only when three cumulative conditions are met. The restriction must be provided by law, meaning a norm precise enough for people to foresee its application. It must pursue one of the listed legitimate aims: respect for the rights or reputations of others, or the protection of national security, public order, public health, or morals. And it must be necessary and proportionate, which requires the least intrusive means available.
Each limb does real work online. Vague offenses fail the legality requirement, a recurring problem with recent cybercrime statutes: many criminalize loosely defined conduct such as "false news" or "insulting" content, and are then applied against journalists and critics (Bussiek, 2022). Pretextual invocations of national security fail the legitimate aim requirement. Necessity fails whenever a state blocks an entire platform to suppress a single item of content.
2.3 Website blocking and intermediary liability in European case law
The European Court of Human Rights confronted wholesale blocking in Ahmet Yıldırım v Turkey. A Turkish court, seeking to block one site that insulted the memory of Atatürk, ordered access to all of Google Sites blocked, which extinguished the applicant's unrelated academic website. The Court found a violation of Article 10 of the European Convention: the measure had no adequate legal framework, was not targeted, and amounted to collateral censorship (ECtHR, 2012). The judgment established that blanket blocking is presumptively disproportionate, a principle courts outside Europe now cite.
Liability of intermediaries for user content raises the opposite risk: platforms that fear liability delete lawful speech to be safe. In Delfi AS v Estonia, the Grand Chamber accepted that a commercially run news portal could be held liable for anonymous reader comments amounting to hate speech and threats, without violating Article 10 (ECtHR, 2015). The holding is narrower than it first appears. The following year the Court confined it, finding a violation where Hungarian courts imposed liability for merely offensive, non-hateful comments (ECtHR, 2016). The dividing line is the character of the content: clearly unlawful speech may ground strict duties; vulgar criticism may not.
3. The Right to Privacy Online
3.1 From Article 17 of the ICCPR to the digital age resolutions
Article 17 of the ICCPR prohibits arbitrary or unlawful interference with privacy, family, home, or correspondence. "Correspondence" has been read to cover all forms of communication, including email and messaging, so the interception of digital communications is an interference requiring justification under the same standards of legality, necessity, and proportionality that govern expression.
The 2013 disclosures of mass surveillance programs by intelligence agencies moved the question to the top of the UN agenda. The General Assembly responded with resolution 68/167 on the right to privacy in the digital age, expressing deep concern that surveillance conducted on a mass scale may violate Article 17 (UN General Assembly, 2013). The OHCHR report that followed concluded that governments must show that bulk practices are actually necessary and proportionate, not merely useful, and that secret rules and secret interpretations of law do not satisfy the legality requirement (OHCHR, 2014).
Privacy also protects expression. A person who assumes every message is logged speaks differently. This chilling effect is why surveillance cases are often argued under both Articles 17 and 19 together.
3.2 Mass surveillance before European courts
Two judgments define the current judicial position. In Digital Rights Ireland, the CJEU invalidated the EU Data Retention Directive, which had required providers to retain everyone's communications metadata for up to two years. Retention detached from any suspicion, covering the whole population, exceeded what strict necessity allows (CJEU, 2014a).
In Big Brother Watch and Others v the United Kingdom, the Grand Chamber of the European Court of Human Rights reviewed the UK bulk interception regime revealed in 2013. It found violations of Articles 8 and 10, principally because authorization and oversight safeguards were inadequate and journalistic material was insufficiently protected. Yet the Court also held that bulk interception is not, as such, incompatible with the Convention, provided "end-to-end safeguards" accompany every stage of the process (ECtHR, 2021). Critics reasonably object that this concedes the central point: population-scale collection is treated as lawful in principle, with the argument shifted to procedure.
Outside these systems, the gap between norm and practice is wider. In Zimbabwe, interception of private communications does not require a judicial warrant; a government minister may order it (Bussiek, 2022). Surveillance without independent authorization fails the legality requirement before proportionality is even reached.
3.3 Data protection, encryption, and anonymity
Data protection gives privacy its operational rules: lawful grounds for processing, purpose limitation, and rights of access and correction. The Council of Europe's Convention 108 of 1981 was the first binding international treaty in the field and is open to states outside Europe; an amending protocol modernized it in 2018 (Council of Europe, 1981; Council of Europe, 2018). The EU General Data Protection Regulation is the most influential regional model and has shaped legislation on every continent (European Union, 2016).
Encryption and anonymity have their own place in the framework. The UN Special Rapporteur on freedom of expression concluded that they provide the privacy and security necessary for people to exercise their rights to opinion and expression in the digital age, and that restrictions on them, such as backdoor mandates or blanket prohibitions on anonymous use, must satisfy the same three-part test (Kaye, 2015). A general ban on encryption fails that test because it disables the security of everyone to reach the communications of a few.
4. Internet Access and Human Rights
4.1 Access as an enabler of rights
Is there a human right to internet access? Under current treaty law, not as a free-standing entitlement. The better description is that access is an enabler: without it, the rights to expression, information, education, and participation cannot be exercised in the forms modern life assumes. The Special Rapporteur's influential 2011 report framed it this way and urged states to make the internet widely available, accessible, and affordable (La Rue, 2011). The Human Rights Council has since repeatedly called upon states to facilitate access (UN Human Rights Council, 2012).
The distance between that aspiration and reality is measurable. In sub-Saharan Africa, about 495 million people, 46 percent of the population, subscribed to mobile phones in 2020, and the cost of data remains among the highest in the world relative to income (Bussiek, 2022). Access divides track existing inequalities of income, gender, and geography, which is why internet access and human rights are increasingly discussed together with the right to non-discrimination.
National and regional instruments are moving faster than treaty law. The EU's digital decade targets include connectivity for all, and the Spanish Charter of Digital Rights treats access as a named right (Car, 2022; Government of Spain, 2021). If enough states legislate in this direction, the practice could eventually harden into customary obligation. It has not yet.
4.2 Internet shutdowns as a violation of international law
Internet shutdowns are the clearest case of state conduct condemned by the framework. In 2016, the Human Rights Council condemned unequivocally measures to intentionally prevent or disrupt access to or dissemination of information online in violation of international human rights law (UN Human Rights Council, 2016). General Comment No. 34 had already stated that generic bans on the operation of sites and systems are incompatible with Article 19(3) (UN Human Rights Committee, 2011).
A shutdown fails every limb of the three-part test. There is rarely a clear legal basis; the stated aims, typically public order during protests or elections, are usually pretexts for suppressing scrutiny; and a measure that silences an entire population to address the speech of a few can never be the least restrictive means. Shutdowns also inflict indiscriminate economic harm, cutting off payments, health services, and emergency communication.
The ECOWAS Community Court of Justice applied this reasoning in Amnesty International and Others v The Togolese Republic, holding that Togo's 2017 shutdown during protests violated freedom of expression under Article 9 of the African Charter, and treating internet access as a right derivative of expression that states may not suspend at will (ECOWAS Court of Justice, 2020). The judgment matters because it came from a sub-regional court ordering a state to guarantee non-repetition, not from a UN body speaking in general terms. Shutdowns nonetheless remain routine around elections in parts of Africa and Asia (Bussiek, 2022).
5. Regional Declarations and National Charters
The past decade produced a series of instruments that restate human rights in the digital age in consolidated form. The African Commission on Human and Peoples' Rights adopted a resolution on internet freedom in 2016 and then, in 2019, a revised Declaration of Principles on Freedom of Expression and Access to Information in Africa, which addresses online expression, access, privacy, and shutdowns in detail (ACHPR, 2016; ACHPR, 2019).
In Europe, the European Declaration on Digital Rights and Principles for the Digital Decade was signed by the Commission, Parliament, and Council in December 2022. It is organized around six chapters, from putting people at the center of digital transformation to sustainability, and it expressly confers no new rights: it restates the existing EU acquis as adapted to the digital environment, with an annual monitoring mechanism (Car, 2022; European Union, 2023). Spain's 2021 Charter of Digital Rights takes the same descriptive approach at national level, while adding forward-looking entries such as pseudonymity and rights concerning digital legacy (Government of Spain, 2021). At the global level, the Global Digital Compact adopted by the General Assembly in 2024 anchors commitments on connectivity, data governance, and artificial intelligence in international human rights law (United Nations, 2024).
None of these instruments binds anyone. Their value lies elsewhere: they give courts and legislators an agreed vocabulary, they commit governments politically to positions that can be quoted back to them, and over time they generate the state practice from which customary law is made. Treating them as if they already created enforceable rights overstates the law; dismissing them as paper underestimates how legal change in this field has actually happened.
6. Platforms, Business Responsibility, and the Enforcement Gap
Human rights treaties bind states. Yet most decisions affecting expression and privacy online are made by companies: platforms moderating content, telecommunications operators executing shutdown orders, and firms selling surveillance tools. The UN Guiding Principles on Business and Human Rights answer this partly, articulating a corporate responsibility to respect human rights through due diligence and remediation, alongside the state duty to protect against corporate abuse (United Nations, 2011). The responsibility is not itself legally binding.
The practical dilemmas are sharpest where lawful government demands conflict with users' rights. Brown and Korff, writing for the Global Network Initiative, mapped what companies receiving takedown, data handover, or shutdown orders can do within the law: demand written legal authority, interpret orders narrowly, disclose transparently, and challenge overbroad demands in court (Brown and Korff, 2012). Telecommunications operators are especially exposed because they hold licenses at government pleasure; in 2019 Zimbabwe's largest operator shut down internet services under protest, stating it faced legal compulsion (Bussiek, 2022).
This is the enforcement gap at the center of the field. A user whose account is wrongly deleted has no international forum; a foreign national surveilled from abroad struggles to establish jurisdiction; a population cut off by a shutdown may wait years for a regional judgment. The doctrinal frontier of digital rights is therefore less about recognizing new rights than about extending old remedies: horizontal application to private power, and extraterritorial application to cross-border surveillance.
Also read
Conclusion
The claim that international law is silent about the internet is false. The ICCPR's texts on expression and privacy, General Comment No. 34, the digital age resolutions, and a growing body of judgments from Strasbourg, Luxembourg, and Abuja supply a workable legal framework. Its core is a single discipline: any interference with rights online must be prescribed by clear law, pursue a genuine listed aim, and be necessary and proportionate. Shutdowns, blanket blocking, warrantless interception, and indiscriminate data retention all fail that discipline, and courts have said so.
The deficits lie elsewhere. Enforcement depends on courts most affected people cannot reach. Nearly half of humanity's access to the digital public sphere depends on affordability that treaty law does not yet guarantee. And the actors with the greatest daily power over online rights are companies the treaties do not bind.
Three questions remain genuinely open: whether bulk surveillance can ever satisfy proportionality or only be proceduralized, whether internet access will harden from enabler into an autonomous right, and whether platform obligations will become binding law rather than declared responsibility. The declarations of the past decade will not settle them. Courts applying the old treaties strictly will.
References
African Commission on Human and Peoples' Rights (2016) Resolution on the Right to Freedom of Information and Expression on the Internet in Africa, ACHPR/Res.362(LIX), adopted at the 59th Ordinary Session, November 2016.
African Commission on Human and Peoples' Rights (2019) Declaration of Principles on Freedom of Expression and Access to Information in Africa. Banjul: African Commission on Human and Peoples' Rights.
Brown, I. and Korff, D. (2012) Digital Freedoms in International Law: Practical Steps to Protect Human Rights Online. Global Network Initiative.
Bussiek, H. (2022) Digital Rights Are Human Rights: An Introduction to the State of Affairs and Challenges in Africa. Windhoek: fesmedia Africa, Friedrich-Ebert-Stiftung.
Car, P. (2022) European Declaration on Digital Rights and Principles. Briefing PE 733.518. Brussels: European Parliamentary Research Service.
Council of Europe (1981) Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS No. 108, 28 January 1981.
Council of Europe (2018) Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, CETS No. 223, 10 October 2018.
Court of Justice of the European Union (2014a) Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others, Joined Cases C-293/12 and C-594/12, judgment, 8 April 2014.
Court of Justice of the European Union (2014b) Google Spain SL and Google Inc. v Agencia Española de Protección de Datos and Mario Costeja González, Case C-131/12, judgment, 13 May 2014.
ECOWAS Community Court of Justice (2020) Amnesty International and Others v The Togolese Republic, Suit No. ECW/CCJ/APP/61/18, judgment, 25 June 2020.
European Court of Human Rights (2012) Ahmet Yıldırım v Turkey, Application No. 3111/10, judgment, 18 December 2012.
European Court of Human Rights (2015) Delfi AS v Estonia, Application No. 64569/09, Grand Chamber judgment, 16 June 2015.
European Court of Human Rights (2016) Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt v Hungary, Application No. 22947/13, judgment, 2 February 2016.
European Court of Human Rights (2021) Big Brother Watch and Others v the United Kingdom, Applications Nos. 58170/13, 62322/14 and 24960/15, Grand Chamber judgment, 25 May 2021.
European Union (2016) Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation), OJ L 119, 4 May 2016.
European Union (2023) European Declaration on Digital Rights and Principles for the Digital Decade, OJ C 23, 23 January 2023.
Government of Spain (2021) Charter of Digital Rights. Madrid: Government of Spain.
International Covenant on Civil and Political Rights (1966) adopted 16 December 1966, entered into force 23 March 1976, 999 UNTS 171.
Kaye, D. (2015) Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, A/HRC/29/32, 22 May 2015.
La Rue, F. (2011) Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, A/HRC/17/27, 16 May 2011.
Media Defence (2020) Summary Modules on Litigating Digital Rights and Freedom of Expression Online. London: Media Defence.
OHCHR (Office of the United Nations High Commissioner for Human Rights) (2014) The Right to Privacy in the Digital Age, A/HRC/27/37, 30 June 2014.
UN General Assembly (1948) Universal Declaration of Human Rights, Resolution 217 A (III), 10 December 1948.
UN General Assembly (2013) The Right to Privacy in the Digital Age, A/RES/68/167, 18 December 2013.
UN Human Rights Committee (2011) General Comment No. 34: Article 19, Freedoms of Opinion and Expression, CCPR/C/GC/34, 12 September 2011.
UN Human Rights Council (2012) The Promotion, Protection and Enjoyment of Human Rights on the Internet, A/HRC/RES/20/8, 5 July 2012.
UN Human Rights Council (2016) The Promotion, Protection and Enjoyment of Human Rights on the Internet, A/HRC/RES/32/13, 1 July 2016.
United Nations (2011) Guiding Principles on Business and Human Rights. New York and Geneva: Office of the United Nations High Commissioner for Human Rights.
United Nations (2024) Global Digital Compact, annexed to the Pact for the Future, A/RES/79/1, 22 September 2024.
