UNITED NATIONS: GUIDELINES FOR THE REGULATION OF COMPUTERIZED PERSONAL DATA FILES.

Adopted by General Assembly resolution 45/95 of 14 December 1990 The procedures for implementing the standards for computerized personal data files are left to the initiative of each State, subject to the following guidelines:

A. PRINCIPLES CONCERNING THE MINIMUM GUARANTEES TO BE PROVIDED BY NATIONAL LEGISLATION

Information relating to individuals should not be collected or processed by unfair or unlawful methods, nor should it be used for purposes contrary to the purposes and principles of the Charter of the United Nations.

2. Principle of accuracy

The persons responsible for the compilation of files, or those responsible for maintaining them, have the obligation to carry out periodic checks on the accuracy and relevance of the data recorded and to ensure that they are maintained as completely as possible, in order to avoid errors of omission, as well as to update them periodically or when the information contained in a file is used, while they are being processed.

3. Principle of specification of purpose

The purpose to be served by a file and its use in terms of that purpose must be specified, legitimate and, once established, receive a certain amount of publicity or be brought to the attention of the person concerned, so that it is subsequently possible to ensure that:
a) All personal data collected and recorded remain relevant and adequate for the specified purposes;
b) None of the aforementioned personal data is used or disclosed, except with the consent of the person concerned, for purposes incompatible with those specified;
c) The period during which the personal data is stored does not exceed the period that allows the achievement of the specified purposes.

4. Principle of access of the person concerned Anyone who offers proof of his identity has the right to know whether information concerning him is being processed and to obtain it in an intelligible form, without undue cost or delay; and to obtain appropriate corrections or deletions in the case of illegal, unnecessary or inaccurate entries, and, when communicated, to be informed of their recipients. Provision should be made for recourse, if necessary, to the supervisory authority specified below in the principle.
5. Principle of non-discrimination Without prejudice to the restrictive exceptions provided for in principle 6, data that could give rise to unlawful or arbitrary discrimination, including information relating to racial or ethnic origin, color, sex life, political, religious, philosophical or other beliefs, as well as membership of an association or trade union, must not be collected.
6. Power to make exceptions Exceptions to principles 1 to 4 may be authorized only if they are necessary to protect national security, public order, public health or morals, as well as, inter alia, the rights and freedoms of others, especially of persons who are persecuted (humanitarian clause), provided that such exceptions are explicitly specified in a law or equivalent regulation enacted in accordance with the domestic legal system, which expressly sets out their limits and provides for adequate safeguards.
Exceptions to principle 5, concerning the prohibition of discrimination, in addition to being subject to the same safeguards as those prescribed for exceptions to principles 1 to 4, may only be authorized within the limits established in the International Bill of Human Rights and other applicable instruments in the field of the protection of human rights and the prevention of discrimination.
7. Adequate measures should be taken to protect the archives against both natural hazards, such as accidental loss or destruction, and human hazards, such as unauthorized access, fraudulent use of data, or contamination by computer viruses.
8. Supervision and sanctions The law of each country shall designate the authority that, in accordance with its domestic legal system, shall be responsible for supervising the observance of the principles set forth above. This authority shall offer guarantees of impartiality, independence from the persons or agencies responsible for processing and establishing the data, and technical competence. In case of violation of the provisions of national law implementing the above principles, criminal convictions or other sanctions should be provided for, together with appropriate individual remedies.
9. Transborder data flow Where the laws of two or more countries affected by a transborder data flow provide similar safeguards for the protection of privacy, the information should be able to circulate as freely as within each of the territories concerned. In the absence of reciprocal safeguards, undue limitations should not be imposed on such circulation, but only to the extent required for the protection of privacy.
10. Scope of application These principles should be made applicable, in the first instance, to all public and private computerized archives, as well as, by optional extension and subject to appropriate adjustments, to manual archives. Special provisions, also optional, may be made to make all or part of the principles applicable to archives relating to legal persons, especially when they contain some information relating to
individuals.

B. APPLICATION OF THE GUIDELINES TO PERSONAL DATA FILES MAINTAINED BY INTERNATIONAL GOVERNMENTAL ORGANIZATIONS.

These guidelines shall apply to personal data files maintained by international governmental organizations, subject to any adjustments that may be necessary to take into account any differences that may exist between files for internal purposes, such as those concerning personnel management, and files for external purposes, relating to third parties having dealings with the organization. Each organization should designate the legally competent authority to oversee compliance with these guidelines. Humanitarian clause: an exception to these principles may be specifically provided for when the purpose of the file is the protection of the human rights and fundamental freedoms of the person concerned, or humanitarian aid. A similar exception should be provided for in national legislation for international governmental organizations whose organizational agreement does not prevent the implementation of the aforementioned national legislation, as well as for international non-governmental organizations to which this law is applicable.