J. Surveillance, data protection and the right to privacy Article 17 of the International Covenant on Civil and Political Rights prohibits States parties from interfering with the privacy of those within their jurisdiction and requires them to protect those persons by law against arbitrary or unlawful interference with their privacy. Privacy includes information about an individual’s identity, as well as the private life of the person.101 Most States have stepped up security at airports and other places of transit, for instance by collecting biometric data from passengers (such as eye scans and fingerprints), photographs, passport details and the like. States have for a long time provided their security intelligence services with powers of surveillance, including wiretapping and the use of tracking devices. Some States have significantly extended these surveillance powers in recent years. All of these practices involve the collection of information about a person. They therefore limit the privacy of such persons, as well as raising questions about how the data are to be protected. Interference with privacy also arises in the security screening and searching of persons. Any act which has an impact on a person’s privacy must be lawful, i.e., it must be prescribed by law.102 This means that any search, surveillance or collection of data about a person must be authorized by law. The extent to which this occurs must not be arbitrary, which in turn requires that the legislation must not be unjust, unpredictable or unreasonable. The law authorizing interference with privacy must specify in detail the precise circumstances in which the interference is permitted and must not be implemented in a discriminatory manner.103 This does not mean, however, that States enjoy an unlimited discretion to interfere with privacy, since any limitation on rights must be necessary to achieve legitimate purposes and be proportionate to those purposes. Regard must also be had to the obligation of States to protect against the arbitrary exercise of such authorizations. Thus, in Klass v. Germany for example, the European Court of Human Rights stated that it must be satisfied that any system of secret surveillance conducted by the State must be accompanied by adequate and effective guarantees against abuse.104 Where personal information is collected, the data must be protected against unlawful or arbitrary access, disclosure or use. Although jurisprudence on this duty is scarce, the Human Rights Committee, in its general comment N° 16 (1988), has explained that States must take effective measures to ensure that information concerning a person’s private life does not reach 45