Google should immediately halt its decision to establish a new Cloud region in Saudi Arabia until it can clearly outline steps to mitigate adverse human rights abuses, 39 human rights and digital privacy rights organizations and individuals, including Human Rights Watch, said in a joint statement today.
In December 2020, Google announced an agreement with Saudi Aramco to set up a Google Cloud region in Saudi Arabia and offer Enterprise Cloud services. The Google Cloud Platform is one of the largest data storage and cloud computing services in the world. While Google publishes information about how it handles government requests for customer information and reports when requests are made through formal channels, Saudi Arabia’s recent track record makes it an unsafe country to handle Google Cloud services. The Saudi government represses all public dissent, and its notorious justice system flagrantly violates due process rights. It has a history of alleged espionage and infiltration of technology platforms, and of using cyber surveillance software to spy on dissidents.
“Saudi authorities have repeatedly shown that they have zero regard for the privacy rights of Saudi citizens and residents and will go to great lengths to obtain their private communications with no inhibition or repercussions,” said Michael Page, deputy Middle East director at Human Rights Watch. “Google should not ignore Saudi Arabia’s dangerous contempt for the rule of law and halt its Cloud region in the country if it cannot publicly explain how it will mitigate these risks.”
Google has a responsibility to respect human rights, regardless of any country’s willingness to fulfill its own human rights obligations. The company’s statement on human rights asserts its commitment “to respecting the rights enshrined in the Universal Declaration of Human Rights and its implementing treaties, as well as upholding the standards established in the United Nations Guiding Principles on Business and Human Rights (UNGPs) and in the Global Network Initiative Principles (GNI Principles) across all of its products, including Cloud.
In January 2021, Access Now and the Canadian Internet Policy and Public Interest Clinic (CIPPIC) wrote an open letter requesting information on the due diligence process that Google has carried out to understand the potential impact on human rights, the type of user data that will be stored and processed in the Saudi cloud, the security measures to protect this data, the legal standards that Saudi Arabia has met to be trusted with securing the information stored, and the type of access that the Saudi government will have to this data.
Human Rights Watch wrote to Google in February 2021 highlighting these and related concerns, including asking how Google will vet employees who will have access to information stored in the Saudi Arabia Cloud region and how they will respond to authorities’ requests for user data that are legal under Saudi law but do not comply with international human rights standards.
In separate replies, Google reiterated its commitment to human rights, stated that an independent human rights assessment for the Google Cloud region in Saudi Arabia had been conducted, and that the company took steps to address matters that were identified, but Google did not specify what those steps were.
The UNGPs specify that human rights due diligence should involve meaningful consultation with potentially affected groups and other relevant stakeholders, and that companies should communicate how impacts are being addressed.
The Middle East and North Africa digital rights organization SMEX also wrote to Google to express concerns about what data protection policies will apply to data hosted in Saudi Arabia, but has yet to receive a reply.
The groups say in their joint statement that Google should halt the establishment of the new Cloud region until it has conducted a thorough due diligence process that meaningfully engages with potentially affected groups and provides concrete steps to address the adverse human rights impact. Additionally, they say that Google should outline the types of government requests that are inconsistent with human rights norms concerning the Cloud region and that the company will not comply with.
List of Signatories:
Organizations:
1. 7amleh – The Arab Center for Social Media Advancement
2. 7iber
3. Access Now
4. ALQST for Human Rights
5. Amnesty International
6. Association for Progressive Communications (APC)
7. Canadian Internet Policy and Public Interest Clinic (CIPPIC)
8. Center for Democracy and Human Rights in Saudi Arabia
9. Democracy for the Arab World Now (DAWN)
10. Digital Action
11. Electronic Frontier Foundation
12. Fantsuam Foundation
13. Freedom Forward
14. Front Line Defenders
15. Heartland Initiative
16. Human Rights Watch
17. International Center for Not-for-Profit Law (ICNL)
18. Iraqi Network for Social Media (INSM)
19. Jeem
20. Jokkolabs Banjul
21. Jordan Open Source Association
22. Masar
23. Media Matters for Democracy
24. MENA Rights Group
25. Mnemonic
26. Oxford Internet Institute (OII)
27. PEN America
28. Ranking Digital Rights
29. SMEX
30. Tahrir Institute for Middle East Policy (TIMEP)
31. Yemen Relief and Reconstruction Foundation (YRRF)
Individuals:
1. Abir Ghattas
2. Afef Abroughui
3. Joey Shea
4. Mahmoud Ghzayel
5. Rima Sgheir
6. Sarah Aoun
7. Wafaa Ben Hassine
8. Wafaa Haikal