data localisation requirements, unless such measures are justifiable and compatible with international human rights law and standards. Principle 41. Privacy and communication surveillance 1. States shall not engage in or condone acts of indiscriminate and untargeted collection, storage, analysis or sharing of a person’s communications. 2. States shall only engage in targeted communication surveillance that is authorised by law, that conforms with international human rights law and standards, and that is premised on specific and reasonable suspicion that a serious crime has been or is being carried out or for any other legitimate aim. 3. States shall ensure that any law authorising targeted communication surveillance provides adequate safeguards for the right to privacy, including: a. b. c. d. e. f. the prior authorisation of an independent and impartial judicial authority; due process safeguards; specific limitation on the time, manner, place and scope of the surveillance; notification of the decision authorising surveillance within a reasonable time of the conclusion of such surveillance; proactive transparency on the nature and scope of its use; and effective monitoring and regular review by an independent oversight mechanism. Principle 42. Legal framework for the protection of personal information 1. States shall adopt laws for the protection of personal information of individuals in accordance with international human rights law and standards. 2. The processing of personal information shall by law be: a. b. c. d. e. f. with the consent of the individual concerned; conducted in a lawful and fair manner; in accordance with the purpose for which it was collected, and adequate, relevant and not excessive; accurate and updated, and where incomplete, erased or rectified; transparent and disclose the personal information held; and confidential and kept secure at all times. 26