Regulating surveillance during occupation through core data protection principles

Surveillance has become an integral aspect of modern occupation situations. Yet, the law of occupation lacks explicit provisions for protecting the information of occupied populations. In contrast, international and regional data protection frameworks offer detailed rules for regulating surveillance but are either non-binding or have limited jurisdictional scope in occupation contexts. This gap may be bridged by international human rights law (IHRL), whose jurisprudence extensively incorporates core data protection principles and is widely recognised as applicable in occupation settings. This article examines whether, to what extent, and under what circumstances core data protection principles can provide effective and feasible tools for protecting the information of occupied populations. It organises these principles into three pillars: data subject involvement, data controller obligations, and accountability. It argues that the potential of the data subject involvement principle is largely undermined by practical and security-related restrictions during occupation. Default obligations imposed on data controllers thus assume importance, but they require contextual and good faith application, which underscores the importance of the accountability pillar. Arguing that traditional top-down accountability models envisaged under IHRL are ineffective in occupation settings, the article instead proposes a polycentric accountability model to ensure effective application of core principles during occupation.