...The report – which examines compliance by Facebook, Google, LinkedIn, Microsoft, and Yahoo – shows some signs of progress, such as the implementation of more systematic policies for how to respond to government requests and examples of how companies were able to minimize harm or be more transparent to users. Some of these strategies have now become industry-wide best practice, like the publication of transparency reports on how companies have responded to government requests for user data. 

But many challenges remain, particularly with assessing companies on how they protect privacy in a post-Snowden era. We have almost no information to assess how they are responding to specific national security requests, since companies are often prohibited from disclosing them in the United States and elsewhere. 

GNI is a work in progress; the tension between corporate interests and human rights is ever-present and evolving, and the report notes recommendations for improving company practices. But companies that have joined the GNI have at least shown a willingness to open up their operations to some external scrutiny...