My proposed draft of IBOR (not yet a petition as I think we should try to get bigger organisations to weigh in):
1) Right to freedom of speech, with;
1a) right of reply (confers immunity to libel, slander, etc lawsuits)
1b) neutral hosting requirement (IE cannot censor based on political opinions, views etc otherwise becomes liable for slanderous, copyrighted etc content posted by users as it signals they can moderate)
2) Right to privacy, except;
2a) When a warrant is issued by a publicly electable judge in a transparent court (secret courts are explicitly prohibited), subject to periodic review of the approved warrants (to ensure they are not just being rubberstamped without question)
2b) Unless compliance is practically impossible (EG a generally unbreakable encryption algorithm means you have no obligation to 'crack' the algorithm to comply with the warrant, etc).
3) Reasonable right of access (governments, corporations, are not allowed to impede your access to the internet and should make reasonable accomodations to support access, however this isn't carte blache for them to bend over backwards, IE you're still expected to pay, you can't demand they install costly infrastructure - it just means they can't generally block or throttle your access as an indirect means of censorship, or demand unusually high costs in comparison to the average, etc).
4) Right of ownership/right of repair (AKA right to own the device you buy, for example, companies can't just install a physical backdoor and then seal it up with T&Cs stating you don't 'truly' own the device, even if you paid a lump sum for it; you're allowed to reverse engineer it, take it apart, repair, fix, modify it etc which allows you to remove hardware based backdoors)
5) Right of public utility (if a thing (EG website) is publicly viewable, or it's contents are publicly well known, then by rights you must be given access, and cannot be censored from participating, if it behaves like or is a public utility).
I think points 1 and 2 are bare minimum. Points 3 and 4 are 'practically mandatory' because without them, censorship would simply occur indirectly (rather than a company 'obviously' censoring you, they would 'inobviously' censor you, EG give (falsified) service errors, cause problems, or alternatively spy on you via hardware backdoors etc).
5 is a mildly redundant provision (technically, it's 1 couched in different terms), but it's there as an explicit counter to the 'but we're a private company'. If it walks like a public utility, and quacks like a public utility, then goddamn, it's a public utility.