Chapter 1 - Introduction

Summary

In recent years, the development of new technologies allowing for easier and faster Processing of ever-increasing quantities of Personal Data in an interconnected world has given rise to concerns about possible intrusion into the private sphere of individuals. Regulatory efforts around the globe are ongoing to respond to these concerns.

1.1 Background

In recent years, the development of new technologies allowing for easier and faster Processing of ever-increasing quantities of Personal Data in an interconnected world has given rise to concerns about possible intrusion into the private sphere of individuals. Regulatory efforts around the globe are ongoing to respond to these concerns.

Protecting individuals’ Personal Data is an integral part of protecting their life, integrity and dignity. This is why Personal Data protection is of fundamental importance for Humanitarian Organizations.

In suggesting how data protection principles should be applied by Humanitarian Organizations, this Handbook builds on existing guidelines, working procedures and practices that have been established in Humanitarian Action in the most volatile environments and for the benefit of the most vulnerable victims of armed conflicts, other situations of violence, natural disasters, pandemics and other Humanitarian Emergencies (together ‘Humanitarian Emergencies’). Some of these guidelines, procedures and practices predate the advent and development of data protection laws, but they all are based on the principle of human dignity and the same concept of protection which underpins data protection laws. These guidelines have been set out, notably, in the Professional Standards for Protection Work.¹

1.2 Objective

This Handbook aims to further the discussion launched by the Global Privacy Assembly (GPA) – previously known as the International Conference of Data Protection and Privacy Commissioners (ICDPPC) – with its Resolution on Privacy and International Humanitarian Action² adopted in Amsterdam in 2015. This discussion was relaunched and continued through the GPA Resolution on the Role of Personal Data Protection in International Development Aid, International Humanitarian Aid and Crisis Management³ adopted in 2020, which makes specific reference to the development and publication of the previous editions of this Handbook as one of the main achievements of the cooperation between humanitarian actors and the GPA.

It is not intended to replace compliance with applicable legal norms, or with data protection rules, policies and procedures that a particular organization may have adopted. Rather, the Handbook seeks to raise awareness and assist Humanitarian Organizations in ensuring that they comply with Personal Data protection standards in carrying out humanitarian activities, by providing specific guidance on the interpretation of data protection principles in the context of Humanitarian Action, particularly when new technologies are employed.

This Handbook is designed to assist in the integration of data protection principles and rights in the humanitarian environment. It does not, however, replace or provide advice in relation to the application of domestic legislation on data protection, where this is applicable to a Humanitarian Organization not benefiting from the privileges and immunities generally associated with an International Organization.

Compliance with Personal Data protection standards requires taking into account the specific scope and purpose of humanitarian activities to provide for the urgent and basic needs of vulnerable individuals. Data protection and Humanitarian Action should be seen as compatible, complementary to, and supporting each other. Thus, data protection should not be seen as hampering the work of Humanitarian Organizations; on the contrary, it should be of service to their work. Equally, data protection principles should never be interpreted in a way that hampers essential humanitarian work, and should always be interpreted in a way that furthers the ultimate objective of Humanitarian Action, namely safeguarding the life, integrity and dignity of victims of Humanitarian Emergencies.

The recommendations and guidelines contained in this Handbook are based on some of the most important international instruments dealing with data protection, in particular the following:

• UN General Assembly Resolution 45/95 of 14 December 1990⁴ adopting the Guidelines for the Regulation of Computerized Personal Data Files,⁵ which includes the “humanitarian clause” calling for particular care and flexibility when applying data protection principles in the humanitarian sector;

• the UN Principles on Personal Data Protection and Privacy, adopted by the UN High-Level Committee on Management (HLCM) at its 36th Session on 11 October 2018;⁶

• the International Standards on the Protection of Personal Data and Privacy (The Madrid Resolution) adopted by the ICDPPC in Madrid in 2009;⁷

• The OECD Privacy Guidelines (2013);⁸

• the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108),⁹ including Protocol CETS No. 223 amending the Convention (known as Convention 108+).¹⁰

Other important standards have also been taken into account, in particular:

• recent regulatory developments, insofar as they reflect further development of data protection concepts and principles in light of their application over the years and the challenges generated by new technologies (this includes the updating of Convention 108, as well as the EU General Data Protection Regulation 2016/679 (GDPR));¹¹

• the Resolution on Data Protection and Major Natural Disasters¹² adopted by the ICDPPC in Mexico City in 2011;

• the Resolution on Privacy and International Humanitarian Action adopted by the ICDPPC in Amsterdam in 2015;¹³

• The Resolution on the Role of Personal Data Protection in International Development Aid, International Humanitarian Aid and Crisis Management;¹⁴

• the ICRC Rules on Personal Data Protection (2015, updated and adopted by the ICRC Assembly on 19 December 2019);¹⁵

• the ICRC Professional Standards for Protection Work (2013);¹⁶

• the UNHCR Policy on the Protection of Personal Data of Persons of Concern to UNHCR (2015);¹⁷

• the IOM Data Protection Manual (2010).¹⁸

This Handbook provides recommended minimum standards for the Processing of Personal Data. Humanitarian Organizations may provide for stricter data protection requirements, should they deem it appropriate or be subject to stricter laws at the domestic or regional level.

A few important considerations should be highlighted from the outset:

• The right to privacy has long been recognized globally as a human right,¹⁹ while the right to Personal Data protection is a relatively recent human right that is closely connected to the right to privacy and sets forth conditions for the Processing of data of an identified or identifiable individual. Specific data protection or privacy-related laws and norms have been adopted at national and regional levels in recent years in almost 150 countries,²⁰ and Personal Data protection as a fundamental right is gaining wider acceptance around the world. Accordingly, implementation of Personal Data protection standards, even where not a legal obligation given the privileges and immunities enjoyed by certain Humanitarian Organizations, should be a priority for all Humanitarian Organizations, considering that the main objective of their activities is to work for the safety and dignity of individuals.

• Some Humanitarian Organizations, having a status of International Organizations, enjoy privileges and immunities and do not follow national legislation on Personal Data protection.²¹ Respect for privacy and data protection rules is nevertheless, in many cases, a prerequisite for them to receive Personal Data from other entities, and, therefore, to do their work.

• The exceptional emergency circumstances in which Humanitarian Organizations operate create special challenges regarding data protection. Accordingly, particular care and flexibility is required when applying data protection principles in the humanitarian sector. This need is also reflected in many of the international instruments and standards mentioned above, which include stricter rules for the Processing of Sensitive Data.²²

• The lack of a uniform approach in data protection law to the Personal Data of deceased individuals means that Humanitarian Organizations should adopt their own policies on this matter (for example, by applying the rules applicable to the Personal Data of natural persons to the deceased, insofar as this makes sense). For organizations that do not enjoy immunity from jurisdiction, this question may be regulated by the applicable law.

• The focus of this Handbook is on Personal Data protection, and the application of this area of law to Humanitarian Action. Yet, in armed conflicts and other situations of violence, many threats are collective rather than individual – a village, a community, a specific group of men and women may share the same threats. So just focusing on the proper management of Personal Data may not be sufficient. In some cases, Processing of non-Personal Data may raise specific threats at the collective level. In this respect, a number of initiatives in the humanitarian sector have been focusing on the implications of Processing data more generally for communities and referring, for example, to ‘demographically identifiable information’,²³ or ‘Community Identifiable Information’.²⁴

• Humanitarian Organizations process the Personal Data of different categories of individuals in Humanitarian Emergencies, such as data of affected people and contacts involved in their activities, as well as data of staff and goods/service providers, or even data of donors. While the focus of this Handbook is the Processing of the Personal Data of the beneficiaries of humanitarian programmes, similar considerations apply to the handling of Personal Data of other categories of individuals.

1.3 Structure and approach

Part I of this Handbook applies to all types of Personal Data Processing in Humanitarian Emergencies and provides a detailed analysis of Personal Data protection principles and requirements contextualized in Humanitarian Emergencies. Part II deals with specific types of technologies, technology areas and data Processing situations, and contains a more specific discussion of the relevant data protection issues. The specific Processing scenarios outlined in Part II should always be read with Part I in mind. Defined terms are capitalized throughout this Handbook; the definitions are contained in the at the beginning of the Handbook.

1.4 Target audience

This Handbook is aimed at legal professionals and staff of Humanitarian Organizations involved in Processing Personal Data for the humanitarian operations of their organization, particularly those in charge of advising on and applying data protection standards. It is also addressed to other parties involved in Humanitarian Action or data protection, such as data protection authorities, researchers and academics, private companies wishing to engage in partnerships with Humanitarian Organizations, and any others involved in these activities.