Migrant Data Management and Protection
Being aware of our responsibilities in terms of data management and protection is incredibly important.
HSPs can be particularly sensitive because migrants’ information may be particularly targeted by authorities, traffickers, and people from their past that may wish them harm. Even general data from an HSP can potentially be used by authorities to better target their initiatives to reduce the movement of migrants. It can also be used as, or in misinformation or in communications campaigns by anti-migrant groups.
There is considerable information available within the Movement about collection, storage, management and protection of data. Below are three main areas to particularly consider when establishing and operating an HSP.
Ongoing collection and analysis of data, including sex, age and disability disaggregated data
Migration situations often evolve very quickly, and experience in different contexts has shown that the situation of people using services or their demographics can change very rapidly.
- For example, men made up 75% of arrivals to Europe from Turkey in 2015, but by January 2016 women and children accounted for more than 60%.
- Similarly, the Northern Triangle route in Central America saw the number of women and girls nearly double from 2012 to 2017.
This kind of demographic change can have an important impact on the type of services offered and how they are organised and delivered.
Conversely, changes in uptake of services may indicate a change in the kind of issues that migrants are facing, which may be important to understand in order to respond appropriately.
Ongoing collection and analysis of general data about service users – including gender, age, nationality, and disability – can help ensure the HSP remains relevant, continually adapting to the needs of the people using it.
The collection of personal data, including sensitive data, should strictly adhere to IFRC policy
Building and maintaining trust and ensuring the safety of people using the HSP’s services means ensuring that their data is collected responsibly and in line with ethics and good practice. The following are some relevant principles – full guidance is provided in the IFRC Data Protection Policy.
Fairness and legitimacy
Learn more.
Only process personal data where a legitimate basis exists. People should be provided with easily understandable information related to the collection and processing of their data and ideally asked to provide free and fully informed consent.
Information
Learn more.
Information that provides the basis for informed consent includes why the data is being collected, what it will be used for, who will have access to it, how it will be stored and protected, and who to contact with concerns or complaints about data.
Data quality and minimisation
Learn more.
Personal data collected should be adequate, relevant, accurate, and not excessive considering the specified purpose for which the data was collected. This means that data should only be collected if it is strictly needed for the delivery of the service.
Data retention and disposal
Learn more.
Personal data, whether stored on paper or electronically, should be kept no longer than necessary to fulfill the specified purpose for which the data are processed.
The collection of personal data, including sensitive data, should strictly adhere to IFRC policy
Any personal data, such as medical or legal records, – must be adequately protected. This includes technical measures to protect data from hackers but also includes good data hygiene and discipline in the HSP itself.
Social media can be an invaluable tool for helping alert migrants to the existence of services, share information, and answer questions.
However, the use of social media comes with risks as well. The Movement, and other humanitarian service providers, have no control over the privacy policies of social media sites.
It can be difficult to control who accesses these sites, even when they appear to be private, notably on platforms like WhatsApp, and Zoom, for example. As the Facebook-Cambridge Analytica scandal highlighted, social media companies may track behaviour of users, including non-users of their services.
Meta data may also be extracted and shared from these sites that can be used to map migration routes and behaviour and risk vulnerable people being profiled for surveillance and may result in harm or exploitation for commercial purposes.
Key Steps in Data managment and protection
Key Resources
