Handbook on Data Protection in Humanitarian Action

Published as part of the Brussels Privacy Hub (BPH) and International Committee of the Red Cross (ICRC)'s Data Protection in Humanitarian Action project, this resource is designed for the staff of humanitarian organisations involved in processing personal data (of beneficiaries) as part of humanitarian operations, particularly those in charge of advising on and applying data protection standards. The handbook builds on existing guidelines, working procedures, and practices established in humanitarian action in volatile environments and for the benefit of victims of armed conflicts, other situations of violence, natural disasters, pandemics, and other humanitarian emergencies. It seeks to help humanitarian organisations comply with personal data protection standards by raising awareness and providing specific guidance on the interpretation of data protection principles in the context of humanitarian action, particularly when new technologies are employed.

As ICRC explains, working primarily in humanitarian emergencies, humanitarian organisations operate in situations where the rule of law may not be fully in force. In such situations, there may be limited, if any, access to justice and respect of the international human rights framework. In addition, personal data protection legislation may be embryonic or non-existent, or not entirely enforceable. An individual's right to personal data protection is not absolute, and should be considered in relation to the overall objective of protecting human dignity. It should be balanced with other fundamental rights and freedoms, in accordance with the principle of proportionality.

As noted here, data protection and humanitarian action should be seen as compatible, complementary to, and supporting of each other. Thus, data protection should not be seen as hampering the work of humanitarian organisations; on the contrary, it should be of service to their work. Equally, data protection principles should not be interpreted in a way that hampers essential humanitarian work, and should always be interpreted in a way that furthers the ultimate objective of safeguarding the life, integrity, and dignity of victims of humanitarian emergencies.

A skeletal table of contents follows:

Part I - General Considerations
Chapter 1: Introduction
Chapter 2: Basic Principles of Data Protection
Chapter 3: Legal Bases for Personal Data Processing
Chapter 4: International Data Sharing
Chapter 5: Data Protection Impact Assessments (DPIAS)

Part II - Specific Processing Situations and Technologies
Chapter 6: Data Analytics and Big Data
Chapter 7: Drones/UAVs [Unmanned Aerial Vehicles] and Remote Sensing
Chapter 8: Biometrics
Chapter 9: Cash Transfer Programmes
Chapter 10: Cloud Services
Chapter 11: Mobile Messaging Apps

Appendix I: Template for a DPIA Report
Appendix II: Workshop Participants