Not just an ‘IT’ issue
Ultimately, data protection is not just about legal, or technological fixes, the experts say. It’s about people; protecting them from harm that could be caused if data were misused or abused. Data protection, therefore, can no longer be seen by humanitarian organizations as another “IT” or compliance issue for the information technology teams or the lawyers to fix.
Just as humanitarian workers are trained to understand and navigate the risks of the physical world in a crisis, they now need to understand the dynamics of the digital world. As more and more people around the world connect digitally, protecting people when they are vulnerable also means protecting them in the virtual world.
This kind of operational awareness about digital threats needs to be part and parcel of daily operations, from the field to HQ, the experts say. “When we think about data protection it’s really about how the physical world and the digital world connect,” says Heather Leson, who leads Data Literacy at the International Federation of Red Cross and Red Crescent Societies. “So when we are think about protecting people in the physical world, we have to think about protecting their data, their digital identities, as well.”
This is one reason the IFRC has joined with the Centre for Humanitarian Data and other organizations to raise awareness about data protection and improve practices through initiatives such as the Data Literacy Consortium, a clearinghouse for best practices, disuccion and case studies.
The ICRC, meanwhile, has also taken a leading role, releasing the Handbook on data protection in humanitarian action and several other guidance documents, as well as hosting regular debates and online events on the issue and developing a training and certification programme for Data Protection Officers in Humanitarian Action.
Increasing “data literacy” at all levels is critical because it’s not just a question of protecting data after it is collected. Well before any data-driven project is conceived, there are ethical, legal and humanitarian questions to consider. Do the people involved really understand the risks? Will they have a say over how their data is used?
For Leson, part of the answer lies in adopting a far more inclusive, participatory approach. “When we think about data protection, this is really about people,” she says. “Affected communities have a right and a need to be able to decide what data is collected, how it’s used and why, and then, to get feedback about how that data was collected and used.”