New Data Innovation Projects: Data Privacy and Data Protection 23 September 2016 Mila Romanoff, Data Privacy and Legal Specialist, UN Global Pulse www.unglobalpulse.org

Available at http://www.unglobalpulse.org/privacy-and-data-protection DATA PRIVACY & DATA PROTECTION PRINCIPLES RIGHT TO USE SPECIFIC PURPOSE OF USE & PURPOSE COMPATABILITY INDIVIDUAL PRIVACY DATA SENSITIVITY DATA SECURITY DATA MINIMISATION DATA RETENTION DATA QUALITY DUE DILIGENCE ON COLLABORATORS RISK MITIGATION: RISK/HARM AND BENEFIT ASSESSMENT Based on the UN Resolution 45/95 See more at http://www.unglobalpulse.org/privacy-and-data-protection-principles Available at http://www.unglobalpulse.org/privacy-and-data-protection

DATA PRIVACY & DATA PROTECTION PRINCIPLES RIGHT TO USE: use data that has been obtained by lawful and fair means, including, where appropriate, with the knowledge or consent of the individual whose data is used PURPOSE SPECIFICATION & COMPATABILITY: ensure, to the extent possible, that all of the data we use for project purposes is adequate, relevant and not excessive in relation to the legitimate and fair purposes for which the data was obtained INDIVIDUAL PRIVACY: do not use personal data or the content of private communications, without the knowledge or proper consent of the individual; do not attempt to knowingly and purposely re-identify de-identified data, and we make all reasonable efforts to prevent any unlawful and unjustified re-identification. DATA SENSITIVITY: employ stricter standards of care while conducting research among vulnerable populations and persons at risk, children and young people, and any other sensitive data DATA SECURITY: ensure reasonable and appropriate technical and organisational safeguards are in place to prevent any unauthorised disclosure or breach of data. DATA MINIMISATION: ensure the data use is limited to the minimum necessary DATA RETENTION: ensure that the data used for a project is being stored only for the necessary duration and any retention of it is justified DATA QUALITY AND ACCOUNTABILITY: design, carry out, report and document our activities with adequate accuracy and openness OUR COLLABORATORS: require that our collaborators are acting in compliance with relevant law, data privacy and data protection standards and the United Nations’ global mandate RISK MITIGATION: RISKS/ HARMS & BENEFITS ASSESSMENT: perform a risk assessment and implement appropriate mitigation processes before any new or substantially changed project is undertaken.

GLOBAL PULSE PRIVACY INNOVATION: RISKS, HARMS and benefits ASSESSMNET TOOL What does it do? Helps to make a decision whether the project is ok to launch How? TWO – part process Before a new or substantially changed purpose of data use Evaluate the benefits of your data use Understand and assess the likelihood of the risks Check for all possible harms Ensure that Risks and Harms are not Disproportionate to the Benefits Specifics? New Data Sources Addresses needs of humanitarian and development practitioners Aims to be practical and easy to implement on the ground Considers privacy & ethics Takes into account harms, including group harms Who? Project Managers and Non – Privacy Experts Encourages a multi- disciplinary team work Include a multi-disciplinary team

RISK MANAGEMENT: RISKS/HARMS AND BENEFITS ASSESSMENT

Risk assessment is an accountability and due diligence tool RISK MANAGEMENT: RISKS/HARMS AND BENEFITS ASSESSMENT KEY POINTS TO REMEMBER: Risk assessment is an accountability and due diligence tool Should be based on honest and informed answers There is no “zero” risk, but we can minimize risks It’s not only about privacy and legal compliance Think of the likely harms to individual; groups organization or State Risks and harms must be less than benefits

PART 3.5: ASSESS RISKS AND HARMS Identify risks Identify harms and influence factors

HARMS/NEGATIVE EFFECTS INFLUENCE FACTORS Reputational Economic/financial Surveillance Discrimination Persecution Change of law, norms, ethics Human Rights violations Public Distrust Disadvantage in competition Instability Revelation of state information etc. . Geocultural Social, Economic, Political Instability Legal/Regulatory Use of sensitive data (even if anonymised) Who is conducting a project? What is the purpose? Who will have access to/utilize the results of the project? Who will benefit? etc.

PART: 3.5 ASSESS RISKS AND HARMS Identify risks Identify harms and influence factors Consider likelihood of risks’ occurrence, magnitude and severity of harms Identify who can be affected by the risks and harms

PART 7: Decision: FINAL ASSESSMENT Identify positive effects or benefit of data use; Identify a targeted beneficiary; Identify likely risks and most impactful harms; and who can be affected by those; Consider if there is an alternative to using proposed data; Identify harms linked to not using the data Assess the proportionality of risks and harms with positive impacts; 

PReSENT YOUR FINAL ASSESSMENT: KEY QUESTIONS TO HIGHLIGHT IDENTIFY BENEFIT= IMPACT IDENTIFY DATA IDENTIFY LIKELY RISKS IDENTIFY MAGNITUDE OF HARMS ARE BENEFITS BIGGET THAN THE RISKS? HAVE YOU CHANGED YOUR PROJECT DESIGN/APPROACH BASED ON THE IDENTIFIED RISKS/HARMS? DO YOU THINK YOU WILL NEED TO PERFORM A MORE DETAILED ASSESSMENT IF THE RISKS AND HARMS ARE HIGH?

THANK YOU! romanoff@unglobalpulse.org www.unglobalpulse.org/privacy-and-data-protection