Data Protection Principles

Data Protection 

  Data Protection:
Is the systematic application of a set of institutional, technical and physical safeguards that preserve
the right to privacy with respect to the collection, storage, use and disclosure of personal data.
 Why is Data protection important.
To respect the right to privacy and human dignity of individual.
To ensure the safety, non- discrimination and well being of individual( beneficiaries) 
Credibility with individuals, partners, CSO’s and Donor’s 
 What happens
when data is
not properly
managed?
Discrimination & stigmatization

Lack of trust

Threats to the individual

(Beneficiaries)
 Data theft

No privacy
 IOM’s data Category Description Risk Exposure in case of
unauthorized use 

Sensitive information limited specific individuals for legitimate High risk

purpose.
Secret  Example: (Declaration of Non-disclosure) Vulnerable migrants’
or IDPs’ data managed by CT Case worker.

Information of our beneficiaries, colleagues - IOM if disclosed Moderate risk

can jeopardised operations.
Example: Location data of displacement sites in crises that host
Confidential  unaccompanied children.

Data information intended for internal USE ONLY. Low risk

Example: IOM project documents and budgets.
Unclassified/Internal Use

Migration data intended for unrestricted use.  Migration data No risk

can be distributed to the public without restriction. 
Example: IOM Press Briefing Notes and Publication
Public
The 13 Data Protection Principles
1. LAWFUL & FAIR COLLECTION

2. SPECIFIED & LEGITIMATE PURPOSE

3. DATA QUALITY

4. CONSENT

5. TRANSFER

6. CONFIDENTIALITY

7. ACCESS & TRANSPARENCY

The 13 Data Protection Principles
8. DATA SECURITY

9. RETENTION OF PERSONAL DATA

10. APPLICATION OF THE PRINCIPLES

11. OWNERSHIP OF PERSONAL DATA

12. OVERSIGHT, COMPLIANCE & INTERNAL REMEDIES

13. EXCEPTIONS
Lawful and fair collection – personal data must be obtained by lawful and fair means with the knowledge or consent of
the data migrant;
Specified and legitimate purpose – the purpose of the data collection and processing should be known and specified to
migrant and under consent;
Consent – must be obtained at the time of collection;
Confidentiality – must be respected and applied at all stages of data collection and processing and should be
guaranteed by IOM staff;
Access and transparency – the migrants should be given the opportunity to verify their data’s development, practices
and policies;
Data security – personal data should be kept secure both technically and organizationally with no authorized
modification, destruction, loss, etc.
Data quality – Data controllers should take all reasonable steps to ensure that personal data are accurate and up to date;

Transfer to third parties – Personal data should only be transferred to third parties with the explicit consent of the data subject, for a
specified purpose, and under the guarantee of adequate safeguards to protect the confidentiality of personal data. These three conditions
of transfer should be guaranteed in writing;

Ownership of personal data – IOM shall assume ownership of personal data collected directly from data subjects or collected on behalf of
IOM, unless otherwise agreed, in writing, with a third party

Application of the principles – These principles shall apply to both electronic and paper records of personal data. These principles shall
not apply to non-personal data.

Oversight, compliance & internal remedies – Data protection focal points should assist with monitoring implementation of these
principles, investigate any complaints and training of staff;

Exceptions – Any intent to derogate from these principles should first be referred to the IOM Office of Legal Affairs for approval, as well as
the relevant unit/department at IOM Headquarters.
 Three 1.
2.
With the explicit consent of the migrant or IDP
For a specified purpose
conditions 3. Under the guarantee of adequate safeguards to protect the

for transfer
confidentiality of personal data and to ensure that the
fundamental rights and interests of the migrant or IDP are
respected.
of data:
Data protection for Focus Group Discussions
Data Protection and Privacy – Focus
Groups Discussions (FGD)

Scenario:
You are designing a survey in which you would like to include a qualitative
component, specifically through focus group discussions (FGDs), to better
understand the protection concerns and challenges of internally displaced women in
a mixed community setting (internally displaced and host communities) .
You plan to collect sensitive information during group discussions and record the
conversations and then transcribe and encode them.
Data Protection and Privacy – Focus
Groups Discussions (FGD)
Ethical Considerations: Consent, confidentiality, anonymity, risk of harm
• Consent
• Challenge - giving a good explanation of what is going to happen during the
discussion is difficult, due to the lack of unpredictability and uncertainty about what
is going to be discussed during the FGDs
• For FGDs, less easy to withdraw participation / consent later
• Confidentiality and anonymity
• More problematic as we have very little control over what participants outside the
group say
• External confidentiality - possible disclosure of information by the researcher
• Internal confidentiality - information that could be disclosed by group members
Data Protection and Privacy – Focus
Groups Discussions (FGD)
Ethical Consideration: Data management

• Qualitative data collected through interviews and focus group discussions -

constitutes personal data
• Different devices for recording audio are better than others - any device used
should have all security protocols enabled
• Data security in the field
• Data storage on a secure server
• Deletion of data
• Anonymize the data
Data Protection and Privacy – Focus
Groups Discussions (FGD)
GOOD PRACTICES - DATA MANAGEMENT AND CONFIDENTIALITY

• Recordings and notes captured in the field - uploaded to a secure server as soon as
possible, erased from your devices
• Monitor devices used for data collection, only use IOM devices, make sure all security
measures are activated on your devices, dial device serial number,
• Just record the audio you need 
• Carry out the FGDs in a private space
• Inform participants that the session will be recorded, times, specify when the recording is
finished
• Ask participants to refer to third parties (friends, family) by relationship and not by direct
name
• Use transcript of conversations as the basis for analysis, not recordings
RISK-BENEFIT ASSESSMENT  Y N SENSITIVITY-ASSESSMENT  Y N
E O E O
S S
Is it clear which of the data you will be collecting under this DTM
project are personal data and which are non-personal data?  Are all types personal data that will be collected properly classified according to the level of
sensitivity applied to it? (i.e. low sensitivity, medium sensitivity, high sensitivity)
Have you made a list of all the personal data you will be collecting Was the highly sensitive data identified? If yes, have you ensured that adequate safeguards
from the data subjects under this DTM project?  are in place to protect such data? 
Have you planned to properly mark the personal data as being of “low sensitivity”,
Is it clear which is the specified and legitimate objective for the “medium sensitivity” or “high sensitivity” after the data will be collected? 
collection of those personal data?  Have you planned to review the sensitivity of data on regular basis?
CONSENT
Have you considered whether all the personal data you are planning Are you able to record the consent of each data subject in writing prior to collecting their
to collect are needed in order to fulfill the purpose of the specific personal data? 
project? (you need to ensure that you collect the minimum personal
data possible to achieve the specific purpose) If written consent is not possible to obtain prior to the collection of the personal data have
you evaluated the moment when such consent can be sought?
Have you clearly identified the following roles: data controller (staff If written consent is not possible, are you able to record the consent in another way (e.g.
who has the overall responsibility of the personal data and who audio recording)?
provides instructions to the data processors on how to e.g. collect, If recording the consent is not possible, have you contacted LEG to ensure another basis of
use, store, share and destroy them) and data processor (staff who collecting the personal data? 
process the personal data according to the instructions of the data Is your environment safe to seek consent of each individual IOM beneficiary?
controller)?  Is personal data collected in non-intimidating manner, with due respect of dignity of the
Have you conducted a risk-benefit assessment prior to the collection data subject?
of the personal data? (At a minimum, have you listed all the risks and Do your data subject know what the specified purpose, related purposes and additional
benefits that arise from collecting the specific type of personal data purposes of data collection are at the time of data collection?
from data subjects to achieve the specific purpose?)  Have you been providing the data subjects with an accurate and fair description of the risks
Do the benefits of collecting the specific types of personal data for the and benefits at the time of data collection?
specific purpose outweigh the risks?  Have you considered the data subjects’ physical and mental capacity to consent (e.g. from
vulnerable data subjects)?
Have you planned to review the risks on periodic basis to identify new Have you explained to the data subject that IOM may disclose their personal data to third
potential risks? parties (including donors and project partners) and have you mentioned to them for which
Have you planned to check on regular basis if the benefits still specific reason the personal data will be shared?
outweigh risks? Have you explained to the data subject that he/she has the right to contact IOM to access
their personal data, request to modify and/or delete them?
Have you ensured that the data subject has all necessary IOM contact information?
CONFIDENTIALITY DATA QUALITY
Is your staff briefed about the confidentiality of personal data prior to the Have the data subjects validated the personal data they provided to IOM? 
collection, use and disclosure of such data? Have you taken reasonable steps to verify the accuracy and truthfulness of personal
Do DTM staff know that in accordance with their contracts and the IOM data at the time of data collection?
Staff Regulations and Rules they are obliged to respect confidentiality? Are the DTM staff trained on data protection?
Do DTM staff know that the obligation of confidentiality continues even Are the DTM staff trained on collecting personal data? 
after the end of their employment with IOM?
Has the need for truthful personal data been emphasized and have the consequences
Are you applying strict access controls to the lists containing personal data of relying on inaccurate personal data been highlighted? 
of IOM beneficiaries and maintaining an access record of personal data
disclosed?  Are electronic records containing personal data stored in safe media that are protected
from security risks and unauthorized access and have regular backup procedures
Are you ensuring that all transmission of personal data within IOM are occurred? 
secure, correspondence is highlighted as “secret  ” and the recipients of e-
mails are carefully selected? Are paper records containing personal data stored in safe locations to prevent wear
and tear and unauthorized access? 
Are you monitoring the disposal of printed copies and other paper trails
containing personal data, including the shredding of printed material Has the quality of personal data been affected by any inaccuracies? 
containing personal data? Have updates to the personal data been accurately recorded in the electronic and/or
paper records? 
DATA SECURITY
Have you encouraged the practice of cross-checking prior to collecting personal data
Have you analyzed the level of security at workstations according to and prior-checking before use and disclosure of personal data? 
sensitivity levels, confidentiality, integrity, transmission and access to data?
SHARING PERSONAL DATA WITH THIRD PARTIES
Does the donor agreement for this DTM project include a provision stating that IOM
Have you evaluated the storage location and safety measures needed to will comply with its Data Protection Principles when processing personal data? 
protect paper records?
Have you offered/counteroffered to share aggregate non-personal data?
Have you evaluated the electronic storage areas and safety measures
needed to protect electronic records, including backups? Have you ensured the consent of the data subjects to share their personal data with a
third entity? This is mandatory. 
Have you ensured the proper management of electronic and paper records
to prevent unauthorized retrieval? Is the specified purpose for which personal data will be shared clear? 
Have you enquired with ICT about the latest updates in information Have you contacted LEG for advice prior to transfer of personal data? It is mandatory to
technology , including the availability of encryption software to be used sign a written agreement when sharing personal data, so you have to contact LEG. 
when storing personal data? Have you evaluated the existence of data protection legislation, compliance with data
protection laws and regulations in the country of the third party?
Have you ensured a limited access to personal data of IOM beneficiaries for
certain categories of IOM staff, consultants and individuals? Have you limited the amount of the personal data to that which is necessary to achieve
the specified purpose of transfer?
Have you ensured strict access control and maintenance of personal data
disclosed? Have ensured (in coordination with the ICT Officer) that the method of transfer is safe
and secure?
Summary Did we reach our learning objectives?

- Issues identified are common across countries and the

region.
- Main message:  you will not be negatively judged if you ask
for help, even if you feel you should have done
something differently and feel bad about it. Our job is to
help you minimize the risk and minimize the harm.  Asking
for help means you understand data protection and want to
uphold IOM standards