Poor data protection could put lives at risk, say Somalia aid workers
The rapid upscaling of digital technology use by international groups in Somalia is causing concern about the risk to the people whose data is being collected.
The coronavirus pandemic has accelerated the use of programming by humanitarian organisations to deliver aid, but local staff working with several different NGOs say the organisations are not thinking enough about data protection or obtaining informed consent.
“It is extremely dangerous if the data is lost or falls into the wrong hands,” said Abdifatah Hassan, director of Digital Shelter in Mogadishu, a rights organisation. “We have recently seen people who were killed after their personal information was leaked. This is a matter of life and death. NGOs should uphold the humanitarian principle of ‘do no harm’ when providing assistance to poor people.”
Many of those living in displacement camps have fled areas controlled by the Islamist militia group alShabaab. Some have escaped forceful recruitment while others defied orders not to seek “help from infidels”. Yet sensitive personal details – including their location, names and mobile numbers – have to be given to NGOs before they can access basic services.
“Sometimes community leaders are asked to give consent on behalf of beneficiaries they select instead of every individual giving their own consent,” said a local staffer who worked on the cash transfer programme in Somalia. “Once they are put in the system, no one goes back to them about how their data is used.”
The UN and partner NGOs collect huge quantities of data, including personally identifiable information on vulnerable people, which is shared across multiple organisations and mobile network providers, increasing the risk of breaches.
The Somali Cash Consortium, a group including Save the Children, the Norwegian Refugee Council, the Danish Refugee Council and Concern Worldwide, has been working to harmonise the mobile money payment system. It follows the EU’s strict General Data Protection Regulation (GDPR), which gives data subjects more control over how their personal information is used.
“Data privacy is an important and growing area of work for humanitarian and development agencies given that we all need data to deliver aid,” said director Alessandro Bini. “Cash Consortium has put a lot of thought and time in trying to treat this issue with the required level of care and attention.”
Since the 2011 famine, NGOs have been using cash and mobile money payments to support displaced families throughout Somalia. Hailed as an effective and efficient model of intervention, the system is said to have helped avert another famine in 2017. In the past three years, the consortium has distributed $46m (£34m) to 600,000 people.
Each organisation has its own internal policies when dealing with beneficiaries. Money is transferred through mobile network operators such as Hormuud, the biggest network in Somalia, which disburse it via mobile phones.
“The telecom companies use the data obtained from humanitarian organisations for their own marketing, which is not what beneficiaries have signed up to,” said a senior local official based in Mogadishu, who did not want to be named. “Unfortunately, NGOs seem not to care about it, they don’t see it as an issue simply because vulnerable people would never complain about data breaches for fear of losing the assistance.”
Consent is being collected via a call centre.
“We’re extremely conscious that we’re in a powerful position when it comes to gaining consent. People are unlikely to say no when we’re going to give them money. But we make every effort to gain informed consent. Consent is received verbally when we’re collecting data, either in person or through our call centre. When using the call centre, we record and review calls to ensure beneficiaries’ consent is properly received,” said Bini.
The Somali government is facing Covid-19, devastating locust invasions and floods. The UN says 5.2 million people are in need.
Zakarie Ismael, an official at the government’s ICT department, said efforts were under way to develop legislation. “The fact that we don’t have data protection laws at the moment doesn’t mean we don’t take it seriously,” he said. “Humanitarian organisations must collaborate with the government to protect the vulnerable populations they serve.”