INFORMATION SHARING PROTOCOL InterAgency Workshop Date AGENDA BACKGROUND

INFORMATION SHARING PROTOCOL Inter-Agency Workshop Date

AGENDA

BACKGROUND AND OBJECTIVE • 5 core components of CPIMS+ 1. Case Management Forms 2. Standard Operating Procedures (SOPs) 3. Data Protection Impact Assessment (DPIA) 4. Information Sharing Protocol (ISP) 5. Databases Objective Informed by the DPIA and contextual knowledge, agree on the types and methods for sharing child protection case management information.

INTRODUCTION TO ISP STRUCTURE • Introduction • Purpose • Key Definitions • Ground Rules • Participating Agencies and Brief Overview of Roles and Responsibilities • Types of Data Sharing, Rationale, When and How Information is Shared • Information Quality • Time Limit • Breaches

WHY DOES DATA PROTECTION MATTER? • When collecting, storing, sharing and processing personal data there are inherent risks such as unsecure data storage, accidental or unauthorized loss or disclosure. • These risks are particularly high in exceptional emergency circumstances and volatile environments • A personal data breach; leading to the accidental or unlawful/illegitimate destruction, loss, alteration, unauthorized disclosure of, or access to personal data can have life threatening consequences (on children, families, communities, services providers). • In some cases (armed conflicts, situation of violence) threats are collective (i. e. village community, specific group) rather than individual, as such processing of non-personal data may also raise specific threats at the collective level. • The protection of an individual’s personal data is an integral part of protecting their life, integrity and dignity (ICRC Data Protection in Humanitarian action) • In recent years, the development and use of new technologies have allowed for easier and faster processing of a large quantity of personal data. If not handled properly, the use of new technologies can be harmful (e. g. unsecure mobile messaging, access and administration not properly defined, passwords not managed etc. ).

CHALLENGES FOR DATA COLLECTION AND SHARING ON CHILD PROTECTION CASES § Too much information is collected without a clear understanding of the meaning and purpose § Decisions are made regarding children’ data without their assent or consent or knowledge § Lack of understanding/consensus of the level of data to be shared § Too much irrelevant information is shared § Safety and security of data shared (in particular personal/identifiable data) § One‐way information sharing, no feedback mechanism § No process or procedures in place to guide and govern information sharing

GUIDING PRINCIPLES Inter Agency Guidelines for CM & CP v Agencies involved in case management must develop data protection protocols based on the principles of confidentiality and “need to know”, with the ultimate aim of safeguarding the best interest of the child. v Access to information on children should be limited only to those who need to know and to whomever the children agree to know it.

NEED TO KNOW PRINCIPLE Children’s Personal Data should only ever be shared: • On a ‘need to know’ basis (crucial to define this well); and • If that is in the ‘best interests’ of that child How to distinguish between ‘need to know’ and ‘nice to know’: • Purpose limitation: the purpose must be specific, explicit, and legitimate • Proportionality: is your action proportionate to your pursued aim? Could the same purpose be achieved in a less intrusive way? • Data minimisation: only the minimum amount of Personal Data are processed to achieve the objective and purpose E. g. You are the caseworker for a refugee child. UNHCR request information on the harm the child experienced in their country of origin to support that child’s refugee status determination E. g. The CP Sub-Working Group (or a donor) requests every child’s full case file (including name, date of birth etc. ) to report on aggregate protection concerns The recommended way to share information is to only send aggregate data that excludes personally identifiable information, unless there is a specific purpose to sending Personal Data and that the principles of proportionality, and data minimisation are applied.

NEED TO KNOW PRINCIPLE Less Data Country Level Few data points are relevant & actionable Aggregated, anonymized quantitative data Program Management Level Fewer data points are relevant & actionable More Data Aggregated, anonymized quantitative data Service Provision Level A large number of data points are relevant & actionable Qualitative & anonymized data Levels of Data Sharing

WHAT IS IMPORTANT IS THAT THE CMTF IS: 1) satisfied that the data processing is necessary and proportionate 2) has considered the risks that arise in this context 3) considered mitigation strategies and arrived at an informed decision in the interest of children as to how to proceed.

DPIA KEY FINDINGS

TYPES OF DATA • Personal data is any data related to an individual who can be identified from that data; from that data and other information; or by means reasonably likely to be used related to that data. • Personal data includes: - Biographical data (biodata) such as name, sex, marital status, date and place of birth, country of origin, country of asylum, individual registration number, occupation, religion and ethnicity, biometric data such as photograph, fingerprint, facial or iris image, as well as any expression of opinion about the individual, such as assessments of the status and/or specific needs. - Some of these data fields are non identifying or aggregate if not shared as 1 ‘package with an identifying number or name’ but as statistics such as sex • Aggregate data is any data related to an individual that is non-identifying, meaning the individual cannot be identified from the data

GROUP WORK • Brainstorm types of information sharing • Referrals and to CM and non-CM agencies • Transfers • Aggregated (anonymised) data • Information shared with UNHCR and vice versa • Authority request for data • Sharing information with donors • Group work: Guided by the worksheet

NEXT STEPS • Draft • Inputs • Finalization