Partnership and third-party considerations

Where UNHCR and partners introduce digital services, accountability inevitably extends from face-to-face to the digital space. UNHCR and partners must ensure adherence to [in]corporate and interagency data protection frameworks, and foster inclusion and access to personal data to the extent possible.

To mitigate and manage risks associated with the use of digital tools, partners must address security vulnerabilities which are inherent in digital systems, networks, devices, and technologies, but also ensure that affected people understand the risks relating to them and are supported in protecting themselves against those risks. In addition, partners must support affected communities to exercise their rights as data subjects accurately and effectively when using digital tools.”

In line with UNHCR’s data protection framework, partnerships must ensure that all digital tools and technologies are aligned with the principles of privacy by design and default. The concept of privacy by design and by default are part of the UNHCR’s ‘Data Transformation Strategy 2020-2025: Supporting Protection and Solutions’ Therefore, as provided by the Data Protection Policy, “when elaborating new systems, projects, or policies, or before entering into data transfer arrangements with third parties, which may negatively impact on the protection of personal data of people, UNHCR needs to carry out a Data Protection Impact Assessment (DPIA)”.

Third parties are also expected to undertake a HRDD of this work in line with the UN Secretary-General’s Guidance on Human Rights Due Diligence for Digital Technology Use. This ensures the consideration of additional human rights risks beyond the right to privacy and data protection.