Building Data Responsibility into Humanitarian Action

"Because affected populations can be harmed as well as helped by the use of data, frameworks must be established to ensure that humanitarians understand and mitigate risks caused by the use of data."

This United Nations (UN) Office for Coordination of Humanitarian Affairs (OCHA) think brief identifies the critical issues humanitarians face as they strive to responsibly use data in operations. It also proposes an initial framework for data responsibility, using 3 case studies to show how organisations adopted risk mitigation measures in data-driven projects.

The report first defines the diverse and complex "humanitarian data ecosystem", which involves humanitarian actors, their partners, and affected communities together producing, capturing, and accessing growing volumes of digital data about crisis-affected communities and contexts. Digital data flowing through this ecosystem includes mobile phone records, social media posts, satellite imagery, sensor data, financial transactions, and other streams of data - including information about the time- and place-specific activities of affected populations, i.e., "spatiotemporal metadata". For example, call detail records (CDRs) from mobile phones and crowd maps can be used to understand population movements to help plan relief distribution. Other examples: Calls to radio stations can reveal local perceptions of international aid; social media messages and online news outlets can enhance understanding of local need; and local social media can yield insights about capacities in hospitals and other infrastructure.

However, as noted here, these same data streams can harm the very populations humanitarians seek to serve. The disclosure of sensitive personal and demographic data in the humanitarian space can lead to already vulnerable individuals and communities being further harmed or exploited. Over time, inappropriate uses of data can have ripple effects, with concerns over security, confidentiality, and privacy, among others, expanding resistance to data sharing and undermining humanitarian work in the long run. Affected populations can also become more vulnerable if new technologies, such as algorithms, exclude their participation in recovery efforts. For example, researchers found that victims of Typhoon Haiyan in the Philippines (2013) who were from low socio-economic backgrounds had limited or no access to the internet and other media, and their digital literacy levels were correspondingly very low. This constraint contributed to their slow recovery compared to middle-income families who were able to navigate the media landscape and tools offered by digital data and technologies.

"Identifying the risks of these new tools and techniques and codifying best practices, is a major task that the humanitarian community is only beginning to take up." To assist in that process, the report offers a framework for data that includes, at minimum:

1. Evaluating the context and purpose within which data is being generated and shared - What is the anticipated benefit of using the data? Who has access to the data? What constitutes the actionable information for a potential perpetrator? What could set off the threat to the data being used inappropriately?"
2. Taking inventory of the data and how it is stored - Where is the data? Is it stored locally or hosted by a third party? Where could the data be housed later? Who might gain access to the data in the future? Is data access being monitored?
3. Pre-identifying risks and harms associated with a proposed use of data before data is collected - Could the data be combined with other data sources to expose individuals? What happens if the raw data is publicly released? What happens if the organisation is maliciously breached? Who are the spoilers who could use data to deliberately harm affected populations? Can the data analysis be misinterpreted to the detriment of the programme?
4. Developing strategies to mitigate those risks - Developing data handling policies and scenarios with decision trees, implementing access controls to the data, adopting technological solutions, and training staff.

Case studies include to illustrate this process include: (i) Cash transaction analysis in Lebanon - World Food Programme and Leiden University Centre for Innovation; (ii) Call detail records for mapping Malaria - Flowminder; (iii) Satellite imagery analysis for early warning - HII.

The 4-step process for data responsibility described above is a practical guide that a project or an organisation can use today. However, according to this report, humanitarian actors must still come together to develop a comprehensive and consistent framework for data responsibility across the sector. In doing so, they should ensure that this framework is built on a set of minimum standards that would encompass:

• Identifying the need: Data should never be used simply because they can be; the humanitarian need and potential benefits should be clear and defined.
• Assessing core competencies: Humanitarian actors should identify what core competencies are needed to deploy a specific data-driven approach during a response, and only proceed if those competencies are available to them.
• Managing risk to vulnerable populations: Humanitarians should identify risks and harms to individuals and communities before operations commence and adopt a plan to manage and mitigate those risks.
• Adhering to legal and ethical standards: Practitioners are responsible for determining what legal and ethical standards apply to proposed applications of data in specific contexts, and for adhering to these to prevent potential violations of laws and rights.

Characteristics of humanitarian organisations that use data responsibly:

• Responsible use of data is not just a policy but is an integrated and iterative set of processes with the necessary capacities to support them.
• Organisations develop and adhere to clear rules before they deploy data-based interventions. They identify and plan to address moments requiring the immediate cessation of a project.
• Organisations are transparent, intentionally capturing and sharing information about their projects, critical incidents, and best practices.
• Organisations responsibly using data establish feedback loops with key stakeholders at each stage of their project to help ensure accountability to recipients. They also monitor data practices throughout the project's lifecycle.

The report concludes that "participants in the humanitarian data ecosystem will need to look beyond their own organization to ensure that their broader environment is adhering to the principles and practices of humanitarian data responsibility. Without a holistic, ecosystem-wide approach, humanitarian data use will only be as responsible as the weakest link in the data chain."