Address Privacy & Security
Addressing privacy and security in digital development involves careful consideration of which data are collected and how data are acquired, used, stored and shared. Organizations must take measures to minimize collection and to protect confidential information and identities of individuals represented in data sets from unauthorized access and manipulation by third parties. Responsible practices for organizations collecting and using individual data include considering the sensitivities around the data they have collected, being transparent about how data will be collected and used, minimizing the amount of personal identifiable and sensitive information collected, creating and implementing security policies that protect data and uphold individuals’ privacy and dignity, and creating an end-of-life policy for post-project data management.
Core Tenets
- Define data ownership, sovereignty and access before any data are collected or captured. Determine what local data protection laws and regulations need to be followed, who gets to decide what to do with the data, who is allowed to access or use the data and where data can (or must) be stored.
- Keep the best interests of end users and individuals whose data are collected at the forefront of your planning for upholding user privacy and ensuring data security and ethical implementation. This is especially important when implementers work with vulnerable or marginalized communities who may not have had a say in how their data have been collected, used or shared.
- Perform a risk-benefit analysis of the data being processed that identifies who benefits and who is at risk. This process may need to be repeated throughout the period of performance as new data are needed, new risks are identified or emerge, or new data-sharing partners are considered.
- Assess the risks of unauthorized access or leakage of any stored data. Consider the impact this data could have on the individuals if accessed or published maliciously and the risks if data were combined with other data sets.
- Understand that risks are highly contextualized, not just to countries but also to communities, populations and periods of time. If working with vulnerable or marginalized communities, what groups might have motivation to acquire your data, how capable are they, and are the information and access controls around the data sufficient?
- Minimize the collection of personal identifiable information. Consider how critical personal information is to the project’s success and what the consequences would be if those data are exposed to third parties — especially when partnering with users from vulnerable populations, such as minority groups, the disabled, and women and children. Include a risk assessment for collecting personal information.
- Catalog and track any personal or sensitive information captured throughout the project: Create a plan for mid-and post-project destruction or secure offline storage of sensitive data, including the review of hard drives, cloud file storage, flash drives, email inboxes and other common sources of data leakages.
- Be transparent with individuals whose data are collected by explaining how your initiative will use and protect their data.
- Obtain informed consent prior to data collection. It is crucial to ensure that participants understand why their data are being collected, how data are used and shared, and how the participants can access or change the data collected — and that they be given the option to refuse to participate. Participants should be informed of and fully understand the risks related to sharing their data. Consent forms should be written in the local language and easily understood by the individuals whose data are being collected.
- Protect data by adopting best practices for securing and restricting access to data. Examples of best practices include encrypting files, using two-factor authentication, restricting access permissions, storing data on secure servers or secure cloud storage services, and implementing organizational security policies and procedures, including data-sharing agreements with all data-sharing partners.