Data Protection: A core component of a survivor-centered approach?

Having visited our project team in Bangui in October, I have yet to find words to describe the trip, and the extraordinary people I met in the Central African Republic’s capital. One of the visit’s purposes was to meet with the survivors of conflict-related sexual violence (CRSV) we work with, to discuss perspectives on the Personal Data requested from them by non-governmental organisations.  This includes data such as contact information, demographic data, financial or medical information, images, videos, audio recordings, and the list goes on, and concerns about the use of such Data.   

As I spoke to survivor activists - and to the Project’s fantastic team of psycho-social assistants - it became clear that the real-life impact of survivors’ information being disclosed within their communities was far from the numerical risk analyses and formulaic risk assessments we typically use to define and manage Data Protection risk. Although we often refer to “stigmatisation” and “discrimination” of survivors as risks related to survivors’ information being disclosed, somehow these words took on far greater meaning when survivor colleagues explained to me that they had moved house and village, often many times, when the conflict-related sexual violence that happened to them became known; how they were rejected and scorned by loved ones and seen as tarnished by those around them. Having suffered the unimaginable, they were faced with profoundly scarring dismissal and humiliation at a time when their will to live was already hanging by a thread.  

Sharing these stories, survivor colleagues conveyed the immediate necessity to protect each and every survivor’s right to privacy through the protection of their personal information. Agency over personal information is a clear priority; agency to be able to decide who to share it with, and who not; who they trust to respect their lived experiences, and who they do not; what information to disclose, and what to keep private. Having this time to speak with survivor activists also allowed us to identify together the different elements of GSF’s interim reparative measures (IRM) project that could whisper to communities that those participating in it are survivors of conflict-related sexual violence, and to start thinking about how best to address these risk points. 

As discussions moved forward, it also became clear that just as important as agency over what information to share, was the right to decide when to share it. I listened to colleagues describe the levels of emotional vulnerability they experienced shortly after their ordeals, and the roads they had travelled to rebuild their life and reappropriate their position in society, owning their narrative and making the difficult decision to become outspoken representatives for all survivors. The path to reaching such a decision was seen by many as a part of the reparative process, it cannot be rushed and it cannot be dictated by anybody else.  

Through these conversations, it dawned on me that protecting privacy is not only important in its own right, but is also key to survivors regaining control over their own narrative and, as such, is both a core component of the reparative process and at the heart of what GSF strives to achieve.  

Having control over one’s personal information – and personal story - is at the heart of data protection, which - as now infamous European data protection laws make clear - seeks to preserve the fundamental human right to privacy, and with it to “contribute to ensuring the accomplishment of… freedom, security and justice, to economic and social progress, and to the well-being of individuals”.  

Such values are also to be found in GSF’s survivor-centered approach, which adheres to the premise that only survivors can know what is best for them and what challenges they face, and must be actively involved in every aspect of an IRM project. This involvement includes agency in determining how their personal information is treated, when, by whom, and how it is protected.

To ensure such involvement in every IRM project, we will need to make the space and time to speak with survivors about their concerns, their wishes and the risks they identify when it comes to the collection and use of their information, and to develop Data Protection measures accordingly.   

We will also need to identify and inform survivors about some less tangible risks that may be associated with the processing of their information. Whether it is the risk of becoming marketing targets for high-risk financial products if their financial information is shared with commercial entities or the risk of being persecuted by Government entities in certain situations, we will need to work together on ways to ensure protection from such risks.   

It will also be key to convey to survivors that they have rights related to their personal information: the right to know what information is being collected about them, what it is being used for and by who; the right to have access to their Data, object to certain uses of it, the right to have their Data erased, the right to request that it be shared with another organisation.    

None of these tasks will be easy, but I have returned to Geneva evermore convinced that being led by ethics and by the values of dignity and humanity is the way to ensure not only a truly survivor-centered approach, but also strong data protection practices. Regaining control over one’s narrative starts with having control over one’s personal information, and as such is an integral component of any pathway to reparation. Survivors will be trusting us with their most intimate information, and we have a duty to ensure that we protect that information to the best of our ability while it is in our care.  

Also made clear during this trip was that data protection is key to GSF’s other guiding principles of contextualisation and a multi-stakeholder approach, but that, is a tale for another day…