The collection and processing of personal data is an integral and essential part of IOM operations, as the Organization daily processes personal data of millions of beneficiaries in order to fulfill its mandate. IOM therefore attaches significant importance to data protection, which contributes to effective implementation of IOM projects and activities while ensuring the privacy and safety of beneficiaries. The protection of personal data is paramount to IOM in order to respect the right to privacy, human dignity, and well-being of migrants, ensure their safety and non-discrimination, facilitate migration movements and understand migration challenges. IOM was one of the first international organizations to develop its own internal data protection policy: the IOM Data Protection Principles adopted in 2009 and the IOM Data Protection Manual in 2010. IOM’s data protection strategy seeks to protect the interests of IOM beneficiaries, as well as the Organization itself and it should be applied systematically throughout the Organization. As per the IOM data protection statement, “all reasonable and necessary precautions to preserve the confidentiality of personal data and the anonymity of data subjects. All personal data shall be collected, used, transferred, and stored securely in accordance with the IOM data protection principles.” The IOM data protection principles are designed to assist IOM staff to take reasonable and necessary precautions in order to preserve the confidentiality of personal data and to ensure that the rights and interests of IOM beneficiaries are adequately protected. They prevent unnecessary and disproportionate interference into privacy and are applied systematically to ensure the protection of personal data of all beneficiaries IOM serves.

Consent is a process that includes providing information to beneficiaries, giving them the opportunity to ask questions to ensure that the information is complete and understood. Before receiving assistance, beneficiaries must give their permission (or refusal), which shall be recorded in a secure and confidential manner. Consent is usually provided in writing by signing a consent form. In case this is not feasible or appropriate (for example in the case in the case of children, beneficiaries with low levels of literacy, and/or those without the capacity to give consent), it is possible to record audio or video consent. If the consent is given verbally, it shall be certified in writing by an IOM staff.

Capacity to give consent can be affected by migrants’ age, cognitive ability physical, and psychological state. In such cases, informed assent can be sought, i.e. the expressed willingness to participate in assistance provision. Appropriate measures should be taken to determine whether a beneficiary is able to give informed consent. If s/he is deemed incapable, appropriate guardianship authorities should be involved, but the migrant should remain involved in any decisions regarding assistance.

IOM implementing partners are also bound by the organization provisions relating to data protection and shall ensure that beneficiaries provide their informed consent to the collection of their personal data. In case of referrals of beneficiaries, principle 5 of IOM Data protection provisions on data sharing shall be followed.

Contacts:

The Office of Legal Affairs of IOM is the focal point for data protection issues. For further guidance on how to ensure that personal data are processed in accordance with the IOM Data Protection Principles please contact  leg@iom.int