Privacy Impact Assessment (PIA) International Consultant – short term At World Food Programme

JOB TITLE: Privacy Impact Assessment (PIA) International Consultant – short term

TYPE OF CONTRACT: WAE

UNIT/DIVISION: Programme

DUTY STATION (City, Country): Bishkek, Kyrgyzstan

DURATION: 3 months

BACKGROUND

The United Nations World Food Programme is the world’s largest humanitarian agency fighting hunger worldwide. The mission of WFP is to help the world achieve Zero Hunger in our lifetimes.

In Kyrgyzstan, WFP has established its presence since 2008 to support chronically food insecure and vulnerable people. While earlier programme support was unconditional and covering target population through blanket distribution of food jointly with local counterparts, eventually, WFP has introduced more demand-driven and community-based participatory approaches by putting people at ‘the heart of decision-making’ processes. The current Country Strategic Plan (CSP) is implemented in close coordination with partners and supports the country in food security and nutrition, social protection, rural development, disaster risk reduction and climate change adaptation.

Under the current CSP, WFP partners with the national government in 5 Strategic Outcomes (SOs):

1) Optimization of school meal programme;

2) Support to vulnerable smallholders;

3) Enhancing community resilience to climate change and natural disasters;

4) Support to food security and nutrition management;

5) Emergency support and early recovery (cash-based transfers (CBT)).

For all the above programme interventions, WFP Kyrgyzstan heavily relies on support and partnership by the national counterparts (ministries, departments, NGOs, school administrations, communities, etc.) to process large volume of data linked to its programmes and operations. Fully acknowledging that managing people’s personal data and identity is extremely sensitive, WFP consistently improves existing practices and tools to prevent any unintended use of personal data of beneficiaries. Protecting personal data is about protecting people’s life, dignity and integrity, which is the core commitment set forth by the 2020 WFP Protection and Accountability Policy. In contrast to larger emergency and refugee context operations, WFP Kyrgyzstan works mostly with national citizens and in a development country context. At the same time, there are several aspects to be improved in the manner data is handled, processed and transferred between local partners and WFP in the course of joint programme interventions (targeting, implementation, monitoring, reporting, etc.).

The key tool used in data protection work in WFP is a Privacy Impact Assessment (PIA), which is aimed at identifying, evaluating and addressing the risks (e.g. protection, legal, principled emergency action, etc.) arising from the processing of personal data related to a specific activity, project, programme, initiative or, in this case, a whole Country Strategic Plan (CSP). The PIA is a multifunctional exercise, which draws from the expertise of units such as IT, M&E, partnerships, programme and protection.

PURPOSE OF THE ASSIGNMENT

WFP Kyrgyzstan is seeking qualified international consultant to the conduct a Privacy Impact Assessment (PIA) with the objective of reviewing, evaluating and improving existing data protection mechanisms across programme interventions.

· Conduct a Privacy Impact Assessment (PIA) of the WFP Kyrgyzstan tools/mechanisms for data flows under each SO with the purpose to analyze and identify privacy and personal data protection risks and propose any required mitigation measures for improving data protection for the new CSP for 2023-2028.

· Conduct lighter assessment of social protection programme tools, so called “digital assistance services”, for possible re-designing of existing processes in a digital and innovative way considering data protection risks and related mitigation measures.

The above consultancy for PIA exercise will be conducted within 3 months:

1) Phase 1 for remote-based analysis to combine desk research, documentation review, interviews and discussion with WFP staff through Internet;

2) Phase 2 for in-person visit to the country, if security situation permits, with office based in Bishkek to conduct any meetings and interviews with national counterparts;

3) Phase 3 for finalization of analysis, preparation of final report and presentation to WFP Kyrgyzstan.

The PIA Consultant will be supervised by the CBT Officer under the guidance Deputy Country Director and the technical lead of the Regional Beneficiary Data Protection Advisor.

The PIA Consultant will be supported by one national specialist recruited with specific objective to assist in translation, interpretation, legislation review, arranging meetings, conducting interviews, organization of assessment, provision of inputs for reporting and evaluation, preparation of final presentation.

ACCOUNTABILITIES/RESPONSIBILITIES:

Conduct and complete the Privacy Impact Assessment for WFP Kyrgyzstan operations in collaboration with other relevant units in WFP, including Programme (with SOs, VAM, CFM, CBT, Monitoring, Protection, Security, IT, Budget and Programming, Administration and Finance; and Supply Chain units). Completing the PIA includes, but is not limited to:

· Developing a deliverable-based workplan for the assignment, with the completed PIA report clearly outlining key recommendations as the final product for WFP Kyrgyzstan context.

· Conducting secondary literature and data review to understand the:

o Socio-political situation and relevance of identity and personal data therein;

o Protection issues experienced by crisis and poverty affected people, with special focus on issues where identity, or lack of identity, or any particular status of the person (e.g., ethnicity, language, disability, gender, displacement, etc.) is a triggering factor;

o Legal framework on data privacy and protection in Kyrgyzstan, including applicability of UN privileges and immunities, domestic legislation and regulations of relevance to people’s identity (e.g., Know Your Client regulations; anti-terrorism laws; anti-money laundering laws; any other public health or public security law requiring access to personal data) and possibility that partners or third parties are obliged to disclose data to authorities;

o Known or foreseeable actors that might be interested in requesting/accessing/seizing personal data collected by WFP to pursue humanitarian and non-humanitarian purposes;

o Risks of possible unintended use of personal data and consequences on WFP’s beneficiaries.

· Conducting assessment of technical and organizational capacities of WFP and with consideration of main ministry partners in the Government with regard to data protection processes and systems, considering WFP’s support to digital tools (esp. in the area of social protection), analysing WFP Kyrgyzstan implementation of privacy and personal data protection, including issues such as data quality, data subject rights, data security standards, and risk analysis as per the Data Protection Toolkit:

o Conducting internal consultations with relevant WFP staff, including heads of units, heads of field office, focal points in relevant sectors, and colleagues working on data protection at the country, regional and headquarters level;

o Conducting external consultations with relevant development partners (e.g., UNICEF, OHCHR, UNFPA, IOM, ILO, UNHCR), WFP CPs, Government Partners and Protection Sector and affected people of various gender, age, disability and other diversity;

o Engaging in field visits, if required, to complete data collection and consultations for the PIA, including to observe informed consent being obtained from beneficiaries for data collection and registration, with a view to developing informed consent guidance document for partners;

· Analysis of data flows, data sharing agreements, data security, data quality and data subject rights in WFP operations as executed together with partners;

· Provide overview of data protection risks and mitigation measures and key programmatic recommendations.

· Completing the draft of the report including all annexes in consultation with relevant colleagues for inputs on the final draft and presenting it to WFP management/Heads of units for endorsement of the recommendations.

Methodology:

The PIA is a multifunctional exercise, which draws from multiple areas of expertise (e.g. IT, programme, M&E): it is therefore fundamental that, under the overall leadership of the Country Office Management, relevant key staff members provide support to the PIA mission. The methodology will rely on the following

· CO to appoint PIA focal point(s)

· RBB to provide PIA and data mapping tools

· RBB to provide remote technical support throughout the whole exercise

· Review of past mission reports, assessment and finding related to WFP Kyrgyzstan programmes

· Working sessions with relevant CO and HQ staff (program, TEC, management)

· Consultations with key partners (Government, CPs, UN Agencies, protection actors, etc.)

· Remote consultations with beneficiaries

· Desk based protection and context analysis

· Review of laws and policies

Expected Deliverable

A report outlining main findings and recommendations for improving privacy and data protection by WFP Kyrgyzstan per each SO and programmatic activity.

QUALIFICATIONS & EXPERIENCE REQUIRED:

Desired experiences for entry into the role

· Knowledge of legal frameworks on human rights, data protection and privacy and international humanitarian law.

· At least 6 years of work experience of which 2 years of relevant experience in the field of protection or legal research.

· Solid analytical and writing skills in English.

· Ability to conduct work remotely with little oversight at times.

· Team spirit and excellent interpersonal relations.

· Experience in digital privacy is desirable.

· Flexibility to travel to and live in difficult environments.

Education & Experience:

Advanced university degree in one of the following disciplines: social sciences, law, humanitarian assistance, or another field related to international relations, human rights, or political science.

Languages: Fluency (level C) in written and spoken English.

Working knowledge of Russian and other languages spoken in Kyrgyzstan is desirable.