Sensitive data leak, requests for lists by the authorities and information-sharing protocol

Scale: 1,240 households × 6.2 = about 7,690 people identifiable, including 37 households flagged "GBV" and 12 households flagged "associated child" (49 households, i.e. 4% of the file, about 300 people in total). The file was seen by 41 people over two days and may have been downloaded or forwarded: deleting the message guarantees nothing.

Severity: very high. The combination of name, telephone, ethnic group, village of origin and current site makes it possible to locate and target people in a conflict with a communal dimension. The "GBV" and "associated child" flags expose survivors to stigma and to reprisals by the perpetrator or the family, and expose associated children and their families to arrest or re-recruitment. The risk also affects staff (accusation of collaboration) and the organisation's access.

24 hours: (1) containment: ask the group members in writing and individually to delete the file, without restating its content; ask the group administrator to restrict forwarding; (2) report the incident to country management and the data protection focal point according to the procedure; (3) individual risk assessment for the 49 flagged households, with priority to the 37 GBV and the 12 associated children, by the case workers, with discreet contact through the channel agreed with each person; (4) suspend the sending of named exports by messaging for the whole team; (5) inform the monitor of the follow-up, without immediate sanction, and gather the facts on the pressure he was under.

7 days: safety plans and relocation or referral options for the most exposed people; informing the households concerned in an appropriate way, if it is safe to do so; root cause analysis (pressure from the administration, no sharing rules, files on personal phones); notification to the donor if the agreement requires it; informing the protection working group without personal data; corrective action plan (question 3); follow-up of any incident reported by the households concerned.

Analysis: the data requested are exactly those that would make it possible to target people on the basis of ethnicity and age, in a context of arrests of young men. Sending them would expose people to serious violations, destroy community trust and compromise access and staff safety. The data were collected to provide assistance, with people's consent for that purpose only.

Principles: humanitarian principles (neutrality, impartiality, independence); the "do no harm" protection principle; purpose limitation and data minimisation; informed consent; data responsibility as described in the IASC operational guidance.

What can be shared: aggregated, non-sensitive figures (number of households and people per site, by sex and broad age group), if this serves assistance or the protection of the sites, without ethnicity or data that would identify small groups. The position is coordinated with country management, the protection working group and, if possible, a common position of humanitarian organisations (civil-military coordination).

Reply: "We acknowledge receipt of your letter and share your concern for the security of the sites. Our organisation collects personal data solely for the purpose of providing humanitarian assistance, with people's consent and under strict confidentiality rules. We are therefore not in a position to send named lists or data on the ethnic origin or age of household members. We can provide you with overall numbers per site, and we remain available to discuss, together with the other humanitarian organisations, measures for the security of the sites. Our country director is at your disposal for a meeting."

First three measures: (1) physically and digitally secure the case management files; (2) immediately delete all named data from personal phones and prohibit the sending of named files by messaging; (3) remove victim names from monitoring and ethnicity from registration if it is not needed. Then: training of the whole team, signed confidentiality agreement, written procedure for managing data incidents.

Protection working group: yes, aggregated and anonymised data (incidents by commune and by type), with no data that would allow a person to be re-identified (suppression of cells with very small numbers, for example fewer than 5).

Donor: no named list with telephone numbers. Alternatives: list by unique identifiers; verification by the monitoring agent of a sample of households that have consented to be contacted, contacted by the organisation; accompanied visit; or a data-sharing agreement specifying purpose, security, duration and destruction, if named verification is contractually required and consent provided for.

Other NGO: sharing possible for a compatible assistance purpose, but only under a data-sharing agreement, limited to the necessary data (name, identifier, household size), without sensitive vulnerabilities, and if the consent obtained covers this sharing; otherwise, the organisation can contact the households itself to obtain their agreement.

Five-rule protocol: (1) defined purpose, compatible with the collection; (2) minimisation: only the necessary data, aggregated by default; (3) never sensitive named data (GBV, associated children, ethnicity, alleged perpetrators) outside case management and consented referral; (4) transfer only through secure channels, with a written agreement and approval by the protection manager; (5) sharing register, retention period and confirmed destruction.

Monitor: no immediate dismissal under pressure from the team. The error is serious, but above all it reveals system failures (exports on phones, no rules, pressure from a government official not reported to management). I request a fair disciplinary procedure conducted by human resources, including a hearing of the monitor; in the meantime, I remove his access to named data. I gather the facts on the pressure he was under, which must be dealt with separately. I remind the whole team of the obligation to report this type of request.

Neighbourhood chief: I thank him and take the threats seriously: meeting with the security manager, threat analysis, security advice and, if he wishes and it is safe, referral to a protection actor. I do not disclose that he was the source of the report.