2.1 Confidentiality and Data Protection in UNHCR RSD Procedures 2.1.1 Protection of Personal Data and Duty of Confidentiality in UNHCR RSD Procedures The confidentiality of UNHCR RSD procedures is essential for creating an environment of security and trust for asylum-seekers and other individuals participating in UNHCR procedures, as well as for maintaining the integrity of UNHCR RSD procedures.1 All UNHCR staff, including interpreters and security staff, as well as any partners, counsellors or medical practitioners who provide services to asylum-seekers and refugees under an agreement with UNHCR, have a duty to ensure the confidentiality of personal data2 and other information received from or about such individuals in accordance with UNHCR’s data protection policy and confidentiality standards.3 This includes the fact that an individual has registered or is in contact with UNHCR. The duty of confidentiality extends to all communications with current and former asylum-seekers and refugees, as well as all personal data or information obtained from or about them by UNHCR staff and partners in the course of their activities.4 UNHCR standards regarding the protection of personal data of current and former asylum-seekers and refugees, as well as the confidentiality of other information provided by Applicants or otherwise gathered in the course of RSD should be incorporated into the procedures of every UNHCR Office. These standards should be understood and adhered to by all UNHCR staff and any other individuals who are responsible for implementing RSD procedures. Specific recommendations regarding the processing of personal data in the context of RSD and, more generally, the confidentiality of RSD procedures are set out in the relevant sections of this Unit and throughout the RSD Procedural Standards. These include, inter alia, procedures and measures for the protection against unauthorised disclosure and accidental loss or transfer of personal data and other information on individual RSD files, as well as measures to ensure 20 1 For example, an Applicant’s family members or individuals witnessing on an Applicant’s behalf, who may not themselves be persons of concern to UNHCR. 2 According to UNHCR’s data protection policy, personal data is any data related to an individual who can be identified from that data; from that data and other information; or by means reasonably likely to be used related to that data. Personal data includes biographical data such as name, sex, marital status, date and place of birth, country of origin, country of asylum, individual registration number, occupation, religion and ethnicity, biometric data (such as a photograph, fingerprint, facial or iris image), as well as any expression of opinion about the individual (such as assessments of the status and/or specific needs). 3 This implies that all UNHCR staff understand their obligations in respect to the confidentiality of personal data of persons of concern, including the relevant provisions in the Code of Conduct (see Principle 6) and UN Staff Rules (see Regulation 1.2). Interpreters must also sign an Undertaking of Confidentiality and Impartiality (see § 2.5.2 – Qualifications and Training of UNHCR Interpreters). For implementing partners, standard data protection clauses must be integrated into the standard Project Partnership Agreement. For operational partners and other third parties, UNHCR must seek written agreement that the personal data will be kept confidential at all times and if data transfers are likely to be large, repeated or structural, a Data Transfer Agreement must be instituted. 4 For further guidance on data protection of persons of concern, please refer to UNHCR’s data protection policy and guidance. The retention and storage of personal data of persons no longer of concern to UNHCR, including individual RSD files, must be done in accordance with UNHCR’s records and archives policy. Procedural Standards for RSD under UNHCR’s Mandate