7.2 Transfer of Personal Data
Only the UNHCR Policy, the APEC Privacy Framework and the ECOWAS Privacy
Framework are relevant in this context:
Within the scope of 6.1 of the UNHCR Policy, “UNHCR may transfer personal
data to third parties on condition that the third party affords a level of data protection
the same or comparable to [the] Policy”. This relates particularly to the following
basic principles (6.1.2):
• Transfer is based on one or more legitimate bases;
• Transfer is for one or more specific and legitimate purpose(s);
• The personal data to be transferred is adequate, relevant, necessary and not
excessive in relation to the purpose(s) for which it is being transferred;
• The data subject has been informed, either at the time of collection in accordance
with Part 3.1, or subsequently, about the transfer of his/her personal data, unless
one or more of the restrictions in Part 3.7 apply;
• The third party respects the confidentiality of personal data transferred to them by
UNHCR. Whether or not a data transfer agreement has been signed between
UNHCR and the third party, UNHCR must seek written agreement from the third
party that the personal data will be kept confidential at all times. In order to ensure
and respect confidentiality, personal data must be filed and stored in a way that is
accessible only to authorized personnel and transferred only through the use of
protected means of communication;
• The third party maintains a high level of data security that protects personal data
against the risk of accidental or unlawful/illegitimate destruction, loss, alteration,
unauthorized disclosure of, or access to it.
In addition, UNHCR needs to ensure that transferring personal data does not
negatively impact:
• the safety and security of UNHCR personnel and/or personnel of Implementing
Partners; and/or
• the effective functioning of an UNHCR operation or compromise UNHCR’s
mandate, for example due to the loss of the climate of trust and confidence
between UNHCR and persons of concern or the loss of the perception of
UNHCR as an independent, humanitarian and non-political Organization.
37
The APEC Privacy Framework has no particular legislation but includes some
recommendations for the development of Cross-border Privacy Rules:
III. Cooperative Development of Cross-border Privacy Rules
46. Member Economies will endeavor to support the development and recognition or
acceptance of organizations’ cross-border privacy rules across the APEC region, recognizing
that organizations would still be responsible for complying with the local data protection
37 See UNHCR Policy, pp. 35 f.
542
T. Hoeren
Only the UNHCR Policy, the APEC Privacy Framework and the ECOWAS Privacy
Framework are relevant in this context:
Within the scope of 6.1 of the UNHCR Policy, “UNHCR may transfer personal
data to third parties on condition that the third party affords a level of data protection
the same or comparable to [the] Policy”. This relates particularly to the following
basic principles (6.1.2):
• Transfer is based on one or more legitimate bases;
• Transfer is for one or more specific and legitimate purpose(s);
• The personal data to be transferred is adequate, relevant, necessary and not
excessive in relation to the purpose(s) for which it is being transferred;
• The data subject has been informed, either at the time of collection in accordance
with Part 3.1, or subsequently, about the transfer of his/her personal data, unless
one or more of the restrictions in Part 3.7 apply;
• The third party respects the confidentiality of personal data transferred to them by
UNHCR. Whether or not a data transfer agreement has been signed between
UNHCR and the third party, UNHCR must seek written agreement from the third
party that the personal data will be kept confidential at all times. In order to ensure
and respect confidentiality, personal data must be filed and stored in a way that is
accessible only to authorized personnel and transferred only through the use of
protected means of communication;
• The third party maintains a high level of data security that protects personal data
against the risk of accidental or unlawful/illegitimate destruction, loss, alteration,
unauthorized disclosure of, or access to it.
In addition, UNHCR needs to ensure that transferring personal data does not
negatively impact:
• the safety and security of UNHCR personnel and/or personnel of Implementing
Partners; and/or
• the effective functioning of an UNHCR operation or compromise UNHCR’s
mandate, for example due to the loss of the climate of trust and confidence
between UNHCR and persons of concern or the loss of the perception of
UNHCR as an independent, humanitarian and non-political Organization.
37
The APEC Privacy Framework has no particular legislation but includes some
recommendations for the development of Cross-border Privacy Rules:
III. Cooperative Development of Cross-border Privacy Rules
46. Member Economies will endeavor to support the development and recognition or
acceptance of organizations’ cross-border privacy rules across the APEC region, recognizing
that organizations would still be responsible for complying with the local data protection
37 See UNHCR Policy, pp. 35 f.
542
T. Hoeren