Re-Imagining a Responsible Approach to Informed Consent

Earlier in 2021, Human Rights Watch published a report about UNHCR’s improper collection and sharing of data pertaining to Rohingya refugees in Bangladesh, in which they found that the agency failed to conduct a full data impact assessment, as its own policies require. In some cases, the report shows, UNHCR had failed to obtain refugees’ free and informed consent to share their data with Myanmar, the country they had fled. The report sparked a discussion on the Responsible Data listserv about informed consent. 

This was not the first time – and will probably not be the last time  – that the topic of informed consent has taken centre stage in discussions among the RD community. Since its inception, the RD community has tried to grapple with the ethical challenges that the reliance on informed consent as a legitimate basis for data collection presents, particularly (though not exclusively) in the humanitarian aid sector. 

The promises and perils of informed consent in data processing

At its heart, informed consent is about upholding dignity for individuals and communities involved, regardless of who is doing the data collection – whether researchers, governments or aid organisations. 

In many cases, humanitarian organisations rely on informed consent from the communities they serve to legitimise the  collection and use of their information. The emergence of new technologies, however – combined with a rapid increase in the amounts of beneficiary data collected  – has heightened and widened concerns about the validity of informed consent in this context. 

Back in 2014, in the early days of the budding RD community, a small group of members came together to discuss what consent policies for civil society organisations can and should look like, recognising the thorniness of this topic. Not long after, the community explored the role of informed consent in crowdsourced and user-generated data for advocacy at a Responsible Data Forum in Nairobi, organised in partnership with Amnesty International. In many ways, the questions related to informed consent that emerged at this RDF still resonate today, as participants discussed its relation to technology, duty of care, and the education of data subjects. 

Seven years later, for the RD community these questions are still front of mind as we see examples of how data collection processes are insufficiently seeking informed consent of individuals whose data is being collected. Recent research has highlighted how data collection processes fail to take into account the particular experiences of vulnerable communities, and to integrate contextual interpretations of informed consent within these communities. Dragana Kaurin conducted research into the collection and use of personal data of refugees who arrived in Europe since 2013 and found that informed consent is rarely sought. When conducting research with migrants and refugees arriving in Italy in 2019, Data & Society noted that “there is a lack of meaningful informed consent in the collection of information from migrants and refugees,” and that, consequently, migrants may not be truly giving meaningful consent due to cultural differences, knowledge gaps, or power inequalities. Recent research by The Engine Room on the lived experiences of marginalised communities with digital ID systems in five countries also showed how informed consent processes were lacking in providing refugees with clear and accessible information about the processing of their personal data. 

In many of these cases, informed consent fails to take into account the specific contexts and needs of the communities at hand; particularly in environments with stark power imbalances, standard approaches to informed consent have proven to be insufficient in empowering these communities to exercise their agency. Ultimately, if an individual is not made aware of the implications of their choice or cannot say no, then consent to data processing cannot be regarded as valid.

Re-imagining our approach to informed consent

Seeking consent in a way that ensures those providing consent actually have the information, agency, control and alternatives they need and are entitled to is a key part of using data responsibly. However, if power asymmetries between those doing the collecting and those from whom data is collected prohibit the implementation of free and informed consent processes, can we consider informed consent a legitimate basis for data collection at all? 

As we continue to tackle this question within the RD community, we have witnessed how organisations are starting to recognise the limitations of informed consent. In a recent blog post that accompanied the publication of their biometrics policy, the ICRC wrote that in “rendering its data processing as transparent as possible to its beneficiaries and affected populations, it does not believe that consent provides a legally valid basis for data processing in many emergency situations.” 

As we continue to re-imagine the place of informed consent in the humanitarian space, we hope the RD community can continue to provide a space where practitioners can discuss what informed consent could, or should, look like in the future.