Aid agencies mull legal risks of coordinating humanitarian cash

Editor’s Note: Devex is exploring the evolution of cash transfers in the aid sector. Here, we find out what questions aid agencies’ legal teams have about the approach. Read also: the EU’s vision for more coordinated cash programming. LONDON — As donors put more pressure on humanitarian agencies to collaborate on cash transfer programming, many in the sector are already putting their heads together to work out the legal implications of a more joined-up approach. Last year, the European Union’s humanitarian arm, ECHO, released new guidance for delivering cash transfers which envisions agencies working more closely together, in part by more readily sharing beneficiary data and financial service providers. While many say the aim behind the guidance is good, it has also sparked conversations about potential legal implications around data privacy, intellectual property, and reputational risk. Leaders at some major international aid organizations have been meeting to discuss the issue. “There was a big workshop with agencies and general counsels in San Francisco last December, looking at a couple questions around beneficiary registration and data privacy,” Alexa Swift, senior adviser on economic coping and recovery at Mercy Corps, told Devex. “After that workshop, a few general counsels including ours, led by the one at CARE, met a few times to talk about data sharing and data privacy.” As humanitarian agencies, donors, and financial service providers try to work out how the controversial new guidance will look in practice, some are pointing to legal questions about sharing and protecting beneficiary data; accountability in program delivery; and intellectual property over the tools and platforms offered by both agencies and private sector partners. “We have a lot of reservations about the ECHO vision and guidelines, and aren’t fully convinced that they’re going to get to what they envisioned or what they set out there without some problems,” Swift said. Beneficiary data protection Elizabeth Tromans, technical adviser on cash relief at the International Rescue Committee, explained that while ECHO’s vision for greater agency collaboration is promising, more should be done to make sure that shared beneficiary data — including biometrics, names, addresses, and family connections — doesn’t fall into the wrong hands. Tromans told Devex: “Coming from the last 10 years in the field, beneficiary privacy is the issue I think about the most. How can we do this in a way that protects the privacy of beneficiaries?” She pointed to Myanmar, where the government is believed to have orchestrated mass killings of the minority Rohingya Muslim population, more than 650,000 of whom have fled to Bangladesh. Under huge strain from its growing refugee population, Bangladesh has entered into negotiations with Myanmar to return refugees, despite evidence that the government is still persecuting Rohingya. As part of the negotiations, reports indicate that the government of Myanmar has already got hold of more than 4,000 Rohingya refugees’ biometric data, originally compiled by the United Nations High Commissioner for Refugees. “For Myanmar, that’s kind of the worst-case scenario,” Tromans said. With enhanced collaboration, Tromans said that data — clearly already vulnerable to exploitation — could be targeted by hostile groups, whether in the form of government, armed groups, or others. Even in the early days of increased alignment, these risks are compounded by insufficient staff training in the legalities and best practices around acquiring and sharing biometric data across the sector. For example, an internal U.N. report on the biometric system in Kenya in 2015 showed that "UNHCR did not consider it necessary to install encryption tools in the laptops used by the litigation teams and to conduct network penetration tests to ensure laptops and network connectivity are protected against any sort of unauthorized intrusion." Looking toward solutions, Tromans added that the Collaborative Cash Delivery Platform, a group of 15 humanitarian agencies, is already taking action to assess the risks and best practices in current data-sharing agreements, in anticipation of a more joined-up approach. “We’ve recently been pulling examples of anywhere that data-sharing agreements have been signed, so actual legal agreements between organizations,” she said. “So taking stock of those, seeing what worked well and what didn’t, and then from there, compiling the recommendations on how to do it carefully, with the protection principles in mind.” As one possible model, Tromans pointed to a previous agreement between three organizations to share data, where an IT provider served as a go-between, to identify gaps and duplication in the data, without sharing the actual information with the other organizations. “We did not have access to each other’s data, only our software provider did,” she said. “I never saw the data from the other two organizations and they never saw our data, so that might be one model to look at.” Who’s in charge here? The potential for reputational hazards is another question that legal teams have been exploring. In current humanitarian cash programming, one organization can own a program’s entire value chain, including contracting financial service providers, such as a bank or telecoms company. But ECHO’s new guidelines aim to separate out the components of the program and contract financial service providers directly to deliver the cash. This means that instead of liaising with the humanitarian agency, FSPs will work directly with ECHO. Swift said that while this could streamline contract negotiations and potentially simplify collaboration on cross-cutting programs, it might also hamper critical communication between the humanitarian agency and the FSP. “Most of the places where we do these programs, we do a lot of hand-holding, capacity building, and troubleshooting with the payments provider, so it's not just that we contract someone, hand over our list, and everything works out,” Swift said. She added that Mercy Corps has been “really concerned” that cutting out that link between the agency, which deals directly with the beneficiary community, and the cash delivery could create serious reputational risks to the agency, who are inevitably still the face of the operation when and if something goes wrong with payments. “That is the heart of our community relationship and our community management, so we were really nervous if that would raise sort of a security question if payments are late and we have no recourse to affect or change that,” Swift said. “We are publicly in the area where we’re working on the hook for the quality of the delivery of a service that we haven’t contracted and don’t control.” She added that in contexts with strong banking and financial systems, “it might not be a problem, but in a lot of the places we work, that is rarely the case. So it makes us nervous.” Trust can also be an issue between agencies forced to work in consortia. Ciara O’Malley, senior cash and markets adviser at CARE International, said that even now, agencies sometimes struggle to reconcile different standards and approaches for cash programming. “Because there is a lack of standardization and legal frameworks, this results in having a freelance approach to each organization and FSP about how data is handled, and some agencies are stricter than others,” she said. She explained that this creates enormous risk for the data being misused or displaced if it is being shared between organizations, and leads to the distrust that comes from “leaning on each other’s operational and technical strengths.” “If we are signing [up] to be part of a harmonized beneficiary data management platform, you want to be confident in the system. So if you don’t necessarily trust the aid agency who is responsible for that system, it could [fragment] potential coordination.” Sharing is caring As it stands, agencies contract FSPs, who then provide the agency access to their platforms or products, often with an agreement that the agency cannot share access to it since it is the intellectual property of the FSP. As ECHO assesses the market to see whether service providers might be open to a less exclusive arrangement, O’Malley said that from her perspective, it’s a big ask in such a competitive sector. She explained that the FSP “would have invested in the development of their software, and have their competitive edge, so they’re not exactly going to share this around.” For example, in Uganda, agencies can utilize mobile money in two ways: They can contract a mobile money operator directly, in which case the agency must use the operator’s software system; or the agency can use a third party private sector entity, which in Uganda is Beyonic Technologies. Beyonic contracts a number of mobile money operators, so an agency contracting Beyonic has a wider variety of operators in different geographies. “[Beyonic] act as a kind of middle man, but the whole competitive advantage of using this middle man is, one, that in a single cash transfer cycle you could transfer to multiple different mobile money operators, so not just Orange, but Africell too,” O’Malley said. “The other thing is that Beyonic online software is much more user friendly.” She said agency staff don’t need special training to use the software, which also automatically checks whether beneficiaries meet Know Your Customer compliance guidelines, a verification tool usually set out by the country’s central bank. For Beyonic, which operates in a competitive telecom market, she explained, expanding access to its tools could mean risking its competitive advantage. “Some of those companies are not going to give up their intellectual property to support humanitarian cash transfers,” she said, leaving a significant hurdle to overcome as donors push for closer cooperation.