UN shared Rohingya data without informed consent: HRW

The United Nations High Commissioner for Refugees (UNHCR) improperly collected and shared personal information from ethnic Rohingya refugees with Bangladesh, which shared it with Myanmar to verify people for possible repatriation, Human Rights Watch said today.

The agency did not conduct a full data impact assessment, as its policies require, and in some cases failed to obtain refugees' informed consent to share their data with Myanmar, the country they had fled.

Since 2018, the UNHCR has registered hundreds of thousands of Rohingya refugees in Bangladeshi camps and the Bangladesh government has issued them identity cards, which are needed for essential aid and services. Bangladesh then used the information, including photographs, thumbprint images, and other biographic data to submit refugee details to the Myanmar government for possible repatriation.

"The UN refugee agency's data collection practices with Rohingya in Bangladesh were contrary to the agency's own policies and exposed refugees to further risk," said Lama Fakih, crisis and conflict director at Human Rights Watch. "UNHCR should only allow data that it collects to be shared with countries of origin when it has properly obtained free and informed consent from participants."

Since 2016, over 800,000 Rohingya from Myanmar were expelled or fled crimes against humanity and acts of genocide across the border to Bangladesh. The Myanmar government continues to carry out the crimes against humanity of apartheid and persecution against the remaining Rohingya population.

From September 2020 to March 2021, Human Rights Watch interviewed 24 Rohingya refugees about their registration experiences with UNHCR in Cox's Bazar, Bangladesh and spoke to 20 aid workers, analysts, local activists, journalists, and lawyers who observed or participated in the Rohingya registration. Human Rights Watch sent detailed questions and its research findings to UNHCR in February and April, and received responses from UNHCR on 10 May.

UNHCR denied any wrongdoing or policy violations, stating that it had explained all purposes of the data gathering exercise and obtained consent. The agency said that its data collection efforts were aimed at finding durable solutions for the refugees and that no Rohingya were put at risk.

In 2018, the Bangladesh government sought to supplement previous registrations by beginning a joint registration exercise with UNHCR. The government aimed to provide an identity card for refugees – called a "Smart Card" – that allows them to obtain aid and services. The government also sought to gather personal data collected by UNHCR to submit to Myanmar for repatriation eligibility assessments. UNHCR said this would help protect the refugees' right of return.

In a January meeting with Human Rights Watch, UNHCR said that field officers had asked Rohingya for permission to share their data for repatriation eligibility assessments, explaining that a Smart Card would still be issued to those who did not agree. However, at the time of the registration exercise, UNHCR staff said publicly that the data was not linked to repatriations, including on a September 2018 Rohingya community radio show, and in November 2018 comments to international media. Rohingya refugees had in fact staged protests in the camps that month partly out of concern that data collection would be used to facilitate forced returns.

The refugees Human Rights Watch interviewed also gave a different account than UNHCR staff had outlined in the January meeting. All but one of the 24 said that UNHCR staff told them that they had to register to get the Smart Cards to access aid, and they did not mention anything about sharing data with Myanmar, or linking it to repatriation eligibility assessments. Three said they were told after giving their data that it might be used for repatriation purposes. One said he noticed after leaving the registration center that the box to share data with Myanmar, on a receipt printed out and given to refugees only in English, had been checked "yes," although he was never asked. He was one of only three among the refugees interviewed who could read English.

Human Rights Watch viewed the English-only receipt that UNHCR gave to Rohingya refugees after their registration. It includes a box noting "yes" or "no" as to whether the information can be shared with the Myanmar government.

Human Rights Watch interviewed 21 refugees whose names were included in the list verified by Myanmar for repatriation. Twelve of the 21 people were added to repatriation eligibility assessment lists in 2019 – lists drawn up based on the data collected by UNHCR.

The 21 said that after being registered they later learned that their information had been shared with Myanmar and their names were on lists of people verified for return. They all went into hiding in other camps because they feared being forcibly returned. So far, Bangladesh has not forced any Rohingya in the camps to return against their will to Myanmar.

One of the 24 refugees interviewed said that the UNHCR field officer registering him asked if he consented to have his data shared with the Myanmar government. He said he felt pressure not to refuse: "I could not say no because I needed the Smart Card and I did not think that I could say no to the data-sharing question and still get the card."

UNHCR in this case did not seek free and informed consent, which would have required making certain that the refugees knew and understood the risks of sharing their and their family's data with Myanmar, that they had the ability to opt-out without prejudice, and that they could get the Smart Card even if they did not agree.

UNHCR staff told Human Rights Watch that they did not discuss any specific risks with Rohingya before registering them, and the Rohingya interviewed said they were not told about any such risks.

Between 2018 and 2021, the Bangladesh government submitted at least 830,000 names of Rohingya refugees to Myanmar along with biometric and other data for each person, for repatriation eligibility assessments. Myanmar reportedly agreed to allow about 42,000 Rohingya to return. UNHCR told Human Rights Watch that it played no role in drawing up these lists but that the names and other data included in the lists submitted from 2019 onwards, including biometrics, came from analog versions of the data it had gathered during the joint registration exercise, for example, non-digital thumbprint images.

In its global guidelines on sharing information on individual cases, UNHCR acknowledges the risks of sharing such information and says that "UNHCR should not share any [individual case] information with the authorities of the country of origin."

In the Myanmar context, risks include involuntary Rohingya returns to Myanmar, particularly given Bangladesh's forced repatriation of Rohingya to Myanmar in the 1970s and 1990s. In those cases, UNHCR tacitly condoned Bangladesh's coerced returns.

Bangladesh's submission of lists to Myanmar may also have put refugees, or at least the subset that Myanmar agreed to return, on track to receive Myanmar's National Verification Cards (NVCs), which many Rohingya reject because they believe it undermines their claims to Myanmar citizenship.

The UNHCR-Bangladesh exercise appears to have violated the agency's policy on protecting personal data that it collects, which requires UNHCR to tell people in a language and manner they understand why it is collecting their data and whether it will be transferred to another entity. It also appears to have undermined the objective of UNHCR's policies that aim to ensure that consent is not coerced.

UNHCR's Handbook on Voluntary Repatriation says that the agency should never directly link registration or other verification exercises with registration for voluntary repatriations because "[l]inking the two may create confusion for the refugees by giving the impression that one needs to register for voluntary repatriation in order to be entitled to assistance in the country of asylum. This may seriously jeopardize voluntariness."

Linking the eligibility assessment and registration for services did create confusion, Human Rights Watch said. Nearly all of the refugees interviewed did not understand that their data would be shared with the Myanmar government. In the one case in which the refugee was told that it would be, he said he felt he could not refuse consent without jeopardizing his access to services.

UNHCR should have recognized that Bangladesh sharing data with Myanmar raised serious protection concerns. "[T]he idea of sharing data with Myanmar, or allowing data to be shared with Myanmar, on this community should have been out of the question until there were minimum guarantees in place – which there aren't," said an aid worker familiar with the process in Bangladesh.

Finally, UNHCR has a policy requiring a data protection impact assessment before it enters into data transfer arrangements like the one in Bangladesh. However, staff said they did not carry out a "full-fledged" impact assessment, only undertaking several risk assessments prior to signing the data-sharing agreement with Bangladesh. The apparent failure to take into account the history of forced returns from Bangladesh to Myanmar, in those assessments, is important.

UNHCR should not combine collecting people's data for services or identity cards with data collection for repatriation eligibility, Human Rights Watch said. UNHCR should ensure that people who agree to have their data shared are able to withdraw that consent and know how to do so. The agency should only share data or allow data that it collects to be shared with countries of origin when it has taken all efforts to obtain free and informed consent.

"Humanitarian agencies obviously need to collect and share some data so they can provide refugees with protection, services, and assist with safe, dignified, and voluntary returns," Fakih said. "But a refugee has the right to control their data, who has access to it, and for what purposes, and UNHCR and other agencies should be accountable to those whose data they hold."