Digitalization and digital payments

Digitalization covers a wide spectrum of different areas, many of which are explored in the articles collected in this issue of the Review. Major trends impacting humanitarian action and the wider world include, but are not limited to, ubiquitous connectivity; big data; the impact of technological disruptors on traditional business models; the spread of misinformation, disinformation and hate speech; cyber warfare; surveillance; and artificial intelligence. Ubiquitous connectivity means that people are better connected than ever; in 2019, more than 53% of the world's population were able to access the InternetFootnote ⁵ and 67% had subscribed to some form of mobile communications services.Footnote ⁶

This digital connectivity – including the increased use of digital payments – both requires and generates huge quantities of data. The digitalization of this data, including financial data, is enabling increased surveillance, which today can be carried out by governments, lawfully or not, and by corporations that take advantage of the services they provide in order to gather, process or infer information. Additionally, as spying software becomes cheaper and easier to obtain, there are real-world risks beyond a basic invasion of privacy. Evidence shows that despite the duty of States to uphold and protect the rights of citizens, “surveillance of individuals – including government critics, journalists, and human rights advocates – is largely unimpeded, leading to detention, torture, and extrajudicial killings”.Footnote ⁷ Beyond the data itself, our digital world requires both physical and digital infrastructure. Cyber attacks – in the sense of hostile operations conducted through data streams against computers, computer systems, connected devices or networks – have been increasing year on year, and this has only been amplified during the COVID-19 pandemic.Footnote ⁸ Cyber attacks can target any infrastructure relying on connected networks, with real-world consequences; this can include financial systems, as we will explore later.

How we use money has also changed as a result of digitalization. If I were to ask you how much cash you are carrying in your pocket right now, what would your answer be? One dollar? Ten dollars? Nothing at all? Increasingly, people rely on digital payments – by card, by mobile phone or using internet banking – to pay for the goods and services they need, whether that be paying for groceries, a meal out, rent, or health insurance. Many times, I've seen a look of consternation on a person's face on that (rarer and rarer) occasion where a shopkeeper utters the words, “We don't take cards.” It does not follow, however, that cash will cease to exist. Numerous reports by central banks and financial experts, while recognizing the rise of digital payments, note that – to misquote Mark Twain – “reports of the death of cash have been greatly exaggerated”.Footnote ⁹

Though the terminology is likely to change as technology evolves, it is important to understand what is meant by the digitalization of cash, and digital payments, in order to have a common understanding of what we are speaking of, and to be able to analyze the impact of these phenomena on humanitarian action. In essence, we are talking about “digital payments” or “electronic transfers”, where money is moved electronically – for example, a bank transfer or mobile money transaction. The Electronic Cash Transfer Learning Action Network (ELAN), which has been a pioneer in the humanitarian sector on the use of digital payments, defines them as a “digital transfer of money or vouchers from the implementing agency to a program participant. E-transfers provide access to cash, goods and/or services through mobile devices, electronic vouchers, or cards (e.g., prepaid, ATM, credit or debit cards).”Footnote ¹⁰

Digital payments should not be confused with digital currencies such as Bitcoin, one of the most popular forms of cryptocurrency. Cryptocurrencies are digital forms of currency created by a public network, rather than any government, so they are not legal tender.Footnote ¹¹ There are countries – like Canada – that are considering introducing digital legal tender, thus making paper and metallic currency obsolete.Footnote ¹² However, a recent study of humanitarian CVA notes that despite the increased interest in distributed ledger technology and digital currency, “real-life application at scale is a long way off”.Footnote ¹³

For the purposes of this article, I will use the term “digital payments” to refer to end-to-end digital transactions. This means that both the payer and payee use an electronic medium of transfer (such as a bank transfer or mobile money transfer) and that the payment instrument (how the payment instructions are carried) is itself digital and not paper-based (i.e., not cash, cheques or money orders).

Of course, digital payments do not mean that no physical currency is involved. For example, a recipient might receive funds into their personal account and then withdraw some or all of the money in cash using an ATM card; or, with mobile money, the funds could be moved to the recipient's digital wallet, and then the person can make digital payments (e.g., an electronic payment in a shop) and can also “cash out” (e.g., withdraw cash from any point of sale).

In general, long gone are the days of humanitarians driving around with a Land Cruiser full of bank notes in order to be able to make payments to a community so that they can cover their needs, whether that entails buying food, clothes and households items, or paying for transport, shelter or health care. While it is true that there are still places where there are no means to transfer money electronically, humanitarians are increasingly disbursing funds digitally – through smart cards or mobile phones, or to people's bank accounts. It is the digitalization of the delivery of cash, and not just the cash itself, that is the game changer. The simple click of a button can put money in the hands of hundreds of thousands – if not millions – of people within minutes, and this is changing decades-old processes, opening the door to faster and more efficient delivery of life-saving assistance.

An evolution of the “do no harm” imperative: The example case of the ICRC

Hand in hand with the increasing use of digital payments comes the need to mitigate potential adverse spillover effects from this digitalization process. While recognizing that there is no such thing as a risk-free world, as a part of our duty of care to affected people, the humanitarian sector needs to think about the impact of its work, harnessing opportunities but also anticipating and minimizing possible negative impacts. This is where the imperative of “do no harm”Footnote ¹⁴ plays a crucial role. “Do no harm” requires humanitarian actors to endeavour not to cause further damage and suffering because of their actions.

First coined by Mary B. Anderson, this imperative is fleshed out in the first Protection Principle of the Humanitarian Charter and Minimum Standards in Humanitarian Response.Footnote ¹⁵ For its part, the ICRC emphasizes the “do no harm” imperative in its Protection Policy,Footnote ¹⁶ which highlights how it ensures that its actions do not have adverse impacts on, or create new risks for, individuals or populations. Beyond the ICRC, numerous humanitarian organizations have embedded “do no harm” into their work and policies over the decades, including when it comes to digital transformation processes, such as the digitalization of cash. Oxfam was one of the first agencies to develop an explicit policy on data responsibilityFootnote ¹⁷ and has produced toolkits and training for staff to help operationalize data responsibility throughout its programmes.Footnote ¹⁸ More recently, the United Nations (UN) Office for the Coordination of Humanitarian Affairs (OCHA) Centre for Humanitarian Data's work on data responsibility applies a “do no harm” lens in creating tools and guidance to help staff navigate the technical and ethical aspects of working with humanitarian data, including but not limited to data generated by digital payments.Footnote ¹⁹

Examining the digitalization of cash through the framework of “do no harm” – otherwise referred to as “do no digital harm” – is crucial as it allows humanitarian organizations to act ethically as we proceed in integrating digital transformations.

“Do no digital harm” is a critical imperative particularly in relation to the way humanitarian organizations and their partners manage data, implement activities and connect with affected people in the digital space. This applies equally to the way we use digital payments to support crisis-affected people. In the case of the ICRC, this means that not only does the organization use cash and vouchers (both physical and digital) in its responses, but it also has a clear understanding of how the digitalization of cash could impact humanitarian action, particularly in situations of armed conflict. The ICRC knows that “it is not enough to understand only the physical environment of armed conflict. It is essential to overlay this with readings of the virtual or digital environment.”Footnote ²⁰ To harness the opportunities that digitalization brings – for cash, but also beyond – the ICRC's implementation of the “do no harm” imperative is centred on ensuring that we keep the people we serve at the centre of our analysis.

CVA supporting people-centred responses

The advantages of CVA are well known: it increases affected people's dignity, power, autonomy and choice in how they manage their survival and recovery.Footnote ²¹ When it comes to putting affected people at the centre of our work, CVA is a critical tool because it puts financial resources in the hands of crisis-affected people so that they can recover, whenever and however they choose. In so doing, it enables affected people to make their own decisions – decisions which may well be different from those a humanitarian organization would make on their behalf. CVA has the potential to be transformative because it starts to change the balance of power between humanitarian agencies and crisis-affected people, as well as the multiple other stakeholders involved in humanitarian responses: donors, governments and civil society. When agencies are well prepared, CVA can be delivered quickly and at scale. Additionally, CVA can provide greater operational flexibility and achieve wider social and economic multiplier effects beyond its specific purpose, compared with in-kind assistance (giving goods directly). This is due to the indirect effects of cash transfers whereby increased expenditure by recipients contributes to income growth for non-recipients, expansion of markets for local goods, and increased demand for services.

Nevertheless, the use of CVA is subject to risks similar to those involved in providing in-kind assistance – market interference, accountability tracking, social tensions, protection issues – and these need to be managed carefully. In this respect, the digitalization of CVA can enhance both the benefits and risks for affected people. This is the focus of this analysis going forward: to highlight how the digitalization of cash is impacting humanitarian action, what the potential risks of the digitalization of cash are, and how we in the humanitarian sector can work to mitigate those risks.

Why digital payments?

This has been mirrored in a shift away from cash payments and towards digital payments in the humanitarian sector. For example, in the International Red Cross and Red Crescent Movement, more than half of all payments to affected people are today made digitally.Footnote ²³ This is in part because of the general global shift towards digitalization, but also because digital payments, transfers and remittances are considered by many actors, such as the World Bank, as contributing to the G20 goals of broad-based economic growth, financial inclusion and women's economic empowerment.Footnote ²⁴ The Better than Cash Alliance (BTCA)Footnote ²⁵ examined five main drivers behind the rise in digital payments, and concluded that digital payments bring:

• • Cost savings through increased efficiency and speed

• • Transparency and security by increasing accountability and tracking, reducing corruption and theft as a result

• • Financial inclusion by advancing access to a range of financial services, including savings accounts and insurance products

• • Women's economic participation by giving women more control over their financial lives and improving economic opportunities

• • Inclusive growth through building the institutions that form the bedrock of an economy and the cumulative effect of cost savings, increased transparency, financial inclusion, and greater women's economic participation.Footnote ²⁶

Additional factors have played a role in the shift towards digital payments, including safety and security concerns, as handling large amounts of cash can be very visible and can put recipients or humanitarian staff delivering the cash at risk of theft or looting – much as can be the case with in-kind assistance. For the recipient, holding money in an account rather than keeping cash under their mattress is generally safer. Another important factor is the recipient's preferences – where people already use digital payments in their daily lives, it makes sense to use the same mechanisms that they are familiar and comfortable with.

At the time of writing, almost a year into the COVID-19 pandemic, a new driver can potentially be added: the perception that digital payments decrease the risk of virus transmission. Although it has been concluded in previous studies looking at influenza that “handling banknotes and coins is not practically avoidable and will confer no discernible increased risk compared with handling almost any other communal object used in daily life”,Footnote ²⁷ there has been a general preference for digital payments during the COVID-19 pandemic. Digital payments, such as mobile money transactions or using debit or credit cards, require less handling than physical currency. Additionally, the hardware involved (cards, mobile phones, point-of-sale devices etc.) can be regularly cleaned with a simple disinfectant. A guidance note on CVA and health during COVID-19 issued by the World Health Organization (WHO) and the Global Health Cluster emphasized the preference for digital payments, which reduce the need for people to gather at distribution points and allow for regular disinfection of surfaces such as ATM keypads, noting that “where this is possible, contact-less electronic or mobile payments should be the preferred option to reduce the risk of transmission”.Footnote ²⁸

How humanitarians have embraced digital payments

Although different humanitarian organizations have used cash assistance over the decades, it was the formation of the Cash Learning Partnership (CaLP) in 2005, to promote and improve CVA across the humanitarian sector, which first structured the conversation around CVA, and with it, digital payments. By the early 2010s, and with increasing evidence of the effectiveness of CVA behind us, there was a convergence, and several collaborative initiatives emerged. The BTCA, which launched in 2012 in response to public and private sector demand, continues to provide strategic advocacy, research and guidance on how to transition to electronic payments. 2016 saw the launch of the ELAN, and during a four-year project this network produced numerous valuable resources for practitioners, hosted learning events, and contributed to growth and foresight in the humanitarian sector's work on digital payments. This period also saw a significant investment by the world's largest humanitarian network, the International Red Cross and Red Crescent Movement, in building its capacity to deliver CVA,Footnote ²⁹ with the majority of its payments being made digitally. Such approaches require a level of interoperability between the various humanitarian agencies carrying out this work, which means in terms of risk-benefit analysis, the entire humanitarian sector is affected by the use of digital payments in its operations.

As outlined above, digital payments are becoming more and more prominent in the humanitarian sector. However, this raises the question: what are the risks and benefits of this facet of digital transformation? In the following section, I will address this question by outlining how the ICRC analyzes when to use digital payments.

How the ICRC uses digital payments in armed conflict and other situations of violence

Like many others within the humanitarian sector, the ICRC has embraced the use of both physical and digital payments, based on a thorough analysis of the risks and benefits for people affected by armed conflict and other situations of violence. As will be highlighted in the following sections, not only has the ICRC been using CVA for over 100 years, but the organization also has a critical focus on digital risk and data protection.Footnote ³⁰ Thus, the ICRC's work can serve as an example of how to examine digital risks in CVA.

A dip into the ICRC's archives shows that it was already using cash transfers during the First World War, when its International Prisoners of War Agency was in charge of processing money orders and forwarding registered letters, including money, sent to interned civilians and prisoners of war by their families.Footnote ³¹ Today, the ICRC uses CVA in the majority of its eighty-plus operations, and its experience demonstrates that it is possible to use CVA in armed conflicts and other situations of violence.Footnote ³² From 2012 to 2020, the ICRC has seen a 600% increase in the number of people reached with CVA across its programmes, ranging from small cash-in-hand transfers to help families pay for transport costs to visit detained relatives, to larger grants for rebuilding homes or starting income-generation activities. During this time there has been a huge increase in digital payments, with most large-scale transfers – those to large numbers of people – being made digitally.

The choice between (physical) cash payments or digital payments is made very pragmatically by ICRC teams, based on what resources and services are available in a given country. In South Sudan, for example, where there are extremely limited means of digital payments, small-scale payments – for example, to help a separated person pay for transport to be reunited with their family – are made in cash directly to the affected person. Compare this to Somalia, where the ICRC makes most of its payments digitally as the population have long been using mobile money. The ICRC asks itself what payment instruments people are familiar with, which ones they have access to, which will be fast, efficient and safe for affected people and for ICRC staff alike. This sometimes means using multiple payment methods in one country. For example, in the Democratic Republic of the Congo, the ICRC uses three: cash payments directly to people, digital payments via mobile money, and digital payments via personal accounts held with cooperatives.

Of course, it is not a choice between digital payments or no payments at all; cash remains a valid payment instrument in many cases. In Ukraine, to accompany its work supporting families with the search for missing persons, strengthening the authorities’ capabilities to conduct the search according to international standards, and providing psychosocial, legal and administrative support to families, the ICRC also provided monthly payments to enable the families to better meet their basic needs. These payments were made in cash directly to the families by ICRC staff, in part because this gave the staff a practical reason to visit the families regularly. ICRC staff noted that they would not feel comfortable visiting the families every month if they had no new information about the missing person, whereas making the cash payments provided a reason to visit. The team considered that with digital payments, this vital contact would have been much less frequent and the relationships – and trust – with the families may have taken longer to build.

Digital payments are not universally accessible.

We must start this examination of “do no digital harm” with a focus on the affected people themselves. The fact is, digital payments are not accessible to everyone in the same way that cash is, and the increase in digital payments may deepen the “digital divide” (defined as inequality in access to technology and its associated benefits). Any person can use cash if they can get their hands on it, and providing the goods and services they need to pay for are available. For the recipient, cash does not require any formal identification or any physical infrastructure. Cash is not linked to the person, and as such does not discriminate or identify.Footnote ³⁴ It simply requires the coins or notes that are the means of exchange, and a basic level of numeracy.Footnote ³⁵ However, to use digital payments, the recipient will require a level of digital and financial literacy. It is estimated that only one in three adults globally shows an understanding of basic financial concepts, and that there are lower standards of financial literacy amongst women and the poor.Footnote ³⁶ The recipient will also require a personal account with a financial service provider and will be subject to Know Your Customer (KYC)Footnote ³⁷ regulations set globally by the Financial Action Task Force (FATF), transposed into national law by States and applied by every commercial service provider. While the FATF requires “identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information”,Footnote ³⁸ most States transpose this to mean a legally accepted form of identification such as a passport, birth certificate or national identity card. According to the World Bank, an estimated 1 billion people – that is, 13% of the world's population – do not have an official proof of identity.Footnote ³⁹ Some 91% of these live in low-income or lower middle-income countries, and among these, one in two are women in low-income countries.Footnote ⁴⁰ There are many reasons why people do not have an official proof of identity, including low levels of literacy, the often high costs of official documents (which are a barrier for the poorest), legal requirements that vary for different sections of the population in a given country, absence or paucity of national identity management systems or lack of resources committed to ensuring that all citizens are registered, or simply that it is not common practice in a community to register with the authorities. These issues are often exacerbated by armed conflict and other situations of violence, where State services may be disrupted and shifting frontlines inhibit movement of people and change geographical boundaries, sometimes leaving people living in territories where their identity documents are no longer recognized as valid.

Of course, if communities have no access to digital payments, humanitarians can choose to provide cash payments, vouchers, in-kind assistance or services. The problem arises when most of a population do have access, leading agencies to choose digital payments and thus resulting in the possible – albeit unintentional – exclusion of those groups without access. Humanitarians must always have the flexibility to offer a variety of solutions, in order to ensure that no one is left behind.

Digital payments are often promoted based on the concept that they drive financial inclusion; however, financial inclusion does not necessarily translate to financial well-being. Clear links have been established between increased financial inclusion, poverty reduction and economic security, but it is not as simple as ensuring that people have access to financial services. A 2017 study conducted by the ICRC and the British Red Cross in Nigeria and Kenya found that, in these contexts, “people's main problem remains poverty and not financial inclusion”.Footnote ⁴¹ The provision of digital payment options will not, in and of itself, automatically lead to financial inclusion.

The increased focus on linking humanitarian cash assistance to social protection adds governments – the main providers of social protection systems – into the mix, bringing complicated protection and coordination concerns. This focus is only increasing due to the COVID-19 pandemic and the predicted global economic depression, which will stretch existing governmental social protection and humanitarian aid systems to the limits of their capacities and beyond. However, making these links is not a straightforward matter; the findings of a recent practitioner surveyFootnote ⁴² show that the main perceived challenges of linking CVA with social protection systems remain a lack of coordination between actors, the fact that social protection systems are not designed to be shock-responsive, lack of experience of humanitarians in social protection, and that governments are not perceived as impartial in addressing the needs of the most vulnerable. As the UN has noted:

These exclusions can be exacerbated in times of crisis, and particularly in conflict. In contexts where the rule of law is weak and corruption is endemic, certain people and groups will benefit – and some will suffer – from the changes to the economic model brought about by conflict. Humanitarians have a role to ensure that marginalized groups and those that face protection risks are supported, whether that be through existing systems or through humanitarian protection and assistance activities.

There is also a risk of conflating digital and physical proximity. Digital payments may allow vital assistance to be provided to communities remotely, but this does not mean that humanitarians do not need to be present in communities; field teams still need to conduct assessments in order to get a true picture of needs and then follow these up with monitoring and evaluation to gauge the impact of interventions on the affected communities. Digital proximity – for example, through digital payments – “does not replace the need for physical access to vulnerable communities nor can it replace wider efforts to ensure they enjoy protection under relevant laws”.Footnote ⁴⁴

Data responsibility in humanitarian action

To ensure inclusion in digital payments, humanitarian organizations must collect and process an enormous amount of data, including the personal data of affected people who wish to access those payments. Whether using a “closed loop” system managed entirely by the humanitarian agency, or working through local financial service providers, this data must be securely collected, managed, stored and shared in line with good data management practices.

CaLP's 2020 State of the World's Cash report highlights that “digital risk and data management is a ‘newly emerged risk’” and notes that “whilst some large operational CVA actors (by their own admission) are now on top of responsible data management, many CVA practitioners still find this a paralysing topic”.Footnote ⁴⁵

A series of events in 2019,Footnote ⁴⁶ some focusing specifically on CVA and others on humanitarian action more broadly, explored digital risks and the concepts of “do no digital harm” and “digital dignity” as part of the digital transformation of humanitarian action. Several themes emerge when examining digital risks in humanitarian action, and more specifically the risks associated with digital payments, but fundamentally they are all rooted in the core topic of data responsibility, “a set of principles, processes and tools that support the safe, ethical and effective management of data in humanitarian response. This includes data privacy, protection, and security, as well as other practical measures to mitigate risk and prevent harm.”Footnote ⁴⁷ Data responsibility requires humanitarians to collect, manage, store and share data conscientiously.

The issue of data responsibility is frequently raised when aiming for collaboration between humanitarian agencies. There have been several initiatives related to improving collaboration for delivery of CVA, including the Collaborative Cash Delivery NetworkFootnote ⁴⁸ and the UN common cash system.Footnote ⁴⁹ Such collaborative approaches have been broadly welcomed in the spirit of fostering greater collaboration, in line with Grand BargainFootnote ⁵⁰ commitments to increase the effectiveness, efficiency and accountability of CVA operations and provide better support to those affected by crises.Footnote ⁵¹ However, they have experienced various challenges. Questions have been raised around intellectual property rights in co-created systems, the complexity of data interoperability, and issues of power and resource control between different agencies. Lack of data interoperability and data sharing between agencies that are using collaborative platforms is a significant impediment to programme quality, contributing to delays in programming and meaning that use of information cannot be maximized. Data sharing requires trust in each other's systems and data management and protection practices. In February 2019, the World Food Programme (WFP) and data analytics and intelligence-gathering firm Palantir Technologies signed a $45 million partnership, attracting criticism

The partnership raised questions about the implications for the UN common cash system and how data collected by any organization participating will be protected, along with how this could impact the affected people that the system seeks to serve.

The rise of digital identities and the use of biometrics

Technology-assisted innovation in digital identity has increased in recent years and is often used in programmes providing CVA. But what is digital identity?

Combined with other credentials, they can also answer the question, “Are you who you claim to be?”

A digital identity is not automatically an official or legal proof of identity; only governments can provide legal identification to citizens, although many are choosing to do so digitally. In Estonia, seen as the world leader in digital integration, it is mandatory for every Estonian citizen above the age of 15, and every European citizen residing in Estonia, to obtain the Estonian digital identity card.Footnote ⁵⁴ India has the world's single largest biometric-based digital identification system, called Aadhaar.Footnote ⁵⁵

The digital identities created by humanitarian organizations, enabling people to have access to their programmes, are therefore not official legal identities, and as such have limited use beyond their specified purpose, unless negotiated with the relevant authorities (such as in the case of refugee ID cards issued by the Office of the UN High Commissioner for Refugees (UNHCR), which provide access to services beyond those provided by the UNHCR, including financial services in some casesFootnote ⁵⁶). The creation of digital identities also raises the question of ownership of those identities. The 2019 Wilton Park conference on “Digital Dignity in Armed Conflict” concluded that “to promote digital dignity, individuals who receive aid should be perceived as data agents who have agency over their digital identity and digital anonymity”.Footnote ⁵⁷ There could be significant risks in creating interoperable systems and identity frameworks for vulnerable groups, who may have very good reasons for wishing to remain anonymous, and who could face discrimination or worse by virtue of their being identifiable.

Biometrics are one such form of digital identity. Biometrics were primarily developed and deployed for the purposes of border and migration control, and were then widely deployed in updated national identity systems. It is the drive for legal identity meeting due diligence requirements that makes biometrics so attractive, because they cover both needs. However, this blurring of the boundaries between immigration control and counterterrorism or security makes biometrics collected by private actors and humanitarian organizations particularly interesting for States.Footnote ⁵⁸

The use of biometric identification systems by humanitarian organizations to support digital identity has significantly increased, due to the perception that they bring efficiency and accountability to operations, in particular with regard to reducing fraud.Footnote ⁵⁹ However, this rapid uptake of biometrics has caused much debate. The early use of biometrics by the UNHCR was seen as a success story, but a UN internal audit in 2016 found that in four out of five country operations reviewed, the information being given to refugees about the biometric programme was insufficient for them to be properly informed. Footnote ⁶⁰ As an example, in response to the Rohingya refugee crisis, biometrics enabled the UNHCR and its partners to cope with a crisis of enormous scale and speed, but some have argued that this has created risks for the Rohingya refugees:

Taking a measured approach, in 2015 Oxfam imposed a moratorium on the use of biometrics in its work,Footnote ⁶² later stating that “given the number of unknowns … we felt it was best not to become an early adopter”.Footnote ⁶³ The ICRC has long used biometrics, but only to support the implementation of its mandate where particular objectives cannot be realized without using them, for example in forensics and the restoration of family links: “In this case the ICRC processes the biometric data as a matter of ‘public interest’ (in the implementation of the ICRC's mandate).”Footnote ⁶⁴ When it comes to using biometrics for beneficiary management and assistance distribution, the ICRC's stance differs:

While the use of biometrics is increasing in daily life – fingerprint scans are promoted as an easy way to secure your smartphone, for example – it can still be possible to “opt out”. However, increasingly in humanitarian programming, this possibility is somewhat theoretical, as proving your identity is linked to assistance delivery. Biometrics in and of themselves are not inherently risky, but as we will explore below, the processing of any personal data is sensitive and subject to various risks and concerns.

Data protection: Protecting life, integrity and dignity

The risks highlighted so far have the issue of identity at their core: how do people prove who they are, who owns that identity, and what is done with the identity data that people provide? Directly related to the issue of identity is that of data protection. Anyone with an email account will remember the introduction of the European Union's General Data Protection Regulation, which became enforceable in May 2018, and with it the flood of emails asking us to give our consent to our data being used. Who among us ever reads the reams of pages of terms and conditions before shopping online or downloading an application on our smartphones? People give away their data freely all the time without necessarily considering the implications, the desire for convenience and connectivity often overriding the potential risks, even when their trust in companies or governments is low. For example, despite initial concerns after the Facebook/Cambridge Analytica privacy scandal,Footnote ⁶⁶ and with very little actual improvement to privacy for its users, Facebook's user numbers continue to climb, with a 12% rise year on year.Footnote ⁶⁷

Protecting individuals’ personal data is an essential part of protecting their life, integrity and dignity, which makes the protection of personal data of fundamental importance for humanitarian organizations. Humanitarians frequently collect personal data in order to carry out their mandate, whether that be to trace missing people, to help reunite separated families or to provide life-saving assistance. When it comes to digital payments, data protection is a critical issue because in order to make or receive payments through a financial service provider, recipients must identify themselves, and humanitarian organizations must therefore collect and share people's personal data. As new technologies allow for exponentially faster and easier processing of this data, there are increasing concerns about privacy. While the right to privacy has been recognized globally as a human right since 1948,Footnote ⁶⁸ the right to have one's personal data protected is more recent, with the first regional data protection treaty entering into force almost forty years later.Footnote ⁶⁹ Today, a majority of States, the UN and international organizations with a humanitarian mandate recognize core data protection principles, even if the content of policies and scope of legislation varies across the world.Footnote ⁷⁰ However, the very circumstances within which humanitarian organizations operate – crisis situations – create unique challenges regarding data protection.

For humanitarians, obtaining the consent of recipients for the processing of their personal data is one of the first challenges. In the context of data protection, consent means the freely given, specific and informed indication of a data subject's (i.e., the recipient's) wishes by which they signify agreement to personal data relating to themselves being processed. This means that “the individual must be put in a position to fully appreciate the risks and benefits of data Processing, otherwise Consent may not be considered valid”.Footnote ⁷¹ Using consent as a legal basis for data processing differs from the way the humanitarian sector has traditionally used consent as a basis for its humanitarian responses. Data processing by humanitarian organizations – including the ICRC – is often “based on vital interest or on important grounds of public interest, for example in the performance of a mandate established under national or international law”.Footnote ⁷² This means that consent does not have to be valid for data processing to go ahead, provided that the processing is being carried out on the legal basis of “public interest”.

However, we must recognize that the very concept of freely given consent in a crisis is a misnomer, particularly if consenting to the processing of personal data is a precondition for receiving assistance. If you had lost everything and someone was offering to help you, you would likely accept that help with very few questions asked and would pay very little heed to complex legal questions about what might happen to your data and what the potential future risks may or may not be. Ensuring informed consent is also a challenge when data protection policies include complex legal concepts which many of us would struggle to understand, regardless of levels of literacy and education. One of the key recommendations from the 2019 Wilton Park conference was that:

Of course, data protection is important across the full spectrum of humanitarian work, but it has a particular resonance when it comes to digital payments. The use of digital payments requires humanitarians to outsource part of their supply chain, which can be positive in terms of efficiency and accessing specific expertise, but also requires giving up a level of control in terms of the management of data. The very nature of digital payments requires sharing of data with a third party – the financial service provider who will facilitate the digital payment. Once transferred, the data is therefore no longer under the humanitarian organization's control.

Key concerns relating to data protection arise when using digital payments through financial service providers, who are bound by national legislation implementing FATF recommendations.Footnote ⁷⁴ Concerns include the use of data by authorities for law enforcement purposes, including surveillance and profiling of individuals, and the use of personal data for commercial purposes, such as service providers offering targeted services or advertisements, or profiling customers for creditworthiness. Data may also be used to cross-check people against master lists of customer debts, potentially leading to the financial institution directly deducting sums owed from the humanitarian assistance a person is set to receive. There are times when data protection concerns mean that digital payments are not appropriate, even if they are available. This is particularly common in conflict environments and other sensitive settings, where the choice of financial service providers is often limited and tends towards control by one particular party to the conflict.Footnote ⁷⁵

In many cases, people already have a relationship with a financial service provider, such as a bank or a mobile money operator; these individuals have already accepted and fulfilled the necessary requirements (including KYC) to access the service, and as such accept the benefits and risks that come with this. While this does not absolve humanitarians of their responsibility to undertake the necessary due diligence, there is a difference between, on the one hand, leveraging an existing financial relationship that a recipient has, and, on the other, asking someone to commence a new financial relationship for the sole purpose of receiving assistance through digital payments.

While the risks to individuals are critically important, there is a second layer of risk. We cannot ignore the fact that the personal data collected by humanitarians may be accessed by authorities, via financial service providers, and used for law enforcement purposes, which can have potential risks for wider humanitarian action. As the ICRC has observed:

Both outcomes could eventually lead to a reduction in essential humanitarian services for the affected population.

Beyond the legitimate and legal use of data, the data collected, stored, shared and analyzed by humanitarian agencies can be valuable to parties to the conflict. Data which identify people, their locations, their networks and their connections can be used with malicious intent by individuals, groups or organizations. It is not only the data that we commonly understand as personal data (e.g. name, phone number) but also the often overlooked metadata – data that provides information about other data – which is a mine of information, for those who know how to use it. General Hayden, former director of the US National Security Agency and Central Intelligence Agency, articulated this most clearly when he said “[w]e kill people based on metadata”,Footnote ⁷⁷ highlighting how metadata is used to make life-and-death decisions. In an age of increased surveillance, the protection risks for people of concern are clear: “[e]ven though software typically can't kill people directly in the way that bullets can, the end result is often the same”.Footnote ⁷⁸ Metadata has always existed – for example, the information contained on the outside of a letter which says nothing of its content but still provides information on the sender and recipient. However, with digital information flows and transactions – whether financial or of any other type – the quantities of metadata generated are huge. For example, the volume of metadata generated by mobile money transactions is immense. The issue is not simply the volume of this metadata but rather what can be inferred by it, including what social groups people belong to (if a particular group was targeted for assistance), where they may have moved after the crisis, and their “network of family or friends, based on transfers received or made that didn't involve the humanitarian organisation. Information can then be inferred about these individuals in turn, even though they were not directly involved” in the programme.Footnote ⁷⁹

The way in which metadata can be used for good while simultaneously eroding the privacy of the individual has been very clearly highlighted by the rapid development of contact tracing apps during the COVID-19 pandemic, many of which require users to upload personal information and to agree to their location being tracked and shared using different types of geolocation technology. As of July 2020, close to fifty countries were developing or had rolled out contact tracing apps to help fight the spread of the disease.Footnote ⁸⁰ While some countries, such as South Korea, have credited the use of contact apps with “flattening the curve” of the disease, helping to bring the outbreak under control, there are real privacy concerns being raised. An analysis of COVID-related apps by Privacy International exposed some of the risks of adopting these technologies, not least that “apps are notorious for their lack of security and privacy safeguards, exploiting people's data and devices”.Footnote ⁸¹ While billions of people around the world have accepted restrictions on their day-to-day life in the service of bringing the pandemic under control, there will be limits; now people are “being asked to trust governments with their proposed apps – of which there are many. These are the very same governments who have been keen to exploit data in the past.”Footnote ⁸² Reducing privacy standards in an emergency could be the start of a slippery slope; once standards have dropped, it can be difficult to raise them again.

Cyber security and the increase in cyber attacks

Digital payments also require an infrastructure, both digital and physical. Payments infrastructure requires computers and servers, which must physically be based somewhere and which require energy to run and resources to maintain. Infrastructure can break down, and it can also be damaged, particularly in situations of armed conflict.Footnote ⁸³ If the electricity fails or the “computers are down”, the economy may come to a standstill. In 2018, a massive outage of the Visa payment system left millions in Europe unable to make payments.Footnote ⁸⁴ The same happened to MasterCard a few weeks later, disrupting digital payments globally.Footnote ⁸⁵ A statement from Visa said the issue was not associated with any unauthorized access or cyber attack, but this is a real risk when it comes to critical infrastructure, and alongside health, water, energy and transport infrastructure, financial infrastructure is indeed critical. In 2019, financial services firms reported huge year-on-year increases in the number of cyber attacks, breaches and data thefts, with 25% of all malware attacks being made against financial services organizations, more than any of the other twenty-seven industries monitored.Footnote ⁸⁶ The COVID-19 pandemic is likely to push more and more financial institutions to become fully digital, and with this increasing reliance on e-commerce and contactless payments, there should be continued investment in resilient payment systems.Footnote ⁸⁷ However, humanitarian organizations are also at risk: “Humanitarian organisations collect, store, share and analyse data that is attractive to parties to armed conflict. … As a result, humanitarian organisations are exposed to a growing wave of digital attacks and cyber espionage, and have become highly prized targets.”Footnote ⁸⁸ In the summer of 2019, the UN was the target of a complex cyber attack: “‘The attack resulted in a compromise of core infrastructure components’, said UN spokesperson Stéphane Dujarric, who classified it as ‘serious’. … The ‘core infrastructure’ affected included systems for user and password management, system controls, and security firewalls.”Footnote ⁸⁹ When it comes to digital payments, data collected to make payments to recipients can be at risk of “hacks” while held with the humanitarian organization, and again when held by the financial service provider.

Risk cannot be entirely eliminated

As noted above, the risks in using digital payments can never be entirely avoided, only mitigated. Critical risks including exacerbating the digital divide, increased cyber attacks and data breaches, unknown implications of the creation and use of digital identities, and wider concerns around data protection which must be weighed against the benefits of digital payments. Decisions must be taken mindfully and based on each country or population group, as the severity of impact can change for different groups in different situations. Affected people must have the option to opt out of providing personal data (biometric or otherwise) without it prejudicing their access to essential assistance. Risk analysis – a weighing of the cost–benefit parameters – should be done in consultation with affected people themselves. While the risk may be the same for different groups, the impact of that risk on people's daily lives can vary wildly, and we should listen to their perspectives when taking decisions. A Ground Truth Solutions study which found that “users want cash transfers delivered through mechanisms that are flexible, trustworthy and reliable”Footnote ⁹⁰ dovetails with other evidence – both researched and anecdotal – that people prefer payment mechanisms with which they are familiar, whether those are digital or not. Expecting people in crisis situations to absorb new risk or trust unfamiliar systems is a big ask and must not be undertaken unless it is in their best interest and with their agreement. It is not only today's risks that are a concern; technology is developing much faster than we can keep pace with, and it is obvious that humanitarians cannot accurately imagine all possible future risks. Despite this, we must continue to examine the risks and benefits of digital solutions, including digital payments, while respecting the principle of “do no digital harm”.

Closing the digital divide

If digital payments are not accessible to all, there are several measures that humanitarians can take, depending on the cause. Sometimes the issue is simply that people have never used digital payments before. In this case, basic financial literacy classes can be provided to ensure that people are comfortable with the payment instrument being used. For example, Mercy Corps “embraces a broad definition of financial inclusion, seeking to improve access [and] ensure quality and actual usage of financial products and services”, and one of its key strategies is increased client-level financial capability.Footnote ⁹¹ Organizations such as the Center for Financial InclusionFootnote ⁹² and the Consultative Group to Assist the PoorFootnote ⁹³ were founded with the very objective of promoting financial inclusion and advocating for inclusive, responsible finance. The ICRC, where possible, tries to use financial service providers that people already hold personal accounts with, so that they are familiar and comfortable with the services, have already met the KYC requirements and are not being asked to trust unfamiliar systems. If the issue is that people cannot meet the KYC requirements, this can be harder to resolve. The ICRC can refer people to legal services to help them obtain missing documentation such as identity papers, and even cover the costs of these documents if needed. Humanitarian agencies such as the Danish Refugee Council, Norwegian Refugee Council, UNHCR and a host of local actors include legal advice and the provision of, or advocacy for, key documentation as part of their services. If people cannot access digital payments services, humanitarians must be ready to offer alternatives such as cash payments or in-kind assistance. It can be challenging to offer different options; for example, if digital payments are not a solution for many people, making cash payments to large numbers of people can be logistically complicated, and setting up a new pipeline to procure and deliver in-kind assistance instead will take time. Humanitarian organizations must ensure that they have the infrastructure and procedures in place for in-kind assistance, cash, vouchers or digital payments where appropriate, enabling them to switch if needed.

While many humanitarian organizations are using technologies to improve digital proximity to populations, such as harnessing different means of (two-way) digital communications, monitoring population movements remotely, or making digital payments so that people can pay for essential goods and services, they must continue to balance both physical and digital proximity. The ICRC will continue to negotiate for unimpeded access to people affected by armed conflict. Being accountable to people affected by armed conflict is a key element of the organization's identity and the essence of its operational model, which is based on proximity to affected people.

Digital identities and personal data: protecting data “by design”

When it comes to digital identity, humanitarian organizations should take a measured approach to their engagement. If humanitarian organizations use biometrics, thus creating digital identities, steps must be taken to ensure that those digital identities are used only for the specified purposes and are securely managed. Affected people must have the information they need to make an informed decision and to have agency over their digital identity and digital anonymity, and must have the ability to opt out of having a digital identity created on their behalf, without it prejudicing their access to assistance. A middle-ground option may be provided by the development of different forms of “self-sovereign identities”, such as blockchain-based identities where the data subject has a digital identity but has ultimate control over who can access it.

In discussing how to mitigate risks related to data protection, it is imperative to analyze the situation of affected people. Some people may be at greater risk of negative consequences due to their individual characteristics, such as their legal status, their socio-economic situation, their race, or their religious or political affiliations. This can be exacerbated in situations of armed conflict, which often fall along ethnic or socio-political fault lines. It is also important to understand how the financial service provider will both store and use the data that it receives from humanitarian organizations to facilitate the digital payments. This is influenced both by the financial service provider's own company practice and by national legislation. For example, the ICRC has checklists that highlight data protection “red flags” and issues of concern which it would wish to discuss or negotiate with the provider. However, the humanitarian sector must be realistic; while it should be possible to negotiate that the service provider only uses the data provided to facilitate the digital payment and not for marketing or analyzing creditworthiness, obligations such as mandatory reporting under national legislation cannot be negotiated. Significant investment is being made by humanitarian organizations in tools and guidance to support analyzing data protection concerns with digital payments. A new short course hosted by CaLP focuses on e-transfers and operationalizing beneficiary data protection.Footnote ⁹⁴ The ELAN Data Starter KitFootnote ⁹⁵ is designed to help humanitarians plan and improve data management practices, while the Mercy Corps E-Transfer Implementation Guide Footnote ⁹⁶ provides a step-by-step walkthrough on implementing e-transfers and includes support on analyzing the regulatory environment, KYC requirements and including data protection in its contracting. Many organizations, including UN agencies and NGOs, have their own internal data protection policies and guidance.

In short, every humanitarian organization must complete its due diligence. For the ICRC, this means firstly determining the likelihood of the risk – how likely is the data to be compromised? – and secondly determining the impact of the risk on the individual – how severe would the consequences be for the individual, as well as for the perception and acceptance of the ICRC by the population and the parties to the conflict? In practical terms, this entails ICRC teams completing a Data Protection Impact Assessment, which will help to identify the privacy risks to individuals, identify data protection compliance liabilities for the ICRC, protect the ICRC's reputation, and ensure that the organization does not compromise on the neutrality of its humanitarian action.Footnote ⁹⁷ Similarly, CaLP has shared guidance on data protection in CVA, including model privacy impact assessments,Footnote ⁹⁸ and this work is being built on by multiple humanitarian organizations.

It is critical that any risk assessment – whether for data protection or any other area of risk – includes consulting the affected population themselves. In Afghanistan, the ICRC considered using mobile money transfers to make digital payments. People living in Taliban-controlled communities were well aware of the possibility of geolocalization through mobile phones, and while they said that they trusted the ICRC to protect their data – and often gave the organization their phone numbers so that its teams could be in contact with them – they were concerned about how the mobile money companies would use their data, or which groups their data might be passed to. In direct contrast to this, in Ukraine, where ICRC teams discussed digital payments and technologies, the local communities – somewhat fatalistically – told the organization that the authorities already had all their data (through passport records, mobile phone and banking records, and even through Facebook), and as such, they didn't see any additional risk in the ICRC collecting and sharing their data. These two examples show how different people's perspectives of the likelihood and impact of risk can be, and why it is essential to take affected people's views into account when analyzing risk.

From a pure data protection perspective,

This can be particularly useful for people who have no formal identity document, or where the risk of their data being shared with the financial service provider is deemed too high. Of course, this approach does not allow for financial inclusion, as the person does not have access to a personal account.Footnote ¹⁰⁰

Assessing critical infrastructure

In terms of financial infrastructure, it is much easier to assess its availability than its security. Humanitarian organizations can assess several issues, including the provider's liquidity, its geographical coverage, including the number of points of sale (locations and capacity of those places where recipients can make onward digital payments or “cash out”), and the availability of customer support services. With the growing risk of cyber attacks on financial infrastructure, it becomes more complex and difficult to analyze the security of that infrastructure. Beyond analyzing past incidents in the country and which providers they have affected – likely only from publicly available sources, as financial service providers do not disclose all hacks – there is a limit to what a humanitarian organization can do to be sure of the stability and safety of financial infrastructure. Humanitarians can, however, ensure that they implement appropriate technical and operational security standards in their own operations, and processes should be put in place for the protection of people's personal data from loss, theft, damage or destruction; this includes back-up systems and effective means to respond to security breaches and prevent unauthorized access, disclosure or loss of data that humanitarians store. The Handbook on Data Protection in Humanitarian Action also recommends that humanitarian organizations “protect ‘by design’ the Personal Data they obtain from beneficiaries …. Encryption or compartmentalization of information can be viable solutions to meet this need.”Footnote ¹⁰¹

Data responsibility: From theory to practice

All of these mitigation measures fall under the broad category of data responsibility. The OCHA Centre for Humanitarian Data has attempted to address gaps in guidance through its series on data responsibility, providing guidance on a wide range of issues including data incident management.Footnote ¹⁰² However, this remains a critical area for investment.

Of course, humanitarians can't predict the future; we cannot know all the myriad ways in which the data we collect today could be used for different purposes tomorrow, employing technologies that may not even exist today. However, all humanitarian agencies need to ensure data minimization – i.e., that only the personal data necessary for the identification of individuals should be collected and processed for the explicit humanitarian purpose of making the digital payments. Any “excess” information should not be collected, or if collected, should be deleted. We must ensure that the technologies we use to create digital ID, to store, process and share data and to communicate with affected people are secure. While it is vital to uphold clear standards on data protection, the humanitarian sector must also accept that it is impossible to fully protect data from every possible breach or misuse. More fundamentally, we should start from the fact that access to humanitarian assistance should not depend upon people being forced to disclose their personal information.Footnote ¹⁰³ With robust data responsibility policies and practices, and thoughtful decision-making, we can do our due diligence, taking measures to analyze the risks that the method of assistance – and in the case of CVA, the payment instrument – exposes people to, and mitigate them.