International Consultant - Data Protection Expert- Somalia Country Office - (55 days] - [Remote assignment with 2 missions to Mogadishu)

Contract

This is a Consultancy contract. More about Consultancy contracts.

2.1 Background

Poverty in Somalia is widespread, fuelled by economic challenges and on-going humanitarian crisis. Estimates suggest 7 in 10 Somali people live below the international poverty line, making Somalia the third poorest country in the region. A further 1 in 10 people are vulnerable to falling below the poverty line during a shock. In addition, chronic food insecurity and the resulting severe malnutrition among children under five years of age are a particular concern in Somalia. In the absence of a formal national social protection system, Somalis currently rely on traditional safety nets and humanitarian support.

The Ministry of Labour and Social Affairs (MoLSA) is implementing the Shock Responsive Safety Net for Human Capital Project (SNHCP), with funding of the World Bank and support of the World Food Programme (WFP) and UNICEF. The Component 2 of the SNHCP is on Delivery Systems and Institutional Capacity Building. This is implemented with support of UNICEF and aims to establish the key building blocks of a social protection delivery system, support policy development, strengthen institutional capacity of MoLSA and relevant government agencies to manage and implement a national cash transfer programme. A key element of this component is the development of a Unified Social Registry (USR).

The processes for the design and development of USR started in December 2020. The key design documents for the USR (including the concept design note, the Functional Requirements Document, Systems Design Document and the Hardware specification) of the USR have all been completed and development of the software and testing of the USR software is ongoing and scheduled to be completed by the end of the year. Other important elements that are needed to operationalize the USR is a country wide data protection and data privacy policy and legal framework and an agency specific data privacy and data protection guideline for the USR.

Several initiatives are also ongoing to enact the needed legislation to operationalize the USR. These include the development of Digital Identification Policy by the Ministry of Interior, Federal Affairs & Reconciliation of the Federal Government of Somalia. This policy has clearly identified the need to adopt several legislations (including the data protection legislation) as part of the steps for establishing an inclusive digital identification system. The policy also clearly sets out important elements and requirements of the data protection law, including the specific data protection principles and the rights of the data subjects that should be reflected in the law[1]. Further to this, the Ministry of Communication Technology has initiated procurement processes for a firm[2] that will support the Federal Government of Somalia to develop the enabling foundational legal framework for the digital economy, featuring laws in a number of areas including data protection.

Though the initial drafts of the data protection legislation are expected by the end of March 2022, as part of Baxnaano Component 2 on Delivery Systems and Institutional Capacity building, UNICEF is initiating through this consultancy assignment, the process to develop an organizational level data protection guideline for the USR. Though this guideline is expected to be aligned with the legislation, its development will run concurrently since the key elements of the data protection law are already outlined in the Digital Identification Policy. The USR data protection guideline will also draw from international best practices on protection of the privacy of persons.

2.2 Objectives

The assignment seeks to develop practical guidelines for the Agency that will be managing the Unified Social Registry based on its anticipated obligation as data controller and the rights of the data subjects as outlined in the digital identification policy of the FGS and international best practices. The operations of the USR involve inherent privacy related risk associated with the collection and handling of beneficiary personal data. The risks need to be identified and addressed using guidelines.

This guideline will ensure the USR operates in a way that protects the privacy of the individual and their personal data by regulating the processing of personal information and to provide the process to obtain, hold, use or disclose the personal information and related matters. It will also provide practical guidance for maintaining data security and protecting from both internal and external threats.

The USR, as key component of the social protection delivery system for Somalia, is expected to deliver the following core functions[3]:

• Gather and maintain information on Somalia’s citizens and households.
• Facilitate a harmonized survey for the collection of data about households’ basic information and living conditions.
• Enable multiple social programmes and services to use the collected information for their own targeting.

• Maintain an up-to-date registry, to the extent possible, through a two-way communication with programmes connected to the USR.

  Source: USR design Concept Note

[1] This is clearly captured under Annex 4 “General Data Protection Requirements” of the Digital Identification Policy developed by the Ministry of Interior, Federal Affairs & Reconciliation of the Federal Government of Somalia

[2] This assignment is led by the Ministry of Communication Technology, who is a beneficiary of a World Bank financed project called the Somalia Capacity Advancement, Livelihoods and Entrepreneurship through Digital Uplift Project (SCALED-UP).

[3] This is based on the Concept Note for the developing the Unified Social Registry for the Ministry of Labour and Social Affairs of the Federal Government of Somalia

UNICEF works in some of the world’s toughest places, to reach the world’s most disadvantaged children. To save their lives. To defend their rights. To help them fulfill their potential.

Across 190 countries and territories, we work for every child, everywhere, every day, to build a better world for everyone.

And we never give up.

www.unicef.org/somalia

How can you make a difference?

Scope of Work:

1. Review the concept note and the design documents of the USR to understand its scope of operations.

This will include understanding the various actors and their roles in the operation of the USR, and what data they would need in performing those roles. The consultant will review the data flow processes to understand the way in which data moves within, and in and out of the USR, and how this data flow might have an impact on data security and protection of beneficiary data. The consultant will also speak to the firm developing the USR to gain a detailed understanding of the USR design. The consultant will assess data protection risks and benefits of the original design perform initial and if appropriate enhanced risk assessment. This will include the following:

Performance of initial personal data risk assessment probing into questions such as: what types of data will be captured and processed; whose data? For what purposes; how captured; who will have access; data transmission channels; where, how and for how long will the data be retained, etc.

Review of risk assessment and if high data sensitivity, vulnerable populations, risky data sharing, etc.

then perform enhanced risk assessment where risks and benefits are weighted, solutions are probed into to minimize the risks (political, economic, social, emotional, economic, etc.) to individuals;

the risk assessments should provide specific guidance on measures to be taken to make sure privacy by design is built into the project and finished product.

2. Undertake a series of consultations with the relevant stakeholders of the USR including WFP and the consultants drafting the legislation for the data protection bill for Somalia

The purpose of these engagements to understand the specific data requirements for the transfer of data from WFP to the USR[1] and to get a high-level understanding and appreciation of the impending foundational legislation and the principles underpinning its evolution to inform the development of data security and data protection guidelines for the USR’s operation. These consultations will also enable the consultant to understand the risk associated with the USR operations in the context of Somalia from the perspective of these stakeholders to put in place the needed mitigating measures using these guidelines.

3. Draft the data privacy and data security guideline for the USR that highlights how the management of the USR shall uphold the data protection principles across all areas of its operations.

Though the initial concept design of the USR has been completed, the detailed operational procedures are yet to be developed and will run concurrently with this assignment. The data privacy and data security guideline will be influenced by the final draft of the detailed USR operational procedures and guide its finalization.

The draft the guideline will cover the entire operations of the USR, including any agencies that would be contracted to perform data collections activities. It will provide detailed guidelines for the various user roles identified in the USR, guidelines for ensuring that the IT systems are regularly checked, and actions taken to ensure robust cybersecurity, and guidelines for sharing data with other stakeholders and partners.

4 . Present the data protection guidelines to the relevant stakeholder forums for feedback and validation.

Develop a briefing note and PowerPoint presentation for an engagement with relevant stakeholders to share the guidelines and obtain feedback and validation. Revise the draft guideline based on the inputs from the stakeholders and provide technical support to MoLSA to gain the needed approval for this guideline from the FGS.

5. Develop training materials for training contracted enumerators and new on-boarded staff on the data security and data protection guidelines and train the USR staff to be able to deliver this training.

This component will develop power point presentations to cover both the fundamental aspects of data privacy and data protection as well as the applicable aspects of the USR data protection guideline for potential subcontractors, users, and staff members of the USR. the consultant will conduct a three-day ToT for the USR staff using the materials developed.

Tasks/Milestone:

Deliverables/Outputs:

Timeline

An inception report which maps out the data flows and identified risks based on a review of USR design documents

Inception

5 days (Feb 2022)

A report on the learnings from the consultations and implications for the development of the USR

Report on USR consultations

10 days (March 2022)

Draft data privacy and data protection guideline for the USR

Draft Data privacy and protection guideline

20 days (April 2022)

Briefing note and power point presentation on the guideline for stakeholder validation

Presentation

5 days (May 2022)

Final version of the data privacy and data protection guideline that have been approved by the FGS

Final report- guideline data protection

5 days (May 2022)

Training Deck in PowerPoint on data privacy and data protection for 3-day training for USR satff

Presentation

10 days (May 2022)

To qualify as an advocate for every child you will have…

• A qualified lawyer with an academic degree at master’s level or higher, preferably on data protection law.
• At least 7 years’ experience in conducting data compliance reviews and audits for organizations.
• Demonstrated deep knowledge of data privacy, data protection and data security issues.
• Strong technical knowledge/expertise on data security and data protection.
• Prior experience in developing data protection guidelines for social registries, beneficiary registries and cash transfer programmes.
• Fluency in written and spoken English is essential
• Fluency in Somali language is considered an asset

For every Child, you demonstrate…

UNICEF's values of Care, Respect, Integrity, Trust, and Accountability (CRITA).

To view our competency framework, please visit here.

UNICEF is committed to diversity and inclusion within its workforce, and encourages all candidates, irrespective of gender, nationality, religious and ethnic backgrounds, including persons living with disabilities, to apply to become a part of the organization.

UNICEF has a zero-tolerance policy on conduct that is incompatible with the aims and objectives of the United Nations and UNICEF, including sexual exploitation and abuse, sexual harassment, abuse of authority and discrimination. UNICEF also adheres to strict child safeguarding principles. All selected candidates will be expected to adhere to these standards and principles and will therefore undergo rigorous reference and background checks. Background checks will include the verification of academic credential(s) and employment history. Selected candidates may be required to provide additional information to conduct a background check.

Remarks:

Only shortlisted candidates will be contacted and advance to the next stage of the selection process.

UNICEF only considers Higher education qualifications obtained from an institution accredited/recognized in the World Higher Education Database (WHED), a list updated by the International Association of Universities (IAU), United Nations Educational, Scientific and Cultural Organization (UNESCO). The list can be accessed at http://www.whed.net

Individuals engaged under a consultancy or individual contract will not be considered “staff members” under the Staff Regulations and Rules of the United Nations and UNICEF’s policies and procedures, and will not be entitled to benefits provided therein (such as leave entitlements and medical insurance coverage). Their conditions of service will be governed by their contract and the General Conditions of Contracts for the Services of Consultants and Individual Contractors. Consultants and individual contractors are responsible for determining their tax liabilities and for the payment of any taxes and/or duties, in accordance with local or other applicable laws.