encompasses techniques that can be used to ensure that data sets containing Personal Data are fully and irreversibly anonymized so that they do not relate to an identified or identifiable natural person, or that the Data Subject is not or no longer identifiable.

refers to “[a] set of sciences, theories and techniques whose purpose is to reproduce by a machine the cognitive abilities of a human being”.Footnote ¹ In its current form, it aims to allow technology developers “to entrust a machine with complex tasks previously delegated to a human”.Footnote ²

or biometric recognition means the automated recognition of individuals based on their biological and behavioural characteristics.

is “in essence an append-only decentralized database that is maintained by a consensus algorithm and stored on multiple nodes (computers)”.Footnote ³

Cash Transfer Programming, cash-based interventions and cash-based assistance are terms in the humanitarian sector to describe the delivery of humanitarian aid in the form of vouchers or cash.

Computer Emergency Response Team

Chief Information Security Officer

most commonly refers to “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction”.Footnote ⁴

means the freely given, specific and informed indication of a Data Subject’s wishes by which the Data Subject signifies agreement to Personal Data relating to him or her being processed.

Computer Security Incident Response Team

Chief Security Officer

Chief Technology Officer

denotes the practice of combining very large volumes of diversely sourced information (big data) and analysing them, using sophisticated algorithms to inform decisions.

means the unauthorized modification, copying, unlawful destruction, accidental loss, improper disclosure, or undue transfer of, or tampering with, Personal Data.

means the person or organization who alone or jointly with others determines the purposes and means of the Processing of Personal Data.

means the person or organization who processes Personal Data on behalf of the Data Controller.

or DPIA means an assessment that identifies, evaluates and addresses the risks to Personal Data arising from a project, policy, programme or other initiative.

means a natural person (i.e. an individual) who can be identified, directly or indirectly, in particular by reference to Personal Data.

refers to “a collection of electronically captured and stored identity attributes that uniquely describe a person within a given context and are used for electronic transactions”.Footnote ⁵

in the context of this Handbook means a Humanitarian Organization’s internal data protection office or Data Protection Officer.

are small aerial or non-aerial units that are remotely controlled or operate autonomously. They are also known as Unmanned Aerial Vehicles (UAVs) or Remotely Piloted Aircraft Systems (RPAS).

means additional Processing of Personal Data that goes beyond the purposes originally specified at the time the data were collected.

means data related to the physical or mental health of an individual, which reveal information about their health status.

means any activity undertaken on an impartial basis to carry out assistance, relief and protection operations in response to a Humanitarian Emergency. Humanitarian Action may include “humanitarian assistance”, “humanitarian aid” and “protection”.

means an event or series of events (in particular arising out of armed conflicts or natural disasters) that poses a critical threat to the health, safety, security or well-being of a community or other large group of people, usually over a wide area.

means an organization that provides aid to alleviate human suffering, and/or protects life and health, and upholds human dignity during Humanitarian Emergencies in accordance with its mandate and/or mission.

stands for Infrastructure as a Service.

includes any act of transferring or making Personal Data accessible outside the country or International Organization where they were originally collected or processed, including to a different entity within the same Humanitarian Organization or to a Third Party, via electronic means, the Internet or other means.

means an organization and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.

is a process enabling businesses to check the identity of their customers in order to comply with regulations and legislation on money laundering and corruption.Footnote ⁶

is a specific form of Artificial Intelligence that can be defined as the study of algorithms that improve their performance when completing a certain task with experience in the form of machine-readable data.

Platform as a Service

means any information relating to an identified or identifiable natural person.

means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, or erasure.

as distinct from Anonymization, means the Processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.

describes the process of turning allegedly Anonymized or Pseudonymized data back into Personal Data through the use of data matching or similar techniques. If the risk of Reidentification is deemed to be reasonably likely, the information should be considered to be Personal Data and subject to all the data protection principles. It can be very difficult to assess the risk of Reidentification with absolute certainty.

Software as a Service

means Personal Data which, if disclosed, may result in discrimination against or the repression of the individual concerned. Typically, data relating to health, race or ethnicity, religious/political/armed group affiliation, or genetic and biometric data are considered to be Sensitive Data. All Sensitive Data require augmented protection even though different types of data falling under the scope of Sensitive Data (e.g. different types of biometric data) may present different levels of sensitivity. Given the specific situations in which Humanitarian Organizations work and the possibility that some data elements could give rise to discrimination, setting out a definitive list of Sensitive Data categories in Humanitarian Action is not meaningful. Sensitivity of data as well as appropriate safeguards (e.g. technical and organizational security measures) have to be considered on a case-by-case basis.

A service-level agreement is an official commitment between a service provider and a client, particularly for the provision of reliable telecommunications and Internet services.

is a person unaccounted for, for whom a tracing operation has been launched.

is a person or organization that is engaged by a Data Processor to process Personal Data on its behalf.

is any natural or legal person, public authority, agency, or any other body other than the Data Subject, the Data Controller or the Data Processor.

Transport Layer Security is a cryptographic protocol to provide privacy and data integrity between a client and a server over an Internet connection.