Putting it into practice An NHRI is working with other groups including HRDs to provide emergency aid in a region affected by a disaster. At the aid distribution centre, aid recipients are told to register their name, phone number and address. During registration and before being given aid, individuals are asked to check a box to consent for their personal information to be used for future projects, fundraising, and sharing with partner groups for research. Every person who registers checks the box to agree. This is not valid consent because: It is not freely given - the individuals seeking help are in desperate need of basic necessities, and they fear that refusing consent might prevent them from receiving aid. Consent cannot be considered freely given if the person may feel they have no real choice or fear negative consequences from refusal. It is not specific or fully informed – the individuals were told their details would be shared with several different groups with broad and vague purposes. They were not given the option to agree to one type of sharing but not others. Individuals should know exactly what their data will be used for, and consent must be sought for each distinct purpose separately. Being Transparent about your handling of personal information Individuals whose personal information you collect should be made aware of how their personal information will be handled, in particular: • What data is being collected (e.g., names, contact details, health data). • Why the data is collected (e.g., to deliver aid, manage donations, or for sending out information about meetings and events). • How the data will be used (e.g., to provide services, contact donors). • Who the data will be shared with (e.g., partner organisations or third parties). • How long the data will be retained and how it will be safeguarded. One common way to do this is through privacy and security policies and notices appearing on a web page, in an email, an SMS or other text messaging app, or on a paper form. But there are many situations where alternative approaches would be better at providing clear, accessible, and understandable information. The NHRI should decide on the approaches that are most relevant and best integrated into the particular activity that is being conducted. Data Protection Guidelines for NHRIs Toolkit 9