UN shared Rohingya data inproperly

The United Nations refugee agency improperly collected and shared personal information from ethnic Rohingya refugees with Bangladesh, which shared it with Myanmar to verify people for possible repatriation, Human Rights Watch said on Tuesday.

The agency did not conduct a full data impact assessment, as its policies require, and in some cases failed to obtain refugees’ informed consent to share their data with Myanmar, the country they had fled, HRW said in a new report.

Since 2018 the UN High Commissioner for Refugees (UNHCR) has registered hundreds of thousands of Rohingya refugees in Bangladeshi camps and the Bangladesh government has issued them identity cards, which are needed for essential aid and services. Bangladesh then used the information, including analogue photographs, thumbprint images, and other biographic data to submit refugee details to the Myanmar government for possible repatriation.

“The UN refugee agency’s data collection practices with Rohingya in Bangladesh were contrary to the agency’s own policies and exposed refugees to further risk,” said Lama Fakih, crisis and conflict director at HRW. “UNHCR should only allow data that it collects to be shared with countries of origin when it has properly obtained free and informed consent from participants.”

Since 2016, over 800,000 Rohingya from Myanmar were expelled or fled crimes against humanity and acts of genocide across the border to Bangladesh. The Myanmar government continues to carry out crimes against humanity of apartheid and persecution against the remaining Rohingya population.

From September 2020 to March 2021, HRW interviewed 24 Rohingya refugees about their registration experiences with UNHCR in Cox’s Bazar, Bangladesh and spoke to 20 aid workers, analysts, local activists, journalists, and lawyers who observed or participated in the Rohingya registration. HRW sent detailed questions and its research findings to UNHCR in February and April, and received responses from UNHCR on May 10.

UNHCR denied any wrongdoing or policy violations, stating that it had explained all purposes of the data gathering exercise and obtained consent. The agency said that its data collection efforts were aimed at finding durable solutions for the refugees and that no Rohingya were put at risk.

In 2018, the Bangladesh government sought to supplement previous registrations by beginning a joint registration exercise with UNHCR. The government aimed to provide an identity card for refugees – called a “Smart Card” – that allows them to obtain aid and services. The government also sought to gather personal data collected by UNHCR to submit to Myanmar for repatriation eligibility assessments. UNHCR said this would help protect the refugees’ right of return.

In a January meeting with HRW, UNHCR said that field officers had asked Rohingya for permission to share their data for repatriation eligibility assessments, explaining that a Smart Card would still be issued to those who did not agree. “However, at the time of the registration exercise, UNHCR staff said publicly that the data was not linked to repatriations, including on a September 2018 Rohingya community radio show, and in November 2018 comments to international media. Rohingya refugees had in fact staged protests in the camps that month partly out of concern that data collection would be used to facilitate forced returns,” HRW said.

The refugees interviewed by HRW also gave a different account than UNHCR staff had outlined in the January meeting, according to the report.

All but one of the 24 said that UNHCR staff told them that they had to register to get the Smart Cards to access aid, and they did not mention anything about sharing data with Myanmar, or linking it to repatriation eligibility assessments. Three said they were told after giving their data that it might be used for repatriation purposes. One said he noticed after leaving the registration centre that the box to share data with Myanmar, on a receipt printed out and given to refugees only in English, had been checked “yes,” although he was never asked. He was one of only three among the refugees interviewed who could read English.

HRW said it viewed the English-only receipt that UNHCR gave to Rohingya refugees after their registration. It includes a box noting “yes” or “no” as to whether the information can be shared with the Myanmar government.

HRW interviewed 21 refugees whose names were included in the list verified by Myanmar for repatriation. Twelve of the 21 people were added to repatriation eligibility assessment lists in 2019 – lists drawn up based on the data collected by UNHCR.

“The 21 said that after being registered they later learned that their information had been shared with Myanmar and their names were on lists of people verified for return. They all went into hiding in other camps because they feared being forcibly returned. So far, Bangladesh has not forced any Rohingya in the camps to return against their will to Myanmar,” HRW said.

One of the 24 refugees interviewed said that the UNHCR field officer registering him asked if he consented to have his data shared with the Myanmar government. He said he felt pressure not to refuse: “I could not say no because I needed the Smart Card and I did not think that I could say no to the data-sharing question and still get the card.”

UNHCR in this case did not seek free and informed consent, which would have required making certain that the refugees knew and understood the risks of sharing their and their family’s data with Myanmar, that they had the ability to opt-out without prejudice, and that they could get the Smart Card even if they did not agree, according to the HRW report.

UNHCR staff told HRW that they did not discuss any specific risks with Rohingya before registering them, and the Rohingya interviewed said they were not told about any such risks.

Between 2018 and 2021, the Bangladesh government submitted at least 830,000 names of Rohingya refugees to Myanmar along with biometric and other data for each person, for repatriation eligibility assessments. Myanmar reportedly agreed to allow about 42,000 Rohingya to return. UNHCR told HRW that it played no role in drawing up these lists but that the names and other data included in the lists submitted from 2019 onwards, including biometrics, came from analogue versions of the data it had gathered during the joint registration exercise, for example, non-digital thumbprint images.

In its global guidelines on sharing information on individual cases, UNHCR acknowledges the risks of sharing such information and says that “UNHCR should not share any [individual case] information with the authorities of the country of origin.”

Bangladesh’s submission of lists to Myanmar may have put refugees, or at least the subset that Myanmar agreed to return, on track to receive Myanmar’s National Verification Cards (NVCs), which many Rohingya reject because they believe it undermines their claims to Myanmar citizenship.