How to deal with sensitive data?
This technical tip is dedicated to the tension that exists between open data and information that should not be public. It is important to be aware of this issue and the things you can do to solve that tension.
In the sector of development aid, some things are sensitive. Maybe the subject matter of the project is not welcomed by the local government, perhaps the donor doesn’t want to be public, or there may be safety concerns for the implementing partner. What is sensitive and what is not, depends on the context and is sometimes a subjective judgement made by the people involved.
The first question is obviously: which of these data might be an issue when publicly shared, and why? In general, the most likely suspects are:
- Partner information (both implementing and funding partners)
- Location (country, geo coordinates, names of locations)
- Results and indicators
- Narrative (all descriptive text in your activity information, from title to project plan to comments on data anywhere)
How do you fix it?
For each of these, solutions are available. Partner information can be anonymised. Just call the partners ‘anonymous donor’, or ‘various implementing partners’. Obviously, only do this to avoid sensitive data going public. If you do this as a routine, the chain of information from original donor to the implementation in the field is broken. Traceability is an important part of IATI and should only be sacrificed if no other solution is possible.
The location is a common one as well. For example, if you work in LGBTQ programming, perhaps being very specific about a country can lead to issues on the ground. Maybe the issue is on subnational region: you would rather not mention specific villages to protect your beneficiaries. ‘Levelling up’ the location is the solution here. Where you would normally enter geo codes of names of locations, you can consider giving the country instead. Or where you would normally name the country, you may choose to stick to region.
Results and indicators may contain information that you have carefully edited out of the rest of the data. Two options here: rewording the result or indicator so it is no longer sensitive, or choosing not to publish the whole indicator or even result. If the first one is possible, that is preferable. Especially for a donor such as the Netherlands Ministry of Foreign Affairs, monitoring progress is hard when there are incomplete result data.
And of course, when there is reason to assume sensitive data is an issue in an activity, all narratives should be checked as well. You may have been careful elsewhere but still mention sensitive things in the project info somewhere else.
In all cases, having (and publishing) an exclusion policy is wise. The IATI Standard website has more information on what it should include. Of course, don’t add any sensitive information there either!
As a last resort, you may choose to not publish the activity at all. However, if it is possible to avoid that by going for one of the options above, that is preferable. And if the NL MFA is your donor, discuss it with your contact in the ministry. They may waive the IATI requirement for this activity.