Report on – 33rd IC Resolution 4: Restoring Family Links while respecting privacy, including as it relates to personal data protection (33IC/19/R4) – German Red Cross

Has your State/National Society/Institution incorporated the commitments contained in this resolution into the relevant strategic or operational plans?

Yes

The commitments are incorporated into:
Strategy
Legislation (e.g. Law, Regulation, Statutes, Rules of Procedure etc.)

At the International, Regional, National, Local level

Explanation:

The German Red Cross (GRC) Tracing Service continues to actively participate in the global “Restoring Family Links Code of Conduct on Data Protection Application Group“ (in line with OPs 5, 9, 12, 13 of the resolution). Standardized data protection templates (information for those searching and consent forms) have been developed for the international Restoring Family Links network, which are to be implemented by all National Societies and ICRC delegations by the next International Conference. In December 2022, tracing requests and declarations of consent adapted to data protection law were introduced across the GRC (in line with OP 7).

The GRC regularly exchanges with the department responsible for the GRC Tracing Service at the Federal Ministry of the Interior and Community (BMI) (in line with OPs 3, 7, 11). Due to the cyber-attack on ICRC servers in January 2022, on which personal data of GRC Tracing Service enquirers and their families was stored, a regulatory audit of the GRC Tracing Service was carried out by the Federal Commissioner for Data Protection and Freedom of Information (BfDI) (OPs 3, 7, 11), also strengthening the understanding for the humanitarian use of personal data by the Tracing Service.

The GRC uses an encrypted secure mail system when exchanging tracing requests with its regional and district branches. The GRC also uses an encryption system for transferring tracing requests abroad to other components of the Movement.

Has your State/National Society/Institution been working with other partners to implement the commitments contained in this resolution?

Yes

Partner with:
Government and/or public authorities
ICRC/IFRC

Examples of cooperation:

The GRC regularly exchanges and cooperates with German public authorities regarding the issues mentioned in the resolution. For example, during regular exchanges of the GRC with the BMI, issues such as the right to refuse to testify for Tracing Service employees, the Tracing Service’s access to relevant databases and the further development of the GRC Tracing Service Data Protection Act have been discussed.

Have you encountered any challenges in implementing the commitments contained in this resolution?

Yes

With challenges on:
Other

Details about challenges:

The COVID-19 pandemic as well as the cyber-attack on the ICRC’s tracing service infrastructure posed significant challenges to the implementation of the resolution.

Have the commitments contained in this resolution had an impact on the work and direction of your State/National Society/Institution?

Yes

Type of Impact:
Cooperation between Government/public authorities and National Society has been strengthened
Programming and operations have become more effective and efficient
Training and capacity of staff and volunteers has increased (for National Societies)
Other

Details about the impact:

The tracing requests and declarations of consent adapted to data protection law facilitate work on RFL. The regular exchanges of the GRC with the BMI and other public authorities strengthen the relationship between both entities, also making the GRC Tracing Service’s work more effective and efficient, since it can communicate its specific needs to the authorities and receive relevant feedback and/or support.

Have the commitments contained in this resolution had an impact on the communities that your State/National Society/Institution serves?

Yes

Description of the impact:

This resolution and its implications have brought attention to the fact that processing of personal data is an integral part of RFL services, with privacy and data protection being key in such work. Ultimately, this ensures and institutionalizes safeguards for the communities that GRC serves through RFL.