Job Description

Title: Consultancy to undertake Caafimaad+ HIP 2024 Data Protection Impact Assessment

Location: Twenty-three (23) districts in Banadir, Bay, Bakool, Gedo, Lower Shabelle, Lower Juba, Middle Shabelle, and Mudug regions

Tentative time of Assessment: 15 January – 28 February 2025

Key Working Contacts: Caafimaad Plus Consortium Management Unit

A. Background

Caafimaad+ Consortium, a Heath & Nutrition Consortium in Somalia initiated in 2020, implements integrated Health, Nutrition, WASH, and Protection services in twenty-three (23) districts of 8 regions across five states in Somalia. The consortium comprises 5 INGOs namely Action Against Hunger (Lead), Concern Worldwide, International Medical Corps, SOS Children’s Village, and Trocaire, alongside 4 local NGOs Juba Foundation, Lifeline Gedo, SHACDO, and Youthlink. The overall objective of the program is “Contribute to the reduction of morbidity and mortality associated with acute malnutrition, natural disasters (drought/floods), displacements, and other shocks among vulnerable population in South and Central Somalia”. The key objectives are:

• Increase access to a package of basic health services at community, primary and secondary health levels, especially for women, children and vulnerable populations
• Increase access to free quality curative and preventive nutrition services at community, primary, and secondary levels
• Improving access to safe, sufficient water, sanitation facilities and waste management services at health facility level
• Women, girls, boys and men in target locations have improved access to safe, timely, lifesaving GBV services
• Vulnerability of the targeted communities to external shocks is reduced through agile life-saving interventions answering to immediate needs brought by rapid onset disasters

The consortium partners implement in 23 districts located in Banadir, Bay, Bakool, Gedo, Lower Shabelle, Lower Juba, Middle Shabelle, and Mudug regions of Somalia. Implementation modalities include health/nutrition facility-based, community-based, and outreach mobile. The consortium handles sensitive personal data as part of its integrated emergency response humanitarian services. These data are health, nutrition, and protection related that are utilized at all levels of the program from direct service delivery to management decision-making. Currently the consortium reporting system is largely paper based, using MOH registers, with an ongoing digitalization that involves electronic medical records (EMR) for consultations and Logistics Information Management System (LIMS) to monitor prescriptions and supplies. The facility-based systems submit data, either manually or electronically to the Ministry of Health DHIS2 and IDSR systems, with the data also being accessed for programmatic reporting. To comply with the General Data Protection Regulation (GDPR) and to ensure the rights and freedoms of individuals are upheld, a DPIA is required for the Caafimaad+ consortium projects.

B. Purpose of the DPIA

The assessment aims to:

1. Review and assess the Caafimaad+ reporting systems, both paper-based and digital, and their linked systems.
2. Assess the potential data protection risks associated with Caafimaad+ consortium integrated emergency response program.
3. Assess compliance with applicable data protection laws like the GDPR.
4. Recommend practical and actionable measures to mitigate identified risks.
5. Document the Data Protection Impact Assessment (DPIA) in a structured and comprehensive manner

C. Scope of Work

The consultant/team will:

• Review project documentation, to understand the nature of the program, assess the types of data collected, identify data flows, and engage with key stakeholders.
• Conduct risk assessments using a well-defined criterion to identify potential risks to data subjects along the lines of ethical, legal, security, privacy, and other concerns.
• Analyze the assessed areas of risk for impact by likelihood of occurrence and severity considering the types of data and processing involved.
• Propose actions to mitigate or eliminate risks at all levels, that include technical, administrative, organizational, or other controls.
• Develop a detailed DPIA report that encompasses all the assessment findings, risks identified and their severity, potential impacts, and mitigation recommendations.
• Field Mission: The consultant will detail the types of people they plan to interview, the reason for the interview, and the interview methodologies. These will include but are not limited to key project stakeholders such as the program management, program staff, consortium partners staff, MOH officials, Donor representatives, local authorities, and communities.

D. Reporting:

The consultants will produce an interim report which will be presented to the Consortium Management Unit (CMU) and key stakeholders. The Final DPIA Report incorporating the comments from key stakeholders will thereafter be developed and presented to the CMU.

E. Key Considerations

• This assessment will cover highly sensitive health records of individual patients, as well as relevant household level information.
• The geographical scope of the evaluation will cover the project sites in different regions of Somalia. However, simple random sampling of some consortium operating areas and communities will be done in to maximize on the time allocated for the evaluation.
• Gender concerns should be addressed in line with the Action Against Hunger Gender Policy throughout the evaluation process.
• All data should be disaggregated by sex and age and different needs of women, men, boys and girls should be considered throughout the evaluation process.
• Gender and decision making of both men and women and access and control of assets, resources and services in the EU Humanitarian Aid funded project should be considered.

F. Deliverables

The consultants will provide the following key deliverables:

The consultant will provide:

1. An initial scoping document outlining the assessment approach and timeline.
2. A risk assessment matrix identifying and classifying risks.
3. A final DPIA report, including:
   • Executive summary
   • Description of data processing activities
   • Risk analysis and mitigation recommendations
   • Compliance guidance specific to the project
4. A presentation summarizing findings to key stakeholders.

G. Timeline

• The consultant will provide proposed timeline for completing the assessment within the provided timeframe, clearly indicating the milestones such as: Contract Signing, Inception Report, Field Data Collection, Draft Report Submission, and Final Report Submission.

H. Budget

Provide a budget on a custom template detailing the cost of the consultancy by budgetary line items.

Experiences and Qualifications

Title: Consultancy to undertake Caafimaad+ HIP 2024 Data Protection Impact Assessment

Location: Twenty-three (23) districts in Banadir, Bay, Bakool, Gedo, Lower Shabelle, Lower Juba, Middle Shabelle, and Mudug regions

Tentative time of Assessment: 15 January – 28 February 2025

Key Working Contacts: Caafimaad Plus Consortium Management Unit

A. Background

Caafimaad+ Consortium, a Heath & Nutrition Consortium in Somalia initiated in 2020, implements integrated Health, Nutrition, WASH, and Protection services in twenty-three (23) districts of 8 regions across five states in Somalia. The consortium comprises 5 INGOs namely Action Against Hunger (Lead), Concern Worldwide, International Medical Corps, SOS Children’s Village, and Trocaire, alongside 4 local NGOs Juba Foundation, Lifeline Gedo, SHACDO, and Youthlink. The overall objective of the program is “Contribute to the reduction of morbidity and mortality associated with acute malnutrition, natural disasters (drought/floods), displacements, and other shocks among vulnerable population in South and Central Somalia”. The key objectives are:

• Increase access to a package of basic health services at community, primary and secondary health levels, especially for women, children and vulnerable populations
• Increase access to free quality curative and preventive nutrition services at community, primary, and secondary levels
• Improving access to safe, sufficient water, sanitation facilities and waste management services at health facility level
• Women, girls, boys and men in target locations have improved access to safe, timely, lifesaving GBV services
• Vulnerability of the targeted communities to external shocks is reduced through agile life-saving interventions answering to immediate needs brought by rapid onset disasters

The consortium partners implement in 23 districts located in Banadir, Bay, Bakool, Gedo, Lower Shabelle, Lower Juba, Middle Shabelle, and Mudug regions of Somalia. Implementation modalities include health/nutrition facility-based, community-based, and outreach mobile. The consortium handles sensitive personal data as part of its integrated emergency response humanitarian services. These data are health, nutrition, and protection related that are utilized at all levels of the program from direct service delivery to management decision-making. Currently the consortium reporting system is largely paper based, using MOH registers, with an ongoing digitalization that involves electronic medical records (EMR) for consultations and Logistics Information Management System (LIMS) to monitor prescriptions and supplies. The facility-based systems submit data, either manually or electronically to the Ministry of Health DHIS2 and IDSR systems, with the data also being accessed for programmatic reporting. To comply with the General Data Protection Regulation (GDPR) and to ensure the rights and freedoms of individuals are upheld, a DPIA is required for the Caafimaad+ consortium projects.

B. Purpose of the DPIA

The assessment aims to:

1. Review and assess the Caafimaad+ reporting systems, both paper-based and digital, and their linked systems.
2. Assess the potential data protection risks associated with Caafimaad+ consortium integrated emergency response program.
3. Assess compliance with applicable data protection laws like the GDPR.
4. Recommend practical and actionable measures to mitigate identified risks.
5. Document the Data Protection Impact Assessment (DPIA) in a structured and comprehensive manner

C. Scope of Work

The consultant/team will:

• Review project documentation, to understand the nature of the program, assess the types of data collected, identify data flows, and engage with key stakeholders.
• Conduct risk assessments using a well-defined criterion to identify potential risks to data subjects along the lines of ethical, legal, security, privacy, and other concerns.
• Analyze the assessed areas of risk for impact by likelihood of occurrence and severity considering the types of data and processing involved.
• Propose actions to mitigate or eliminate risks at all levels, that include technical, administrative, organizational, or other controls.
• Develop a detailed DPIA report that encompasses all the assessment findings, risks identified and their severity, potential impacts, and mitigation recommendations.
• Field Mission: The consultant will detail the types of people they plan to interview, the reason for the interview, and the interview methodologies. These will include but are not limited to key project stakeholders such as the program management, program staff, consortium partners staff, MOH officials, Donor representatives, local authorities, and communities.

D. Reporting:

The consultants will produce an interim report which will be presented to the Consortium Management Unit (CMU) and key stakeholders. The Final DPIA Report incorporating the comments from key stakeholders will thereafter be developed and presented to the CMU.

E. Key Considerations

• This assessment will cover highly sensitive health records of individual patients, as well as relevant household level information.
• The geographical scope of the evaluation will cover the project sites in different regions of Somalia. However, simple random sampling of some consortium operating areas and communities will be done in to maximize on the time allocated for the evaluation.
• Gender concerns should be addressed in line with the Action Against Hunger Gender Policy throughout the evaluation process.
• All data should be disaggregated by sex and age and different needs of women, men, boys and girls should be considered throughout the evaluation process.
• Gender and decision making of both men and women and access and control of assets, resources and services in the EU Humanitarian Aid funded project should be considered.

F. Deliverables

The consultants will provide the following key deliverables:

The consultant will provide:

1. An initial scoping document outlining the assessment approach and timeline.
2. A risk assessment matrix identifying and classifying risks.
3. A final DPIA report, including:
   • Executive summary
   • Description of data processing activities
   • Risk analysis and mitigation recommendations
   • Compliance guidance specific to the project
4. A presentation summarizing findings to key stakeholders.

G. Timeline

• The consultant will provide proposed timeline for completing the assessment within the provided timeframe, clearly indicating the milestones such as: Contract Signing, Inception Report, Field Data Collection, Draft Report Submission, and Final Report Submission.

H. Budget

Provide a budget on a custom template detailing the cost of the consultancy by budgetary line items.

Skills Required

Follow us on social media