"Not Just a Barcode": A Descriptive Analysis of Data Privacy Protection for Refugees Resettling in the United States

Protecting the data privacy of refugees is important because unauthorized disclosure of refugees' sensitive information or coerced data collection can endanger their safety, well-being, and agency. This thesis evaluates the extent to which the US government, nonprofits, and international organizations protect refugees’ data privacy during refugee resettlement in the United States. Through analyzing relevant data privacy policies and in-depth interviews with both refugees and practitioners, I track the quality of nine key components of data privacy, stakeholder incentives and challenges in protecting refugee’s data privacy both in theory and in practice. This thesis finds that federal government actors are responsible for the most significant data privacy violations against resettled refugees, while international organizations have the most robust data privacy regulations. The lack of legal guarantee for refugees’ data privacy rights, meaningful barriers to informed consent, and over-retention of sensitive personal data present the most significant regulatory vulnerabilities. Unauthorized data access without consent, data security breaches, and inaccessibility of complaint systems comprise the most severe data privacy violations against US resettled refugees in practice. Interviews with refugees also suggest that power dynamics and lack of language accessibility create meaningful barriers that prevent refugees from objecting to unwanted information disclosure. Potential causes of data privacy violations against refugees (such as resource constraints), data-flow mapping, and policy recommendations identified in this thesis can inform future studies and policymakers to improve data privacy protection for a wider range of refugees in the future.

Keywords: Program in International Relations
Refugee data privacy
Data privacy
Informed consent (Medical law) > U.S. states
Refugee resettlement
Data protection
Data protection > Government policy
Migration, Internal > Social aspects
Human rights
Privacy
Privacy Act of 1974 (United States)
Data security
Political refugees
Asylum seeker
United States. Office of Refugee Resettlement
United States. Department of State
U.S. Citizenship and Immigration Services
U.S. Customs and Border Protection
United States. Department of Homeland Security
Health Insurance Portability and Accountability Act of 1996 (United States)
Office of the United Nations High Commissioner for Refugees
International Organization for Migration
Convention Relating to the Status of Refugees
Data privacy policy
Refugee surveillance
Refugee privacy
Nonprofit data privacy
United States. Resettlement Administration
U.S. resettlement agency
Operation Allies Welcome
Afghanistan
Afghan refugee
Humanitarian assistance
Digital rights
Reception and Placement
Resettlement Support Center
Data minimization
GDPR
Refugee interview
International Rescue Committee
Lutheran Immigration and Refugee Service
Non-governmental organizations
Identity theft
Refugee data protection
Catholic Social Services (Mobile, Ala.). Refugee Resettlement Program
Text
Policy brief
Thesis
Advisor: Hainmueller Jens