Application of data protection laws with a proposal for a flexible regime for humanitarian organisations

Abstract

Humanitarian organisations often operate in emergency contexts where strict compliance with data protection laws, such as the General Data Protection Regulation (GDPR), can pose significant practical challenges. This paper explores the need for a differentiated data protection regime tailored to the realities of humanitarian crises, balancing efficiency and the fundamental rights of data subjects. By analysing key European Court of Justice cases, including Schrems II (C-311/18), Nowak (C-434/16) and Pankki S (C-579/21), the paper highlights the importance of adapting core GDPR principles to crisis situations. It also examines the integration of human rights principles, emphasising the protection of dignity and autonomy during emergencies. Furthermore, it addresses regulatory challenges, proposing proactive engagement with authorities to ensure accountability and trust. Practical solutions are proposed such as simplified Data Protection Impact Assessments (DPIAs), the use of pseudonymisation, data minimisation and standardised Memorandums of Understanding (MOUs) to replace complex contractual requirements. These measures aim to ensure compliance while enabling rapid and effective responses in emergencies. The paper concludes by calling for the development of a flexible regulatory framework that integrates data protection into the operational needs of humanitarian organisations without compromising ethical and legal standards.