Under data protection laws, Amnesty International is the data controller for the Mapping Racism at Amnesty Platform (“the platform”). This is because the project team behind the platform determines how data will be processed and for which outcome. It is our responsibility to let you know which types of data we will collect, why we are collecting it, and how it will be shared.
The below explains how data and consent are considered within the platform. If you have further questions which aren’t answered in this document, please contact: mapping.racism@amnesty.org.
Platform aims – why are we collecting your data?
This platform is a collective initiative which enables people to anonymously share their experiences of racism (as a victim or witness) within their working life at Amnesty International’s International Secretariat (“IS”). By sharing your stories, you help to:
- Shape knowledge of how racism manifests at the IS – including the emotional, physical, and professional impacts it has.
- Reveal the complex dynamics and multiplicity of effects of a common phenomenon.
- Forge solidarity through collective recognition of what is happening to staff.
- Inform antiracist advocacy and institutional change.
This platform is not an internal grievance mechanism that will lead to individual disciplinary processes. Instead, it is designed to inform cultural and policy shifts at the IS through telling the collective story of how racism is occurring and impacting staff.
What type of information will I be asked to share, and how will it be used?
All experiences shared through the platform will be done so anonymously. This means you will not be asked to provide your name or email address, nor will the platform record IP addresses.
When making a submission, you will be asked a series of multiple choice and free text questions which are framed to capture the context of your experience, as well as the emotional, physical and life consequences it has had. You will also be asked to provide some demographic information for analytical purposes. All questions are optional.
The analysts who will be responsible for aggregating the data will delete any names which are mentioned within submissions, permanently removing them from the system. Once they have reviewed all the data, they will produce a report capturing key trends, conclusions, and recommendations. This means that stories shared through the platform will not be re-told but will be summarized alongside other shared experiences. No identifiable details will be included in the analysts’ report.
Given the aims of the platform and the anonymity of people sharing their experiences, this platform is not designed to facilitate follow up on individual cases. This means that no direct action will be taken on your case. If you would like to receive further support, or your submission contains safeguarding or other serious concerns, we encourage you to follow formal reporting procedures which are described in the article “Where can I access further support for what I’ve experienced” located on the support tab of the platform.
Who will have access to my data?
When you submit your story, it will be stored on a cloud-based database provided by Culture Shift. At no point will Culture Shift have access to the database of stories shared through the platform. Culture Shift use 3 sub-processors to provide their service: Amazon Web Services, Mixpanel, and Sentry (Functional Software Inc). These companies act as sub-processors and do not have any direct access to personal data, and the submissions themselves are only stored within an Amazon Web Services database, with Mixpanel and Sentry only handling the names and email addresses of platform administrators. All these sub-processors are either based in the European Union, or we have standard contractual clauses in place to ensure compliance with the General Data Protection Regulation (“GDPR”).
Only a small team of analysts will have access to the raw data collected through the platform. This team will have agreed to a code of practice determining how they will handle and treat the data they view. Members of IS staff who will undertake this task will be named under the ‘Project Team’ section of the platform site.
The platform will be available in the IS’ core languages. Where data submitted in a core language is not understood by the analysts, the translation of the relevant data will be centralized by colleagues from the Language Resource Centre (LRC). LRC colleagues will be guided by the same code of practice as the analysts.
Analysts will be granted access to the data by the project team. The analysts will need to enter their Amnesty credentials to verify their ID. Once an analyst is no longer engaged in the platform, they will have their access removed.
Once you have shared your experience through the platform you will not be able to recall or edit your submission or request a copy. As all names will be removed from the data, it will not be necessary for IS staff to include this platform in any future data subject access requests as the platform has been specifically designed not to capture or store personal identifiable information.
How will my data be handled?
In order to analyse the data, analysts will be required to export it in a password protected file. The password will only be known to the analysts and will not be shared over email or messaging devices. Once downloaded, the data will be stored on a SharePoint site within Amnesty’s system. It will not be saved in personal folders or on personal devices.
If an incident occurs which affects the integrity of the online platform, Culture Shift will determine whether a security or data breach has occurred and take action to resolve the situation. The project team will be notified of any such occurrences. If an incident occurs which affects the integrity of the downloaded data, the analysts will notify the project team who will follow Amnesty’s Data Breach Policy (AI INDEX: DOC 23/8677/2018).
Your data will only be retained for the time necessary to meet the purpose of the platform. Submission cycles will last for an approximate period of 8 months, after which a report will be produced. Data which is collected over this time will be archived once the correlating report has been finalized. Data will be anonymized before archiving. Any data downloaded for analysis purposes will be deleted by the analysts within one month of the report launch. Should use of the platform cease, the archived data will be permanently deleted from Culture Shift’s systems.
Participation and consent
Under GDPR regulations, the processing of data is only lawful in particular circumstances. The circumstance which applies in this instance is that data will only be processed once you have given your consent for the use of your data in line with the platform aims stated above. You will be asked to provide your consent before sharing your story on the platform.
When you provide your consent, you are confirming that:
- You have made a submission voluntarily. There is no obligation to share your experience and you should only do so when it is your choice. All questions in the submission form are optional. You will be able to go back and edit your responses before submitting. If you begin to make a submission but change your mind, no data from unsubmitted reports will be collected.
- You understand (and agree to) what will happen to the data you submit and how it will be used.
- You understand that there will be no follow up on your submission, besides your story being aggregated with others to inform anti-racism advocacy and institutional change at the IS.
Raising concerns
If you are concerned with how you have been treated during your engagement with the platform, please inform the project team: mapping.racism@amnesty.org