By Human Rights Watch

Bangladesh Provided Myanmar Information that Refugee Agency Collected

The United Nations refugee agency improperly collected and shared personal information from ethnic Rohingya refugees with Bangladesh, which shared it with Myanmar to verify people for possible repatriation, Human Rights Watch said today. The agency did not conduct a full data impact assessment, as its policies require, and in some cases failed to obtain refugees’ informed consent to share their data with Myanmar, the country they had fled.

Since 2018 the UN High Commissioner for Refugees (UNHCR) has registered hundreds of thousands of Rohingya refugees in Bangladeshi camps and the Bangladesh government has issued them identity cards, which are needed for essential aid and services. Bangladesh then used the information, including analog photographs, thumbprint images, and other biographic data to submit refugee details to the Myanmar government for possible repatriation.

“The UN refugee agency’s data collection practices with Rohingya in Bangladesh were contrary to the agency’s own policies and exposed refugees to further risk,” said Lama Fakih, crisis and conflict director at Human Rights Watch. “UNHCR should only allow data that it collects to be shared with countries of origin when it has properly obtained free and informed consent from participants.”

Since 2016, over 800,000 Rohingya from Myanmar were expelled or fled crimes against humanity and acts of genocide across the border to Bangladesh. The Myanmar government continues to carry out the crimes against humanity of apartheid and persecution against the remaining Rohingya population.

From September 2020 to March 2021, Human Rights Watch interviewed 24 Rohingya refugees about their registration experiences with UNHCR in Cox’s Bazar, Bangladesh and spoke to 20 aid workers, analysts, local activists, journalists, and lawyers who observed or participated in the Rohingya registration. Human Rights Watch sent detailed questions and its research findings to UNHCR in February and April, and received responses from UNHCR on May 10.

UNHCR denied any wrongdoing or policy violations, stating that it had explained all purposes of the data gathering exercise and obtained consent. The agency said that its data collection efforts were aimed at finding durable solutions for the refugees and that no Rohingya were put at risk.

In 2018, the Bangladesh government sought to supplement previous registrations by beginning a joint registration exercise with UNHCR. The government aimed to provide an identity card for refugees – called a “Smart Card” – that allows them to obtain aid and services. The government also sought to gather personal data collected by UNHCR to submit to Myanmar for repatriation eligibility assessments. UNHCR said this would help protect the refugees’ right of return.

In a January meeting with Human Rights Watch, UNHCR said that field officers had asked Rohingya for permission to share their data for repatriation eligibility assessments, explaining that a Smart Card would still be issued to those who did not agree. However, at the time of the registration exercise, UNHCR staff said publicly that the data was not linked to repatriations, including on a September 2018 Rohingya community radio show, and in November 2018 comments to international media. Rohingya refugees had in fact staged protests in the camps that month partly out of concern that data collection would be used to facilitate forced returns.

The refugees Human Rights Watch interviewed also gave a different account than UNHCR staff had outlined in the January meeting. All but one of the 24 said that UNHCR staff told them that they had to register to get the Smart Cards to access aid, and they did not mention anything about sharing data with Myanmar, or linking it to repatriation eligibility assessments. Three said they were told after giving their data that it might be used for repatriation purposes. One said he noticed after leaving the registration center that the box to share data with Myanmar, on a receipt printed out and given to refugees only in English, had been checked “yes,” although he was never asked. He was one of only three among the refugees interviewed who could read English.

Human Rights Watch viewed the English-only receipt that UNHCR gave to Rohingya refugees after their registration. It includes a box noting “yes” or “no” as to whether the information can be shared with the Myanmar government.

Human Rights Watch interviewed 21 refugees whose names were included in the list verified by Myanmar for repatriation. Twelve of the 21 people were added to repatriation eligibility assessment lists in 2019 – lists drawn up based on the data collected by UNHCR.

The 21 said that after being registered they later learned that their information had been shared with Myanmar and their names were on lists of people verified for return. They all went into hiding in other camps because they feared being forcibly returned. So far, Bangladesh has not forced any Rohingya in the camps to return against their will to Myanmar.

One of the 24 refugees interviewed said that the UNHCR field officer registering him asked if he consented to have his data shared with the Myanmar government. He said he felt pressure not to refuse: “I could not say no because I needed the Smart Card and I did not think that I could say no to the data-sharing question and still get the card.”

UNHCR in this case did not seek free and informed consent, which would have required making certain that the refugees knew and understood the risks of sharing their and their family’s data with Myanmar, that they had the ability to opt-out without prejudice, and that they could get the Smart Card even if they did not agree.

UNHCR staff told Human Rights Watch that they did not discuss any specific risks with Rohingya before registering them, and the Rohingya interviewed said they were not told about any such risks.

Between 2018 and 2021, the Bangladesh government submitted at least 830,000 names of Rohingya refugees to Myanmar along with biometric and other data for each person, for repatriation eligibility assessments. Myanmar reportedly agreed to allow about 42,000 Rohingya to return. UNHCR told Human Rights Watch that it played no role in drawing up these lists but that the names and other data included in the lists submitted from 2019 onwards, including biometrics, came from analog versions of the data it had gathered during the joint registration exercise, for example, non-digital thumbprint images.

In its global guidelines on sharing information on individual cases, UNHCR acknowledges the risks of sharing such information and says that “UNHCR should not share any [individual case] information with the authorities of the country of origin.”

In the Myanmar context, risks include involuntary Rohingya returns to Myanmar, particularly given Bangladesh’s forced repatriation of Rohingya to Myanmar in the 1970s and 1990s. In those cases, UNHCR tacitly condoned Bangladesh’s coerced returns.

Bangladesh’s submission of lists to Myanmar may also have put refugees, or at least the subset that Myanmar agreed to return, on track to receive Myanmar’s National Verification Cards (NVCs), which many Rohingya reject because they believe it undermines their claims to Myanmar citizenship.

The UNHCR-Bangladesh exercise appears to have violated the agency’s policy on protecting personal data that it collects, which requires UNHCR to tell people in a language and manner they understand why it is collecting their data and whether it will be transferred to another entity. It also appears to have undermined the objective of UNHCR’s policies that aim to ensure that consent is not coerced.

UNHCR’s Handbook on Voluntary Repatriation says that the agency should never directly link registration or other verification exercises with registration for voluntary repatriations because “[l]inking the two may create confusion for the refugees by giving the impression that one needs to register for voluntary repatriation in order to be entitled to assistance in the country of asylum. This may seriously jeopardize voluntariness.”

Linking the eligibility assessment and registration for services did create confusion, Human Rights Watch said. Nearly all of the refugees interviewed did not understand that their data would be shared with the Myanmar government. In the one case in which the refugee was told that it would be, he said he felt he could not refuse consent without jeopardizing his access to services.

UNHCR should have recognized that Bangladesh sharing data with Myanmar raised serious protection concerns. “[T]he idea of sharing data with Myanmar, or allowing data to be shared with Myanmar, on this community should have been out of the question until there were minimum guarantees in place – which there aren’t,” said an aid worker familiar with the process in Bangladesh.

Finally, UNHCR has a policy requiring a data protection impact assessment before it enters into data transfer arrangements like the one in Bangladesh. However, staff said they did not carry out a “full-fledged” impact assessment, only undertaking several risk assessments prior to signing the data-sharing agreement with Bangladesh. The apparent failure to take into account the history of forced returns from Bangladesh to Myanmar, in those assessments, is important.

UNHCR should not combine collecting people’s data for services or identity cards with data collection for repatriation eligibility, Human Rights Watch said. UNHCR should ensure that people who agree to have their data shared are able to withdraw that consent and know how to do so. The agency should only share data or allow data that it collects to be shared with countries of origin when it has taken all efforts to obtain free and informed consent.

“Humanitarian agencies obviously need to collect and share some data so they can provide refugees with protection, services, and assist with safe, dignified, and voluntary returns,” Fakih said. “But a refugee has the right to control their data, who has access to it, and for what purposes, and UNHCR and other agencies should be accountable to those whose data they hold.”

Purpose of the UNHCR-Bangladesh Registration Exercise

In 2017, the Bangladesh government conducted its own registration of Rohingya refugees by collecting personal data, including biometrics, and collaborated with UNHCR through its Refugee Relief and Repatriation Commission to conduct a family counting exercise. In 2018, the government asked UNHCR to participate in a joint exercise to link the registration data that it had collected and the data collected by UNHCR in collaboration with the Refugee Relief and Repatriation Commission. UNHCR signed a data-sharing agreement with Bangladesh in January 2018.

Following Myanmar and Bangladesh’s November 2017 repatriation agreement (the Arrangement on Return of Displaced Persons from Rakhine State), which required Bangladesh to conduct a “pre-verification” exercise to vet refugees before Myanmar would carry out its own assessment of return eligibility, Bangladesh and Myanmar also entered into an agreement outlining the verification and repatriation process, including collecting and sharing refugee data.

The agreement stated that “[r]elevant information or data generated by, and available with, relevant UN agencies may be used for reference, as and when necessary … Bangladesh may provide verified lists of returnees from Bangladesh to the UNHCR Representatives for ascertaining voluntariness from prospective returnee families.” The annexed verification form requested extensive identifying data.

UNHCR’s independent evaluation of its emergency response, published in December 2018, noted that for the lists Bangladesh would need to prepare for Myanmar, authorities would “require a level of detail about place of origin, family composition and so on” that the government had not obtained in its initial registration.

UNHCR’s independent evaluation found that the agency saw the joint registration exercise as an opening to assist the “durable documentation” of Rohingya for potential returns. In its May 2021 written response to Human Rights Watch, UNHCR said that this unique verification process stems from the discriminatory nationality restrictions that Rohingya face, because most now lack official documentation proving they are from Myanmar.

UNHCR officials said that as part of the joint registration exercise, field officers asked Rohingya two questions: first, whether they consented to have their data shared with partners for assistance in Bangladesh and, second, whether they consented to have their data shared with Myanmar to assess repatriation eligibility. They said the agency began the registration exercise in June 2018, collecting “a significant amount of information about the family, place of origin and relatives overseas,” and fingerprints, iris scans, photographs, and shared much of that data with the Bangladesh government.

Following the joint exercise, Bangladesh issued refugees over age 12 identity cards known as Smart Cards, which are linked to their biometric data. UNHCR officials said that they advocated successfully to include the phrase “Forcibly Displaced Myanmar National/Person of Concern to UNHCR” on the cards, as well as a written commitment that the card bearer should be protected from being forcibly returned. The cards gave Rohingya valid identification and allowed them access to food, aid, health care, and other essential services.

During the registration exercise, some Rohingya raised concerns that the data would be used to facilitate repatriations and be integrated into the Myanmar National Verification Cards (NVC) system – an inherently discriminatory process that identifies Rohingya as non-citizens. A visit to the Bangladesh camps in early 2018 by Myanmar’s social welfare minister, Dr. Win Myat Aye, stoked those fears. He said during the visit that NVC cards would help to verify the identity of refugees returning to Myanmar. Some Rohingya held protests against the registration exercise in late 2018, which in a few cases the camp authorities met with violence.

A 2020 study by the Engine Room, an international organization working with data and technology to encourage social change, said a number of refugees spoke of fears around data sharing with Myanmar, telling them, “We are still having doubts about one matter … they assured us that they won’t share our biodata with the [government of Myanmar], but what if they cheat us and share this data … [and] send us back to [Myanmar]?”

In response to refugee concerns, UNHCR officials made confusing public statements about the purpose of the data collection exercise. For example, in November 2018, after protesters complained that Myanmar would access the data, a UNHCR official told Reuters that the data was being collected for a verification process that would help Rohingya refugees get better protection and ensure their access to services in Bangladesh and was “not linked to repatriation.”

In its May 10, 2021 response to Human Rights Watch, UNHCR said that Reuters had selectively excerpted this statement without providing more context and that UNHCR staff consistently said that Bangladesh may share data with Myanmar to verify eligibility for returns, and this would not be linked to any “actual return movement.”

In September 2018, a UNHCR assistant registration officer had addressed the issue on a Rohingya community radio show, Bala-Bura:

There isn’t any association between the Smart Card and the repatriation to Myanmar. Repatriation is based on your own willingness and it doesn’t look like it could actually happen right now. It could only happen when there is peace in your country, when you get your rights back, when you get your house, land and properties returned, when you get the freedom of movement—these are the criteria for voluntary [returns]. And this [Smart Card] is to live in Bangladesh, to stay safely in Bangladesh, to get assistance- this card is being given to ensure all of that. There is not any association with the repatriation to Myanmar. When you receive that identity card or the “Smart Card,” the first advantage you will get is that you can stay peacefully and safely in Bangladesh.

At the same time, the official said that Bangladesh would share some limited information on who people were and what village they came from with Myanmar but did not explain that this would be linked to repatriation eligibility assessments, nor that it would include additional data including photographs or thumbprint images. In a January 2019 operational update, UNHCR said the exercise was intended to ensure that refugees had identity documents and could use those documents to get services, and “contribute to ensuring a refugee’s right to return.”

The statements from UNHCR officials contributed to refugees incorrectly believing that the data UNHCR collected was not going to contribute to anything related to potential returns.

As one aid worker, who at the time was attending meetings between Rohingya leaders and UNHCR on this issue put it, “UNHCR kept saying to them [Rohingya leaders] the memorandum of understanding it signed with Myanmar had nothing to do with repatriations and nor did the joint registration exercise. It was basically ignoring the Rohingya and their concerns that there was a link.”

Free and Informed Consent

UNHCR predicates its assistance and protection on free and informed consent by beneficiaries. A 2020 UNHCR guide for making refugee status determinations, for example, states that UNHCR should inform an individual of:

the extent of the information to be disclosed, the recipient of the information, the purpose of the disclosure and the likely use of the information. Consent must be sought each time the information is to be disclosed to a different third party or used for purposes which the Applicant was not informed about and would not have reasonably expected at the time of the initial consent.

In addition, to be valid:

consent must be informed, that is consent must be based upon a clear appreciation and understanding of the facts, implications and consequences, which obliges UNHCR to inform the person of the purpose(s) of data collection, and how the data is, or is likely to be, used. Consent must also be freely given, meaning that the individual must have a genuine choice and be able to refuse or withdraw consent without adverse consequences.

While UNHCR policy allows for processing data without consent under some circumstances, including emergency situations, this should not override the need for consent or appropriate alternatives during registration exercises so as to not expose individuals or groups to harm, or otherwise jeopardize their protection.

UNHCR staff told Human Rights Watch in 2021 that when registering Rohingya for the joint registration exercise in 2018, field staff asked refugees whether they consented to have

their data shared with Myanmar to assess their repatriation eligibility. They said that Rohingya could have registered for the Smart Card even if they did not want their data shared with Myanmar. They contended that the vast majority of refugees consented but did not say how many refused. The Rohingya interviewed by Human Rights Watch disputed these claims.

Human Rights Watch believes that combining registration required for services with consent to a repatriation eligibility assessment is contrary to the principle of free consent. Rohingya refugees require a Smart Card to get all services in the refugee camps. UNHCR’s policies provide that the agency should never directly link registration or other verification exercises with registration for voluntary repatriations.

UNHCR disputed the relevance of this principle by arguing it applies to registration for voluntary repatriation, not sharing names to assess eligibility for return. But the aim of the policy – to ensure that consent is not coerced – should also apply in the registration exercise that UNHCR conducted with Bangladesh, Human Rights Watch said.

Human Rights Watch found that UNHCR gave refugees mixed messages about how their data would be used and did not provide enough information for people to understand when, how, and for what purposes their information would be shared with the Myanmar government.

UNHCR said that when communicating with refugees and media about the registration exercise, UNHCR staff members consistently noted the possibility that the government of Bangladesh may share the data with the government of Myanmar for the purpose of verifying their eligibility for return, but this would not be linked to any actual returns. In February, a UNHCR official said the question about sharing data for eligibility assessments during the joint registration exercise was a “tick box” on a consent form that each refugee signed. She claimed the agency “always asked this question and the refugees understood what we meant very quickly.”

This is contrary to the experience of 23 of the 24 Rohingya refugees interviewed, who said that they believed at the time that the data collection was only to get the Smart Card and access to services, and a counting exercise. They said they did not sign a form, but instead gave their data in their own language to a field officer typing into a computer, and received a printed English language-only receipt with that data at the end of the interview. One Rohingya man who shared with Human Rights Watch the English language receipt said he was shocked to see that his data could be shared with Myanmar:

When I got to the [registration] center no one there told me why they were collecting my data, it was assumed that I knew like everyone that it was in order to receive services and for a counting exercise. After they took my data, they printed out a receipt. I walked back to my tent, and then I looked at the paper, and noticed that on the top there was a tick box that the person at the center had marked as “yes” without ever asking me, that my data would be shared with Myanmar. I was so angry when I saw that, but I had already given my data, and I needed services, so I didn’t know what I could do about it. And I am one of the few people who probably even realized that. Most Rohingya do not read English. But why did they do that? Why don’t they ask the person in front of them instead of just clicking and maybe even causing us harm by doing that?

The man said that before his data was collected, a senior UNHCR official told a community meeting he had attended that, “in the future, if you agree, UNHCR and Bangladesh will share your information with Myanmar so the government can verify where you are from,” but that he was never told this collection exercise would be for that purpose.

Another Rohingya man said:

UNHCR did not tell us it would be used for anything linked to repatriations. When the registration exercise started, we had said we didn’t want to participate because we were worried about repatriations, but the UNHCR staff told us, “We will not share your information with Myanmar until you give us permission to.” And then they never came back to us to ask if they could share our information.

He added that when field staff collected his data, they did not discuss consent in any detail. In its May responses, UNHCR stated that Rohingya refugees were provided extensive counseling on the sharing of their information with Myanmar for the purposes of verification of eligibility for return, but at the same time acknowledged that in some cases a more thorough explanation and counseling for refugees may have helped them better understand the process and its purpose.

UNHCR said that the vast majority of refugees in 2017 and 2018 were expressing a desire to return home “if conditions were conducive” – a sentiment that refugees also expressed to Human Rights Watch at the time. The Rohingya refugees have repeatedly said that they wish to return to Myanmar when it is safe and their citizenship rights, right to freedom of movement, and other human rights are guaranteed. But when Bangladesh started submitting names to Myanmar for repatriation eligibility assessments in 2018, Rohingya refugees told Human Rights Watch that they still did not feel safe to return.

The one Rohingya man who said UNHCR did ask his consent to share his data with Myanmar said he felt pressure not to refuse. He added that he assumed, based on UNHCR’s mandate to protect vulnerable people, the data would only be shared at a time when safe and dignified repatriations were possible. “We would be very worried to have our full information shared without those conditions, especially now with the Myanmar military in control of the government,” he said.

Bangladesh officials said that by early 2021 they had submitted lists with at least 830,000 names to Myanmar. Bangladesh’s foreign minister reported that the lists included all the data the government had on each individual, including biometric data. Myanmar authorities verified the eligibility of 42,000 people for return, though UNHCR considered the situation in Myanmar not conducive for safe refugee returns.

Once they were verified for return, UNHCR interviewed those selected, and almost all said they did not want to return, with some going into hiding out of fear of forced repatriation.

Human Rights Watch believes that biometric data should only be gathered when necessary and proportionate, and when fully compliant with privacy and data protection legislation and internal data retention and privacy policies. If biometric data collection (such as fingerprint images) is deemed necessary, in line with various data protection regulations and established principles of data collection in sensitive contexts, UNHCR should collect and store as little data as possible about vulnerable people.

Implementation of UNHCR Policy

UNHCR has a policy and practical guidance to protect personal data that it collects on beneficiaries and shares with third parties. The policy specifies that “before entering into data transfer arrangements with Implementing Partners or third parties which may negatively impact on the protection of personal data of persons of concern, UNHCR needs to carry out a Data Protection Impact Assessment (DPIA).”

UNHCR told Human Rights Watch that it did not carry out a “full-fledged DPIA,” but undertook several risk assessments prior to signing the data-sharing agreement with Bangladesh and embedded and applied risk-mitigating measures into the agreement. In its assessments, UNHCR said it took into account “application of data protection provisions, refugees’ consent, UNHCR’s prior written authorization to disclose, limitations to the use of data, the format in which data are being shared, and balanced any identified risks against the benefits of upholding refugees’ right to return to their country.” It is important, though that it did not seem to take into account the context of historical involuntary returns from Bangladesh to Myanmar.

A former senior UNHCR staff member said that while the agency has a policy in place, “UNHCR has not put procedures to enforce the policy. DPIAs are generally not conducted.” He added that while the policy document seeks “adequacy” with Europe’s General Data Protection Regulation, in practice staff deviate from the requisite standards including informed consent.

UNHCR’s policy also dictates that when it collects personal data. it should inform the person “in a manner and language that is understandable” of the specific purpose for which the data will be processed and whether the data will be transferred to another entity.

Twenty-one of the 24 Rohingya interviewed said they found out their names were on repatriation eligibility assessment lists only after the Myanmar government had verified them for return.

UNHCR said it was unable to share a copy of its data-sharing agreement with Bangladesh without the government’s permission. Human Rights Watch asked the Bangladesh government for a copy of the agreement but has yet to receive a response.

UNHCR said its protection staff in Bangladesh and Myanmar have monitored whether the sharing of refugee data has resulted in any harm to refugees or their families and had not identified any harm thus far.

Potential Harm

Involuntary Repatriations

In a May meeting with Human Rights Watch, a UNHCR official defended the agency’s data sharing with Bangladesh – knowing that Bangladesh would, in turn, share this data with Myanmar as part of the process for verifying eligibility to return – by saying that UNHCR’s engagement would help to ensure that any returns would be voluntary. UNHCR said that an April 2018 memorandum of understanding between the agency and Bangladesh on the voluntary return of Rohingya to Myanmar includes a role for UNHCR to assist Bangladesh to register refugees who indicate a willingness to return and to ascertain the voluntariness of their decision after the eligibility for return is verified and confirmed between Bangladesh and Myanmar. It also states that UNHCR will assist in voluntary returns but only when the conditions for safe and dignified return are in place.

In its May written response to Human Rights Watch, UNHCR repeated that Bangladesh is upholding its commitment not to involuntarily repatriate Rohingya and pointed out that in November 2018 and August 2019, Bangladesh did not force any Rohingya who had been verified for return to go back to Myanmar. It said that “UNHCR has insisted since the beginning of the Rohingya refugee crisis that the refugees have a right to return if conditions are conducive yet that this should be voluntary and on the basis of informed consent.”

If the necessary conditions are not in place for safe and dignified return, UNHCR engagement on return is usually limited to planning, monitoring, counseling, advocacy, and ongoing analysis of obstacles to and conditions necessary for return, and identifying the necessary actions to address them. By indirectly assisting Bangladesh, through the collection of data, to draw up lists for verifying return eligibility, UNHCR has in effect assisted with potential repatriations, governed by the bilateral agreement between Bangladesh and Myanmar.

This comes in the context of previous forced repatriation from Bangladesh to Myanmar, first in 1978 and then between 1992 and 1997, including UNHCR’s involvement in those episodes of mass forcible return, or refoulement. A study by the Stimson Center found:

In the 1970s and 1990s, UNHCR made choices that prioritized relationships with the governments of Bangladesh and Myanmar over explicitly addressing human rights and protection concerns facing refugees… protection practices and norms such as individually interviewing refugees prior to return, were often sidelined in favor of maintaining these relationships.

In 2021 Bangladeshi authorities have continued their rhetoric around the need for repatriations, including directly after the February 1 military coup in Myanmar. Human Rights Watch questions the extent to which UNHCR will be able to prevent forced returns should they be attempted, given its inability to prevent the Bangladeshi government from relocating – including involuntary transfers – Rohingya to facilities on the remote island of Bhasan Char, where they lack freedom of movement and sustainable livelihoods or education.

The principle of nonrefoulement, the right of refugees not to be returned to a country where their lives or freedom would be threatened, is the cornerstone of international refugee protection, enshrined in article 33 of the 1951 Convention relating to the Status of Refugees. Although Bangladesh is not a party to the UN Refugee Convention, it is bound to uphold the principle of nonrefoulement as a matter of customary international law.

Returning Rohingya to Myanmar would put them at grave risk of arbitrary arrest, torture and other ill-treatment, and possible death. An estimated 600,000 Rohingya remain in Rakhine State, confined to camps and villages without freedom of movement or access to adequate food, health care, education, and livelihoods. Approximately 130,000 internally displaced Rohingya have been arbitrarily held since 2012 in open-air detention camps.

A 2020 report by Human Rights Watch found that that the repression imposed on the Rohingya amounts to the crimes against humanity of persecution, apartheid, and severe deprivation of liberty. The UN-backed Fact-Finding Mission on Myanmar warned in 2019 that the Rohingya remaining in Myanmar faced a greater-than-ever threat of genocide in the face of ongoing marginalization and brutality by the authorities.

The 21 Rohingya who told Human Rights Watch that their names had been on repatriation eligibility assessment lists and been verified for return fled their huts and went into hiding into other camps because they were afraid of being forcibly returned. One said his family fled because Bangladeshi security forces threatened that if they did not return to Myanmar, “then they would bulldoze our hut inside the camp.” Another Rohingya man said Bangladeshi authorities had told him he must return to Myanmar or he would be forced to, though he was not ultimately forced to do so.

One aid worker who witnessed families fleeing their huts said that in November 2018, when authorities tried to get the first group of Rohingya that had been verified for return to leave, she saw camp leaders trying, and ultimately failing, to forcibly round them up and put them on buses.

Denial of Citizenship and Potential Statelessness

The Rohingya are a predominantly Muslim ethnic group who have lived for generations in Myanmar’s Rakhine State. They are not listed among the 135 national ethnic groups Myanmar recognizes and are effectively denied citizenship under the discriminatory 1982 Citizenship Law. Without citizenship, they are for practical purposes stateless, facilitating long-term and severe Myanmar government human rights violations, including deportation, arbitrary confinement, and persecution.

Myanmar authorities have issued documents under successive “citizenship verification” systems, including “white cards,” or temporary registration cards, which were nullified in 2015. The end of the “white cards” was followed by the current National Verification Card (NVC) process, which has been marked by coercion and deceit. Rohingya are also registered on documents under repressive travel authorization and administrative procedures, such as household lists, Form 4s, and “Village Departure Certificates.”

At the time of their registration in Bangladesh, many Rohingya were concerned that their data would be integrated into the Myanmar NVC system, which they believe would undermine their claims to citizenship. A 2019 repatriation assessment conducted by the Association of Southeast Asian Nations (ASEAN) with support from the Myanmar government stated that all returning refugees will be registered for NVCs upon arriving at Rakhine State “reception centers.”

Arbitrary Detention

In line with its repatriation agreements with Bangladesh, the Myanmar government has built “reception centers” and “transit camps” in northern Rakhine State to process and house returnees. They are surrounded by high barbed-wire fencing and security outposts, similar to the central Rakhine State detention camps. Such camps, constructed on land from which the Rohingya had fled, including villages that were burned and bulldozed in their wake, would invariably limit basic rights, segregate returnees from the rest of the population, restrict freedom of movement, and exacerbate persecution. The ASEAN repatriation assessment outlines “strict security measures,” including the extensive presence of armed border guard police at the camps that raise grave rights concerns.

One Rohingya man told Human Rights Watch that his name had appeared on a Myanmar government list of suspected members of the Arakan Rohingya Salvation Army (ARSA), the ethnic Rohingya armed group. He said that around August 2019, he found out from a Bangladesh government-appointed representative in the camp that his name had been included on one of the repatriation eligibility assessment lists and he was verified for return. “I am worried that the Myanmar authorities added my name to the list as a trap, so they can bring me back to Myanmar and then arrest me for membership in ARSA,” he said.

Recommendations

Human Rights Watch appreciates the vital role that UNHCR plays in ensuring that Rohingya refugees in Bangladesh are issued identity documents and have access to basic services. Human Rights Watch also recognizes that Bangladesh authorities require some personal data to issue these documents. It is less clear, however, to what extent facial images, fingerprints, and other biometric data are necessary and proportionate to serve this purpose. As UNHCR guidelines recognize, there are significant risks that this information could be shared with refugees’ countries of origin and the personal information collected should only be shared with the country of origin after an individual confirms that they want to voluntarily return home.

In its April 14 letter to UNHCR, Human Rights Watch included detailed recommendations for the agency to consider. These included investigating the manner in which data collection proceeded in Bangladesh in 2018. More broadly, Human Rights Watch recommends the following to UNHCR:

• • Do not combine collecting data on individuals to provide services or identification documents with collecting data for repatriation eligibility assessment or repatriation. Data collection for repatriation purposes should remain a separate exercise, ideally with a strict firewall in the databases maintained;
  • Instruct field officers to engage in detailed consent discussions with every person being considered for eligibility for repatriation, and for repatriation, which should include ensuring that refugees understand any risks of having their data shared and that they have the ability to opt-out without prejudice;
  • Only share data or allow data that it collects to be shared by host countries with countries of origin, when individuals have given free and informed consent;
  • Ensure that people who agree to have their data shared for repatriation purposes are able to later withdraw that consent, and are informed how to do so in a clear manner at the time they give initial consent;
  • Impose restrictions and safeguards that limit the authorities who can access and share data within the government and prohibit access to this data by third governments and other parties;
  • Carry out mandatory data assessments and, to ensure independence, use teams supervised by an independent body to conduct data impact assessments before engaging in new programming that requires sensitive data collection. Assessments of this risk should include an examination of the historical context of the communities and countries involved; and
  • Ensure that all data collection, including biometric data, meets the requirements of necessity and proportionality.

Human Rights Watch also recommends that donor governments play a greater role in ensuring rights-based data practices. This includes requiring agencies and organizations that collect sensitive data to use independently supervised entities for data protection impact assessments for new projects before data collection begins, and to conduct annual data protection audits.