The World Health Organization’s Personal Data Protection Policy entered into force on 15th April 2024. It marks WHO’s commitment to protect Personal Data held by WHO to continue upholding the trust of Member States and collaborating partners.
The collection, analysis, publication and dissemination of health-related data are core elements of WHO’s mandate, in line with WHO data principles. WHO must transfer and receive personal data to and from third parties in its daily operations in pursuit of this mandate.
The policy outlines the rules and principles relating to the processing of Personal Data held by WHO. The rights of the data subjects are outlined in the policy with clear mechanisms to manage possible data breaches, underscoring the roles and responsibilities of WHO’s Data Protection and Privacy Officer. The full text can be found here.
This Policy should be read in conjunction with other existing internal policies of WHO outlined in the data section of WHO’s eManual, notably:
Data are the basis for all sound public health actions and the benefits of data-sharing are widely recognized, including scientific and public health benefits. Whenever possible, WHO wishes to promote the sharing of health data, including but not restricted to surveillance and epidemiological data. The purpose of the policy is to clarify current policy and practice on use and sharing of data collected in Member States by WHO. This page summarizes the principles and requirements of the policy. The full text of the policy can be accessed here.
The policy applies to the use and sharing of data collected by WHO in, and/or provided to WHO by, Member States (see Annex), outside the context of public health emergencies. The policy allows, but places no obligation on, WHO or Member States to collect, anonymize, analyse or share other health data than those already being collected, anonymized, analysed and shared.
In addition, any platforms established to share data should have an explicit ethical framework governing data collection and use.
The policy was introduced on 1 January 2018 and will be monitored and evaluated over a 12-month transition period (at least one data collection cycle for technical programmes in WHO). Subsequent modifications may be made taking into account the views of technical departments at WHO (compiling and analysing data), Member States (providing data) or third parties (receiving data). The policy will not be applied retrospectively to data already provided by Member States to WHO, and/or which have already been shared by WHO with third parties.
The policy:
(1) WHO’s existing position is that:
(i) all clinical trials are to be prospectively registered in a clinical trial registry meeting international standards http://www.who.int/ictrp;
and
(ii) at a minimum, a summary of results from the clinical trial are to be made publicly available within 12 months of study completion http://www.who.int/ictrp/results/reporting/en