Insights

Through the USAID-funded New Partnerships Initiative (NPI) EXPAND Brazil project, implementation partners worked to increase vaccination against COVID-19 in the Amazon region. In Brazil, NPI EXPAND supports projects dedicated to facing the COVID-19 pandemic and promoting the immunization of vulnerable and isolated communities. These projects show how collaboration among the public, private, and social sectors can encourage capacity strengthening, promote innovation, and improve essential public services, such as the Unified Health System (Sistema Único de Saúde (SUS)) in Brazil.

The COVID-19 pandemic pointed out the importance of something that is not physical or tangible, but without which any effort is in vain: data. Organizations and health workers on the front lines deal with a myriad of personal information on a daily basis. But what data are these? What do they say?

“Data are not only numbers or statistics, data are people.”

The statement from Adiomar Santos, a technical professional at Instituto Juruti Sustentável (IJUS), summarizes, in a simple and elegant way, the importance of data for organizations working to tackle and prevent COVID-19.

In addition to identification data – such as name, individual registration number, gender, date of birth –, sensitive health-related information is also at stake, whether regarding patients, family members, or just people searching for the vaccine. A proper handling of health and personal data is critical to guarantee people’s right to privacy and transparency, but this remains a challenge for many organizations.

As one of its key objectives, NPI EXPAND Brazil aims to strengthen relational, financial, organizational, and technical capacity and improve the performance of grantees to expand their level of engagement in health service delivery. This work also aims to increase the availability and utilization of quality health services in low-resource settings across all USAID priority health areas. The project’s capacity strengthening strategy underscores the importance of achieving development outcomes that are locally led and is designed to support improved outcomes in organizational performance, sustainability, and adaptability. For NPI EXPAND, the improved capacity of local organizations will in turn contribute to improvements in, and sustainability of development outcomes.

To assist the grantee organizations in this process, NPI EXPAND Brazil offered an exclusive training in data processing and protection. “We identified a knowledge gap regarding the LGPD in many of the organizations,” said Beatriz Ferreira, Senior Business Associate at Palladium, referring to the organizations supported by NPI EXPAND and USAID in Brazil.

The “LGPD” mentioned by Ferreira is the Brazilian Data Protection General Law (Law n. 13.709). In force since September 2020, the legislation establishes the principles that should guide the processing of personal data. This is a victory for civil society in Brazil, which led the fight for data protection in the country, and was the focus of the training.

Data protection in the health sector

The very nature of the projects supported by NPI EXPAND in Brazil implies the importance of good data management. We are talking about information in lists, phone calls, consultations, medical records, field activities – data that can impact people’s lives and public health as a whole. “The main challenge is to maintain the reliability and adopt safe and adequate procedures, as institutions often do not have structure or resources,” confirms Adiomar Santos.

NPI EXPAND facilitates a variety of capacity strengthening approaches and interventions to support grantees. These include providing direct learning interventions, group/team training, collaboratively designing and facilitating upgrades of organizational processes, and facilitating peer learning, to strengthen the organizational and technical capacity of local partners to meet crucial health goals equitably and sustainably.

In the case of data management, this concerns both the way in which this information is collected as well as its internal management. When requesting data, it is necessary to make it clear to the patient why, when and by whom their data will be used. And there needs to be consent. “Many of these organizations work in partnership with public authorities and other organizations. So, how does this data flow as it leaves one organization to another? It is necessary to understand the principles of the law for this process to be safe,” explains Beatriz Ferreira.

Understanding the principles and best practices on data protection

Civil society organizations in Brazil have not yet fully comprehended how the data protection law applies to their work processes. The training was designed to fill this gap, bringing the law closer to the practical reality of each organization and highlighting its impact on people’s lives. “Once these organizations also work in the health sector, with projects involving vulnerable communities, there is a concern. Health data are sensitive personal data and, by law, the use of this type of data requires rigorous treatment,” warns Leonardo Chain, the lawyer responsible for the LGPD capacity strengthening training.

Theoretical classes and practical activities presented the key concepts and technical aspects of the law, demonstrating the importance of data security in any social work involving people and public health. In addition to understanding how the law applies to their daily work, the participants identified opportunities brought by the LGPD. “One of the learnings was understanding that these data can be used to create new projects, as well as in the engagement of social justice policies, entrepreneurship and other programs aimed at the community,” comments Adiomar Santos.

The online training was open to the different departments of the organizations, in order to strengthen an internal culture of data collection, management and protection. In total, there were 154 registered participants from 23 organizations. “I’m very interested in this topic, and I intend to keep studying it on my own to complement what I’ve learned in the classes. This knowledge will be of great value for my career,” celebrated Daniele Graça, one of the participants.

For Beatriz Ferreira, the results are positive: “The methodology brought the participants closer to the practical use of the LGPD, and showed the consequences of non-adherence. The training brought an understanding that this goes beyond the projects supported by NPI EXPAND.”

Data protection improving capacity strengthening

LGPD is placed into a broader context of collective rights protection. Complying with the law reinforces the credibility of organizations: it shows that the work for environmental conservation and health in the Amazon region does not compromise people’s privacy nor the responsible management of the data involved in this work.

The training also helped to strengthen institutional capacities within the organizations. For Edgar Ramos Barra, project manager at Instituto Peabiru, the learning will contribute to the organization’s results: “Our work is predominantly with people and data collection. The training will help us to update some procedures that were not in compliance with the law, allowing us to improve our work, always maintaining good results.”

A proper and safe work with personal data, in addition to preventing sanctions in case of non-adherence to the law, enables the participation in national and international public notices or calls for proposals, for many of which data protection is a requirement. “Especially among non-governmental organizations, where there are external investments, investors require this type of compliance – they do not want their name associated with or investing in a project that could lead to a data leak. That is why this work is so important,” emphasizes Leonardo Chain.