This Privacy Notice explains how the IIMP collects, uses, shares, retains, and protects personal data in the course of its work searching for missing persons and supporting their families. It also describes the rights that individuals may have regarding their personal information.

The IIMP obtains information relevant to missing persons cases from various sources, including third parties. This Notice is therefore intended for any person whose personal data may be processed in connection with the work of the IIMP relating to missing persons and supporting their families. This may include missing persons whose fate or whereabouts the IIMP is working to clarify, family members of missing persons, witnesses or other persons connected to missing persons cases, representatives of organizations involved in missing persons processes or referral programs, as well as individuals whose personal data may be contained in documents, records, or other information relevant to missing persons cases.

The Notice does not relate to IIMP’s processing corporate or office personal data, such as data processed for the purposes of human resources and career management, financial, procurement or administrative operations.

“Personal data” means any information that relates to an identified or identifiable natural person.

This may include information that directly identifies a person, such as a name, date of birth, an identification number or a photograph, as well as information that can identify someone when combined with other data. It can also cover special characteristics of an individual, including those related to their physical, psychological, genetic, financial, cultural or social aspects. Personal data can exist in many forms, including written records, digital information, video or audio recordings.

In short, if it is information that can be reasonably linked to a specific individual, either directly or indirectly, it is considered personal data.

IIMP collects and process different types of personal data depending on the nature of the activity and the circumstances of a particular case. The categories of data may include:

• Identification data, such as names, ID numbers or documentation, nationality, gender, nationality, ethnic origin, date and place of birth, or any other identifying details.
• Physical description data which may assist in locating or identifying missing persons, including height, weight, distinguishing marks, and photographs.
• Biographical, social, and family information which may assist in searching missing persons, including data relating to occupation, education or professional background, family connections, social relationships, community, political, tribal or religious affiliations.
• Information about the circumstances of a disappearance, such as known date of disappearance, last known locations and related events.
• Photographs, audiovisual material, including images, recordings, and documentary materials relating to missing persons, including photographs of individuals, locations, or relevant evidence.
• Biological and genetic data, such as biological samples or genetic information provided by family members.
• Information relating to the needs of families of missing persons, including data relevant to referrals for healthcare, legal, psychosocial, and humanitarian assistance.
• Contact and communication data, including communication preferences, email addresses, and phone numbers. It may also include records of communication and content of information shared with us.

This data is obtained from various sources, including families of the missing, witnesses, informants, and other third parties, humanitarian organizations, media organizations, government entities, official records, and publicly available sources.

The IIMP processes personal data only for specific, legitimate, explicitly defined purposes permitted under an applicable legal basis. The primary purpose is to fulfill IIMP’s humanitarian mandate to clarify the fate and whereabouts of missing persons from the Syrian Arab Republic and to support victims, survivors and families. Processing purposes related to this mandate may include:

• Registering cases of missing persons, whether new cases or cases previously reported to other authorities and institutions.
• Establishing the identity, location, condition and fate of missing persons.
• Seeking the reunification of a missing person with their relatives.
• Seeking the release of a missing person if found to be arbitrarily detained.
• Identifying human remains and facilitating their prompt and dignified return to families, including through referrals to relevant actors.
• Collecting, and consolidating information and data on missing persons obtained from different sources to support the search of missing persons.
• Undertaking structural and contextual analysis of information and data to inform a search plan.
• Providing information to families and ensuring their participation.
• Supporting survivors and family members through referrals, including for health, legal and other support or assistance.
• Generating statistics and aggregated data relevant to the situation of missing persons and their families.
• Ensuring long-term preservation and secure archiving of relevant data related to missing persons, to safeguard historical memory and enable future tracing or identification efforts.

The IIMP processes personal data covered by this Notice as necessary to perform the mandate it received from the United Nations General Assembly, in line with the Data Protection and Privacy Policy for the Secretariat of the United Nations (ST/SGB/2024/3) and by the IIMP Data Protection and Privacy Guidelines.

Depending on the specific circumstances another legal basis may also apply. These include the protection of vital interests, when the processing is essential to safeguard an individual’s life and safety; and best interests of the child, when the data subject is a child.

The IIMP brings together all the information collected from families and other sources to help trace missing persons. Personal details, such as names, photos and physical descriptions may be compared with reports from witnesses, other victims, or with records from detention centers, hospitals or other facilities. Information is also analyzed for patterns. For example, last known location and social connections is cross-checked with contextual and historical information, and possible leads.

Personal data is considered alongside other evidence to strengthen reliability. Sometimes elements provided by a family only become useful much later, when new records or testimonies appear that can be linked to those elements.

When several pieces of information point to the same person, such as matching description, testimonies and in some cases genetic samples, the IIMP may be able to confirm the identity, location or fate of a missing person. In some cases, the DNA provided by relatives can be compared with unidentified human remains to establish an identity with a high degree of certainty.

This process may take time and may not always bring definitive answers, but every piece of information families and other key actors share helps build a more complete picture and can contribute to progress in the search.

The IIMP also uses personal data to keep families informed and involve them in the search.

The Institution also processes personal data to understand the needs of families of missing persons and survivors and to facilitate access to appropriate support services. This is generally done through household-level needs assessments, interviews, and other forms of communication. The information collected may relate to areas such as health, psychosocial support, legal assistance, social services and other forms of humanitarian support. Relevant information may be used to connect families with organizations or service providers that are able to offer assistance. Only the information necessary to facilitate such referrals is shared.

The IIMP applies appropriate technical and organizational measures to protect personal data against any unauthorized access, damage, loss, or misuse. Access to personal data is restricted solely to authorized persons with a legitimate need to know for the purposes of this processing operation. The IIMP also applies procedures designed to ensure secure and responsible handling of data.

All IIMP staff who have access to, and are associated with the processing of personal data, are obliged to comply with the rules concerning the classification and handling of all United Nations data, including with respect to the confidentiality of personal data they handle in their official capacity.

The IIMP enjoys privileges and immunities that guarantee international legal protections of data, and the database and data processing systems.

For purposes directly linked to carrying out its humanitarian mandate received from the United Nations General Assembly, the IIMP may transfer personal data to trusted partners inside and outside the UN. The IIMP makes reasonable efforts to ensure these recipients afford an appropriate level of security and protection for personal data in a manner at least equivalent to the principles of the Data Protection and Privacy Policy for the Secretariat of the United Nations.

For example, the IIMP may under these conditions share personal data with trusted humanitarian partners involved in the search for the missing and in providing support to their families, such as other international actors or government entities, to improve search efforts and facilitate access to support services.

Data transfers can be essential for the search for a missing person. Without sharing any personal data, search organizations may be unable even to ask other organizations whether they hold information about the missing person by name. This can significantly limit their capacity to obtain information and provide information to families. For this reason, basic information about the missing person, such as his or her name and date of disappearance, may be shared when the IIMP has identified a third party that is reasonably likely to hold relevant information. Only information necessary for such requests will be shared, in accordance with the Institution’s data protection commitments.

Individuals have the right to request that the IIMP cease or restrict any transfers of their data. Each request will be assessed on a case-by-case basis.

Personal data is retained only for the amount of time that is necessary to meet the specified purposes in support IIMP mandate, and subject to applicable UN rules or policies governing records management.

Because information relating to missing persons may remain relevant over long period of time, some information may be retained for extended periods as necessary to support efforts to clarify the fate of missing persons. In addition, the IIMP is entrusted with designing and implementing appropriate systems for the long-term preservation and archiving of relevant information and data related to missing persons in the Syrian Arab Republic in the best interests of victims, survivors and families.

Individuals may request information about personal data relating to them that may be processed by the IIMP. In particular, individuals may:

• Request confirmation as to whether personal data relating to them is being processed.
• Request access to personal data relating to them that is being processed.
• Request that the IIMP rectifies, completes, deletes, restricts or ceases processing of personal data relating to them.

Requests may be submitted by contacting the Institution using the contact details provided below.

Further information about the procedures applicable to such requests is available in ST/SGB/2024/3.

For further information about the data protection framework applicable to the IIMP, please consult the following documents.