1 CVA is the most current terminology used in the humanitarian sector, with the previously used synonyms being Cash Transfer Programming, Cash-Based Assistance and Cash-Based Interventions. See Cash Learning Partnership (CaLP), “Glossary of Terms”, available at: www.calpnetwork.org/library-and-resources/glossary-of-terms/ (all internet references were accessed in December 2020).

2 CaLP, The State of the World's Cash 2020: Cash and Voucher Assistance in Humanitarian Aid, July 2020, p. 9, available at: www.calpnetwork.org/publication/the-state-of-the-worlds-cash-2020-full-report/.

3 “Cash” in this definition of CVA refers to both physical and digital payments.

4 The International Committee of the Red Cross's (ICRC) definition – in line with CaLP and other CVA providers – focuses on direct transfers to individuals, families and communities in need. The ICRC does not count larger transfers of money to partners like National Red Cross and Red Crescent Societies and large businesses, or salary top-ups to staff in the relevant authorities with whom the organization works. CVA also excludes remittances and micro-finance, although micro-finance institutions may be used for the actual delivery of CVA. ICRC, Cash Transfer Programming in Armed Conflict: The ICRC's Experience, Geneva, November 2018, p. 14, available at: www.icrc.org/en/publication/cash-transfer-programming-armed-conflict-icrcs-experience.

5 International Telecommunication Union, Facts and Figures 2019: Measuring Digital Development, Geneva, 2019, available at: https://itu.foleon.com/itu/measuring-digital-development/home/.

6 GSMA, The Mobile Economy 2020, London, 2020, p. 3, available at: www.gsma.com/mobileeconomy/wp-content/uploads/2020/03/GSMA_MobileEconomy2020_Global.pdf.

7 Siena Anstis, Ron Deibert, Miles Kenyon and John Scott-Railton, “The Dangerous Effects of Unregulated Commercial Spyware”, Citizen Lab, 24 June 2019, available at: https://citizenlab.ca/2019/06/the-dangerous-effects-of-unregulated-commercial-spyware/.

8 Maggie Miller, “FBI Sees Spike in Cyber Crime Reports during Coronavirus Pandemic”, The Hill, 16 April 2020, available at: https://thehill.com/policy/cybersecurity/493198-fbi-sees-spike-in-cyber-crime-reports-during-coronavirus-pandemic.

9 A 2014 European Central Bank study which focused on cash and non-cash (including digital) payments across seven European countries found that cash is still widely in use, even where many other payment mechanisms exist. Importantly, the study found that use of cash is strongly correlated with demographics and point-of-sale characteristics. While this study looks at industrialized countries, it is important to consider how these results might be extrapolated into the types of contexts that humanitarians work in. See John Bagnall, David Bounie, Kim P. Huynh, Anneke Kosse, Tobias Schmidt, Scott Schuh and Helmut Stix, Consumer Cash Usage: A Cross-Country Comparison with Payment Diary Survey Data, Working Paper Series No. 1685, European Central Bank, June 2014.

10 ELAN, “Vocabulary and Usage”, available at: www.calpnetwork.org/wp-content/uploads/2020/01/elan-vocab-and-usage-expanded-jan-2017.pdf.

11 Legal tender is anything recognized by law as a means to settle a public or private debt or meet a financial obligation, including tax payments, contracts, and legal fines or damages.

12 Better Than Cash Alliance (BTCA), “Payments Measurement Toolkit”, available at: www.betterthancash.org/tools-research/toolkits/payments-measurement/focusing-your-measurement/introduction.

13 CaLP, above note 2, p. 116.

14 Mary B. Anderson, Do No Harm: How Aid Can Support Peace or War, Lynne Rienner, Boulder, CO, 1999. For a recent foundational text, see Slim, Hugo, Humanitarian Ethics: A Guide to the Morality of Aid in War and Disaster, Oxford University Press, Oxford, 2015Google Scholar.

15 Sphere Project, The Sphere Handbook: Humanitarian Charter and Minimum Standards in Humanitarian Response, 2018, Protection Principle 1, available at: https://handbook.spherestandards.org/en/sphere/#ch004_002_002.

16 ICRC, “ICRC Protection Policy”, International Review of the Red Cross, Vol. 90, No. 871, 2008, p. 753Google Scholar, available at: www.icrc.org/en/doc/assets/files/other/irrc-871-icrc-protection-policy.pdf.

17 Oxfam, “Responsible Program Data Policy”, February 2015, available at: https://policy-practice.oxfam.org.uk/publications/oxfam-responsible-program-data-policy-575950.

18 Oxfam, “Responsible Data Management”, 2017, available at: https://policy-practice.oxfam.org.uk/our-approach/toolkits-and-guidelines/responsible-data-management.

19 OCHA, Centre for Humanitarian Data, “Data Responsibility”, available at: https://centre.humdata.org/data-responsibility/.

20 ICRC, Symposium Report: Digital Risks in Situations of Armed Conflict, London, 11–12 December 2018, Geneva, 2019, p. 1, available at: www.icrc.org/en/publication/4403-symposium-report-digital-risks-armed-conflicts.

21 Overseas Development Institute (ODI), Doing Cash Differently: How Cash Transfers can Transform Humanitarian Aid. Report of the High Level Panel on Humanitarian Cash Transfers, London, September 2015.

22 Hugh Thomas, “Measuring Progress towards a Cashless Society”, MasterCard Advisors, available at: https://newsroom.mastercard.com/wp-content/uploads/2014/08/MasterCardAdvisors-CashlessSociety-July-20146.pdf.

23 See the Cash Hub interactive cash maps, available at: www.cash-hub.org/resources/cash-maps.

24 Leora Klapper and Dorothe Singer, The Opportunities of Digitizing Payments, World Bank, Washington, DC, 28 August 2015, p. 91.

25 The BTCA is a partnership of seventy-five governments, companies and international organizations intended to accelerate the “transition from cash to digital payments in order to reduce poverty and drive inclusive growth”. See the BTCA website, available at: www.betterthancash.org.

26 BTCA, “Why Digital Payments?”, available at: www.betterthancash.org/why-digital-payments.

27 European Centre for Disease Prevention and Control, Technical Report of the Scientific Panel on Influenza in Reply to Eight Questions concerning Avian Flu, Stockholm, 5 June 2006, p. 26, available at: www.ecdc.europa.eu/sites/default/files/media/en/publications/Publications/0606_TER_Eight_Questions_Concerning_Avian_Flu.pdf.

28 WHO and the Global Health Cluster, Guidance Note on the Role of Cash and Voucher Assistance to Reduce Financial Barriers in the Response to the COVID-19 Pandemic, in Countries Targeted by the Global Humanitarian Response Plan COVID-19, Geneva, April 2020, p. 8, available at: www.who.int/health-cluster/about/work/task-teams/Guidance-note-CVA-COVID.pdf?ua=1.

29 International Red Cross and Red Crescent Movement, Cash Transfer Programming: Guidelines for Mainstreaming and Preparedness, Geneva, 2015, available at: https://cash-hub.org/wp-content/uploads/sites/3/2020/10/Cash-Transfer-Programming-Guidelines-for-Mainstreaming-and-Preparedness.pdf.

30 See “Q&A: Humanitarian Operations, the Spread of Harmful Information and Data Protection”, in this issue of the Review.

31 ICRC, L'agence internationale des prisoners de guerre, Genève, 1914–1918, Geneva, 1919, p. 105Google Scholar.

32 ICRC, above note 4, p. 7.

33 Laura Gordon, Risk and Humanitarian Cash Transfer Programming: Background Note for the High Level Panel on Humanitarian Cash Transfers, ODI, London, May 2015, available at: www.odi.org/sites/odi.org.uk/files/odi-assets/publications-opinion-files/9727.pdf.

34 AGIS Consulting, Cash Essentials: Beyond Payments, Paris, 2015, available at: https://cashessentials.org/?ref=xranks.

35 It has been argued that cash is the preferred means for criminal activities seeking to avoid detection. However, digitalization is changing this, with reports that “electronic money laundering, also known as Transaction Laundering, is the most common, but least enforced, method of money laundering”. Ron Teicher, “Transaction Laundering – Money Laundering Goes Electronic in the 21st Century”, Finextra, 4 June 2018, available at: www.finextra.com/blogposting/15423/transaction-laundering---money-laundering-goes-electronic-in-the-21st-century.

36 Leora Klapper, Annamaria Lusardi and Peter van Oudhuesden, Financial Literacy around the world: Insights from Standard & Poor's Ratings Services Global Financial Literacy Study, 2015, available at: https://gflec.org/wp-content/uploads/2015/11/3313-Finlit_Report_FINAL-5.11.16.pdf?x28148.

37 KYC is a process enabling businesses to check the identity of their customers in order to comply with regulations and legislation on money laundering and corruption, and includes collecting information from the customer such as name, identity document number, phone number and address. PwC, Know Your Customer: Quick Reference Guide, January 2016, available at: www.pwc.lu/en/anti-money-laundering/docs/pwc-kyc-qrg-final-interactive-2016.pdf.

38 FATF, “FATF Recommendation 5: Customer Due Diligence and Record-Keeping”, available at: www.un.org/sc/ctc/wp-content/uploads/2016/03/fatf-rec05.pdf.

39 World Bank, “ID4D Data: Global Identification Challenge by the Numbers”, available at: https://id4d.worldbank.org/global-dataset.

40 Vyjyanti T. Desai, Anna Diofasi and Jing Lu, “The Global Identification Challenge: Who Are the 1 Billion People without Proof of Identity?”, Voices: World Bank Blogs, 25 April 2018, available at: https://blogs.worldbank.org/voices/global-identification-challenge-who-are-1-billion-people-without-proof-identity.

41 Paul Harvey, Kokoévi Sossouvi and Annie Hurlstone, Humanitarian Cash and Financial Inclusion: Findings from Red Cross Movement Projects in Kenya and Nigeria, British Red Cross and ICRC, London, February 2018, p. 6.

42 CaLP, above note 2, p. 144.

43 UN, Promoting Inclusion through Social Protection: Report on the World Social Situation 2018, New York, 2018, p. 18, available at: www.un.org/development/desa/dspd/wp-content/uploads/sites/22/2018/07/1-1.pdf.

44 ICRC, above note 4, p. 9.

45 CaLP, above note 2, p. 52.

46 The ICRC convened a symposium on “Digital Risks in Armed Conflicts” in December 2018 in London: see ICRC, above note 20. CaLP convened a data responsibility workshop in April 2019 in Geneva: see CaLP, “Data Responsibility: Let's Not Wait for Another Wake-Up Call”, 8 May 2019, available at: www.calpnetwork.org/blog/data-responsibility-lets-not-wait-for-another-wake-up-call/. Findings from the CaLP workshop were taken into a first meeting on “Data Responsibility in Humanitarian Action” convened by the OCHA Centre for Humanitarian Data, in collaboration with Wilton Park, in May 2019: see Wilton Park, “Data Responsibility in Humanitarian Action: From Principle to Practice”, available at: www.wiltonpark.org.uk/event/wp1688/. A second Wilton Park event in October 2019 focused more broadly on “Digital Dignity in Armed Conflict”: see Wilton Park, Digital Dignity in Armed Conflict: A Roadmap for Principled Humanitarian Action in the Age of Digital Transformation, October 2019, available at: www.wiltonpark.org.uk/wp-content/uploads/WP1698-Report.pdf.

47 Wilton Park, Data Responsibility in Humanitarian Action: From Principle to Practice, June 2019, available at: www.wiltonpark.org.uk/wp-content/uploads/WP1688-Report-1.pdf.

48 See Collaborative Cash Delivery Network, “Our Story”, available at: www.collaborativecash.org/the-network.

49 See Inter-Agency Standing Committee (IASC), “Statement from the Principals of OCHA, UNHCR, WFP, and UNICEF on Cash Assistance”, 5 December 2018, available at: https://interagencystandingcommittee.org/other/content/statement-principals-ocha-unhcr-wfp-and-unicef-cash-assistance-5-december-2018.

50 See the official Grand Bargain website, available at: https://interagencystandingcommittee.org/grand-bargain.

51 IASC, “Increase the Use and Coordination of Cash-Based Programming”, available at: https://interagencystandingcommittee.org/increase-the-use-and-coordination-of-cash-based-programming.

52 Barnaby Willitts-King, John Bryant and Kerrie Holloway, The Humanitarian “Digital Divide”, Humanitarian Policy Group Working Paper, ODI, London, November 2019, p. 15.

53 World Bank Group, GSMA and Secure Identity Alliance, Digital Identity: Towards Shared Principles for Public and Private Sector Cooperation, July 2016, available at: www.gsma.com/mobilefordevelopment/wp-content/uploads/2016/07/Towards-Shared-Principles-for-Public-and-Private-Sector-Cooperation.pdf.

54 World Bank Group, Privacy by Design: Current Practices in Estonia, India, and Austria, Washington, DC, 2018, available at: https://id4d.worldbank.org/sites/id4d.worldbank.org/files/PrivacyByDesign_112918web.pdf.

55 Ibid.

56 UNHCR, “Documentation”, available at: www.unhcr.org/registration-guidance/chapter5/documentation/.

57 Wilton Park, Digital Dignity in Armed Conflict, above note 46, p. 4.

58 UN Security Council Resolution 2396 requires all States to use “biometric data, which could include fingerprints, photographs, facial recognition, and other relevant identifying biometric data, in order to responsibly and properly identify terrorists, including foreign terrorist fighters”. See UNSC Res. 2396, 21 December 2017, available at: http://unscr.com/en/resolutions/doc/2396; Fionnuala Ní Aoláin, “The UN Security Council, Global Watch Lists, Biometrics, and the Threat to the Rule of Law”, Just Security, 17 January 2018, available at: www.justsecurity.org/51075/security-council-global-watch-lists-biometrics/.

59 The Engine Room and Oxfam, Biometrics in the Humanitarian Sector, March 2018, p. 8, available at: www.theengineroom.org/biometric-tech-review-report/.

60 Elsie Thomas, “Tagged, Tracked and in Danger: How the Rohingya Got Caught in the UN's Risky Biometric Database”, Wired, 12 March 2018, available at: www.wired.co.uk/article/united-nations-refugees-biometric-database-rohingya-myanmar-bangladesh.

61 Ibid.

62 The Engine Room and Oxfam, above note 59.

63 E. Thomas, above note 60.

64 Ben Hayes and Massimo Marelli, “Facilitating Innovation, Ensuring Protection: The ICRC Biometrics Policy”, Humanitarian Law and Policy Blog, 18 October 2019, available at: https://blogs.icrc.org/law-and-policy/2019/10/18/innovation-protection-icrc-biometrics-policy/.

65 Ibid.

66 Julia Carrie Wong, “The Cambridge Analytica Scandal Changed the World – but It Didn't Change Facebook”, The Guardian, 18 March 2019, available at: www.theguardian.com/technology/2019/mar/17/the-cambridge-analytica-scandal-changed-the-world-but-it-didnt-change-facebook.

67 Dan Noyes, “The Top 20 Valuable Facebook Statistics”, Zephoria, October 2020, available at: https://zephoria.com/top-15-valuable-facebook-statistics/.

68 See Universal Declaration of Human Rights, UN Doc. 217 A (III), 10 December 1948, Art. 12; International Covenant on Civil and Political Rights, 999 UNTS 171, 16 December 1966 (entered into force 23 March 1976), Art. 17.

69 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS No. 108, 28 January 1981 (entered into force 1 October 1985), available at: www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108.

70 United Nations Conference on Trade and Development, “Data Protection and Privacy Legislation Worldwide”, available at: https://unctad.org/page/data-protection-and-privacy-legislation-worldwide.

71 Christopher Kuner and Massimo Marelli (eds), Handbook on Data Protection in Humanitarian Action, 2nd ed., ICRC and Brussels Privacy Hub, Geneva, June 2020, p. 51, available at: www.icrc.org/en/data-protection-humanitarian-action-handbook.

72 Ibid., p. 60.

73 Wilton Park, Digital Dignity in Armed Conflict, above note 46.

74 It is important to note that FATF recommendations do require data retention, access for law enforcement, the establishment of financial intelligence units, the submission of suspicious financial transaction reports, etc. See FATF, The FATF Recommendations, February 2012 (updated October 2020), available at: www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html.

75 ICRC, above note 4, p. 50.

76 Ibid., p. 51.

77 David Cole, “‘We Kill People Based on Metadata’”, New York Review of Books, 10 May 2014, available at: www.nybooks.com/daily/2014/05/10/we-kill-people-based-metadata/. And see Johns Hopkins University, “The Price of Privacy: Re-Evaluating the NSA”, Johns Hopkins Foreign Affairs Symposium, 2014, available at: www.youtube.com/watch?time_continue=1022&v=kV2HDM86XgI.

78 Ron Deibert, Citizen Lab, quoted in Stephanie Kirchgaessner, “‘Cat and Mouse Game’: How Citizen Lab Shone a Spotlight on Israeli Spyware Firm”, The Guardian, 12 May 2020, available at: www.theguardian.com/world/2020/may/12/cat-and-mouse-game-how-citizen-lab-shone-a-spotlight-on-israeli-spyware-firm-nso.

79 ICRC and Privacy International, The Humanitarian Metadata Problem: “Doing No Harm” in the Digital Era, Geneva, October 2018, p. 74.

80 Niall McCarthy, “Which Countries Are Deploying Coronavirus Tracing Apps?”, Forbes, 22 July 2020, available at: https://tinyurl.com/j8wse55q.

81 Privacy International, “There's an App for That: Coronavirus Apps”, 20 April 2020, available at: https://privacyinternational.org/long-read/3675/theres-app-coronavirus-apps.

82 Ibid.

83 On the protections that international humanitarian law affords against the effects of cyber operations during armed conflicts, see “Twenty Years On: International Humanitarian Law and the Protection of Civilians against the Effects of Cyber Operations during Armed Conflicts”, in this issue of the Review.

84 Patrick Collins, “Visa Card Payments System Returns to Full Capacity after Crash”, The Guardian, 2 June 2018.

85 Martin Arnold, “MasterCard Customers Suffer Outages around the World”, Financial Times, 12 July 2018.

86 Hadar Rosenberg, Banking and Financial Services: Cyber Threat Landscape Report, IntSights, April 2019, p. 3.

87 World Economic Forum, Impact of COVID-19 on the Global Financial System: Recommendations for Policy-Makers Based on Industry Practitioner Perspectives, Geneva, April 2020, available at: www3.weforum.org/docs/WEF_Impact_of_COVID_19_on_the_Global_Financial_System_2020.pdf.

88 ICRC, above note 20, p. 12.

89 Ben Parker, “The Cyber Attack the UN Tried to Keep under Wraps”, The New Humanitarian, 29 January 2020, available at: www.thenewhumanitarian.org/investigation/2020/01/29/united-nations-cyber-attack.

90 Ground Truth Solutions, Improving User Journeys for Humanitarian Cash Transfers, December 2018, available at: https://groundtruthsolutions.org/wp-content/uploads/2018/12/User_Journeys_Summary-Report_2018.pdf.

91 Mercy Corps, Financial Inclusion: Approach and Principles, 2019, available at: https://tinyurl.com/1f9ejhfq.

92 See the Center for Financial Inclusion website, available at: www.centerforfinancialinclusion.org.

93 See the Consultative Group to Assist the Poor website, available at: http://cgap.org/.

94 CaLP, “E-Transfers and Operationalizing Beneficiary Data Protection”, available at: www.calpnetwork.org/blog/new-calp-online-training-course-e-transfers-and-operationalizing-beneficiary-data-protection/.

95 ELAN, A Data Starter Kit for Humanitarian Field Staff, available at: www.mercycorps.org/sites/default/files/2019-11/DataStarterKitforFieldStaffELAN.pdf

96 Mercy Corps, E-Transfer Implementation Guide, 2018, available at: www.mercycorps.org/sites/default/files/2020-01/EtransferGuide2018%2C%20Final.pdf.

97 C. Kuner and M. Marelli (eds), above note 71, Chap. 5.

98 CaLP, Protection Beneficiary Privacy: Principles and Operational Standards for the Secure Use of Personal Data in Cash and e-Transfer Programmes, 2013, available at: www.calpnetwork.org/wp-content/uploads/2020/01/calp-beneficiary-privacy-web.pdf.

99 C. Kuner and M. Marelli (eds), above note 71, p. 154.

100 ICRC, above note 4, p. 26.

101 C. Kuner and M. Marelli (eds), above note 71, p. 155.

102 OCHA, Centre for Humanitarian Data, “Guidance Note: Data Incident Management”, August 2019, available at: https://centre.humdata.org/wp-content/uploads/2019/08/guidanceNote2_dataincidentmanagement.pdf.

103 It is important when providing humanitarian services to collect the minimum amount of data possible, or even none at all. This process of data minimization is separate from the question of identifying the appropriate legal basis for data collection and processing, a principle which is supported by the ICRC's Handbook on Data Protection in Humanitarian Action and the “do no harm” principle and is one of the core principles of data protection.

104 ICRC, above note 20, p. 5.

105 Ibid., p. 2.

106 Ibid., p. 2.