National/International Legal Consultant – MIDAS Legal Assessment

International Organization for Migration · Maseru

Introduction

Established in 1951, IOM is a Related Organization of the United Nations and the leading UN agency in the field of migration. Working closely with governmental, intergovernmental and non-governmental partners, IOM promotes humane and orderly migration for the benefit of all. It saves lives and protects people on the move, drives solutions to displacement, and facilitates pathways for regular migration, while providing services and advice to governments and migrants.

IOM is committed to fostering a respectful, inclusive and supportive workplace where all employees can thrive professionally and feel valued. By creating such an environment, IOM aims to better harness the full potential of migration and strengthen its support to people on the move.

IOM invites candidates from diverse backgrounds to apply and provides reasonable accommodation throughout the recruitment process when required. Learn more about IOM’s workplace culture at IOM workplace culture | International Organization for Migration

Project Context and Scope

The International Organization for Migration (IOM) is supporting the Government of the Kingdom of Lesotho in the modernization of border and migration management systems through the deployment of the Migration Information and Data Analysis System (MIDAS). MIDAS is IOM's flagship Border Management Information System (BMIS), designed to facilitate the electronic collection, storage, processing, sharing, and analysis of traveller information at border crossing points.

The MIDAS deployment project in Lesotho aims to strengthen border governance, improve migration management, enhance national security, facilitate legitimate cross-border movement, and strengthen the generation and analysis of migration data for evidence-based decision-making. The project includes technical and legal assessments as foundational requirements to guide the implementation, configuration, and long-term sustainability of the system. The project documentation specifically foresees a legal assessment to review legislative and regulatory frameworks relevant to border management, migration governance, automated border control procedures, data protection, and data privacy.

The Kingdom of Lesotho has established a legal framework for the protection of personal information through the Data Protection Act, 2011 (Act No. 5 of 2012), which regulates the processing of personal information, establishes principles for lawful processing, provides safeguards for sensitive personal information, and contains provisions regarding data security, data subject rights, and cross-border transfers of personal data.

As the deployment and operation of MIDAS will involve the collection, processing, storage, use and sharing of personal and biometric data obtained through relevant immigration and border control procedures, the implementation of the system must be assessed against the Data Protection Act, relevant constitutional protections relating to privacy and fundamental rights, and applicable legislation governing immigration, border management, national security, information management, and the relevant powers and functions of competent border authorities.

Furthermore, MIDAS may facilitate interoperability and information exchange between government systems and, where authorised, with regional or international partners. A comprehensive review of the legal, regulatory, institutional, and policy environment is therefore required to determine whether existing legislation adequately supports the collection, processing, retention, sharing, and protection of traveller information and biometric data and to identify any legal, regulatory or operational gaps that could affect implementation, in compliance with national legislation, international obligations, human rights standards, and recognised principles of data protection and privacy.

Particular attention shall be given to legal provisions governing data sharing, cross-border transfers of personal information, the processing of sensitive personal information and biometric data, and safeguards necessary to ensure compliance with applicable data protection requirements.

IOM therefore seeks the services of a qualified legal expert to undertake a comprehensive legal assessment to inform the development and strengthening of the legal and institutional framework governing border management data in Lesotho, including recommendations and a roadmap for its implementation.

Objective of the Consultancy

The overall objective of the consultancy is to conduct a comprehensive legal assessment of the legislative, regulatory, policy, and institutional framework governing border and migration management, personal data protection and privacy, biometric data processing, information management and information-sharing arrangements, and interoperability between government information systems in Lesotho, in order to determine the legal basis for the deployment and operation of MIDAS in Lesotho.

The assessment shall examine the extent to which existing national legislation, including the Data Protection Act, 2011 (Act No. 5 of 2012) and applicable immigration and border management legislation, supports the lawful collection, processing, retention, sharing, and protection of personal and biometric data within MIDAS.

The assessment shall further evaluate compliance with applicable regional and international obligations, international human rights standards, and internationally recognized data protection principles, and provide practical recommendations to address identified legal, institutional, operational, and policy gaps necessary for the sustainable implementation and operation of MIDAS in Lesotho.

Specific Objectives

The consultant shall:

Review the legal and institutional framework governing border management and migration governance in Lesotho.
Assess the adequacy of the legal basis for the collection, processing, storage, retention, transmission, sharing, protection and lawful use of personal and biometric data for border management purposes, including in the context of MIDAS.
Evaluate the alignment of the national framework with applicable constitutional protections, international human rights obligations, regional commitments and international data protection principles.
Assess the legal, regulatory and institutional arrangements governing interoperability and information-sharing between relevant national systems and institutions.
Identify legal, regulatory, policy, and institutional gaps that may affect the effective governance of border management data and the sustainable deployment of MIDAS.
Develop recommendations and a roadmap to strengthen the legal, regulatory and institutional framework governing border management data, including measures required to support the sustainable deployment and operation of MIDAS.

Scope of Work

The consultant shall conduct a legal and institutional assessment of the national framework governing border management data in Lesotho. The assessment shall focus on the collection, processing, storage, retention, sharing, protection, transfer and governance of border management data, including personal and biometric data, and shall identify gaps and recommendations necessary to strengthen the national framework in line with national legislation and applicable regional and international standards.

The consultant shall include the following components:

Review of the Legal and Regulatory Framework

Conduct a detailed review of relevant constitutional, legislative, regulatory, and policy instruments governing border management, migration management, identity management, data protection, privacy, information management, cybersecurity, and related areas.

The review shall assess the extent to which the existing framework provides an adequate legal basis for the collection, processing, storage, retention, sharing, protection and lawful use of border management data by competent authorities.

The review shall also examine the legal mandates and powers of competent authorities involved in border management, migration governance, identity management, law enforcement, and national security, insofar as these relate to the collection, access, use, and sharing of border management data.

This includes, but is not limited to, the Immigration Act and Regulations, passport and citizenship legislation, and refugee and asylum legislation. Human trafficking and transnational organised crime legislation, Border management policies, strategies and operational frameworks, National migration policies and strategies, Civil registration framework, National identity management framework, Population registry systems, Foundational identification systems, constitutional privacy protections, Data protection laws and regulations, ICT legislation, Cybersecurity frameworks, Evidence and electronic transactions legislation.

Stakeholder Consultations

Undertake consultations with relevant governmental and non-governmental stakeholders involved in border management, migration governance, identity management, data protection, information and communications technology, law enforcement and national security.

This may include, as appropriate, the following actors: Ministry of Home Affairs and Police; Department of Immigration Services; Ministry of Justice; national ICT authorities; National Identity Management Agencies; Civil Registration Authorities; Lesotho Mounted Police Service; National security stakeholders: border agencies operating at Points of Entry, development partners, and technical stakeholders.

The consultations shall seek to map institutional mandates and responsibilities, identify existing practices relating to border management data governance, assess institutional coordination and oversight mechanisms, identify challenges, gaps, and priority needs, and validate preliminary findings and recommendations.

Assessment of Institutional Arrangements and Data Governance Frameworks

Examine the mandates, functions and responsibilities of institutions involved in the collection, management, sharing, protection and oversight of border management data.

The assessment shall analyse:

institutional roles and responsibilities;
coordination and accountability mechanisms;
data governance and oversight arrangements;
safeguards governing access to, use, disclosure and sharing of border management data;
institutional capacities and challenges affecting effective data governance.

Assessment of Information sharing, interoperability and cross-border data exchange

Assess the legal, regulatory and institutional arrangements governing the exchange of border management data within and between competent national authorities and with external partners. This may include legal provisions governing data exchange between immigration systems, national ID systems, passports systems, civil registration systems, law enforcement systems, and international systems (e.g. INTERPOL).

Particular attention shall be given to:

inter-agency information sharing mechanisms;
interoperability between border management, identity management, civil registration and law enforcement systems;
legal safeguards governing data exchange;
cross-border sharing of personal and biometric data;
applicable requirements, limitations and safeguards relating to international data transfers.

Assessment of Data Protection and Privacy Safeguards

Assess the adequacy of existing legal and institutional safeguards relating to the protection of personal and biometric data processed for border management purposes.

The assessment shall consider:

lawfulness of processing;
data protection principles;
processing of sensitive personal information and biometric data;
purpose limitation and data minimization requirements;
rights of data subjects;
retention and disposal requirements;
security and confidentiality safeguards;
oversight and accountability mechanisms;
remedies and redress mechanisms.

Analysis against Regional and International Instruments

Assess the alignment of the national framework with applicable regional, continental and international obligations, standards and good practices, including where relevant:

ICAO standards and recommended practices
African Union legal instruments relating to migration and border governance
The SADC Model Law on Data Protection and relevant regional data protection frameworks
Relevant SADC protocols and regional cooperation frameworks related to migration, border management and information sharing
Relevant International human rights instruments
Refugee and migration-related conventions ratified by Lesotho
Internationally recognized principles and standards relating to privacy, data protection and biometric data processing

Gap Analysis and Recommendations

Identify legal, regulatory, institutional and operational gaps affecting effective border management data governance and provide recommendations to strengthen the national framework.

Recommendations should include:

legislative and regulatory reforms;
institutional strengthening measures;
governance and accountability mechanisms;
information-sharing and interoperability arrangements;
data protection and privacy safeguards;
standard operating procedures and cooperation frameworks;
priority implementation actions.

The recommendations shall include a roadmap for the implementation of the recommendations, including immediate actions, medium--term legal, policy, and operational reforms, long-term legislative and institutional strengthening measures, as well as a draft framework for data-sharing agreements and institutional protocols.

The assessment is not intended to constitute a technical, operational, cybersecurity or compliance audit of any specific border management information system. Any reference to existing or planned information systems, including MIDAS, shall be made solely for the purpose of assessing the broader legal, regulatory and institutional framework governing border management data. The assessment shall focus on the national framework for border management data governance rather than on the performance or compliance of any particular system.

Organizational Department / Unit to which the Consultant is contributing

Enhancing Border and Migration Management in Lesotho through the Deployment of the Migration Information and Data Analysis System (MIDAS).

WBL= IB0581:1:2:2:001:LS10

Apply by: DD/MM/YYYY The consultant shall conduct a legal and institutional assessment of the national framework governing border management data in Lesotho. The assessment shall focus on the collection, processing, storage, retention, sharing, protection, transfer and governance of border management data, including personal and biometric data, and shall identify gaps and recommendations necessary to strengthen the national framework in line with national legislation and applicable regional and international standards.

More jobs at International Organization for Migration · Legal & Compliance jobs in Maseru