National/International Legal Consultant – MIDAS Legal Assessment

Introduction

Established in 1951, IOM is a Related Organization of the United Nations and the leading UN agency in the field of migration. Working closely with governmental, intergovernmental and non-governmental partners, IOM promotes humane and orderly migration for the benefit of all. It saves lives and protects people on the move, drives solutions to displacement, and facilitates pathways for regular migration, while providing services and advice to governments and migrants. 

IOM is committed to fostering a respectful, inclusive and supportive workplace where all employees can thrive professionally and feel valued. By creating such an environment, IOM aims to better harness the full potential of migration and strengthen its support to people on the move.

IOM invites candidates from diverse backgrounds to apply and provides reasonable accommodation throughout the recruitment process when required. Learn more about IOM’s workplace culture at IOM workplace culture | International Organization for Migration

Project Context and Scope

The International Organization for Migration (IOM) is supporting the Government of the Kingdom of Lesotho in the modernization of border and migration management systems through the deployment of the Migration Information and Data Analysis System (MIDAS). MIDAS is IOM's flagship Border Management Information System (BMIS), designed to facilitate the electronic collection, storage, processing, sharing, and analysis of traveller information at border crossing points.

The MIDAS deployment project in Lesotho aims to strengthen border governance, improve migration management, enhance national security, facilitate legitimate cross-border movement, and strengthen the generation and analysis of migration data for evidence-based decision-making. The project includes technical and legal assessments as foundational requirements to guide the implementation, configuration, and long-term sustainability of the system. The project documentation specifically foresees a legal assessment to review legislative and regulatory frameworks relevant to border management, migration governance, automated border control procedures, data protection, and data privacy. 

The Kingdom of Lesotho has established a legal framework for the protection of personal information through the Data Protection Act, 2011 (Act No. 5 of 2012), which regulates the processing of personal information, establishes principles for lawful processing, provides safeguards for sensitive personal information, and contains provisions regarding data security, data subject rights, and cross-border transfers of personal data.

As the deployment and operation of MIDAS will involve the collection, processing, storage, use and sharing of personal and biometric data obtained through relevant immigration and border control procedures, the implementation of the system must be assessed against the Data Protection Act, relevant constitutional protections relating to privacy and fundamental rights, and applicable legislation governing immigration, border management, national security, information management, and the relevant powers and functions of competent border authorities.

Furthermore, MIDAS may facilitate interoperability and information exchange between government systems and, where authorised, with regional or international partners. A comprehensive review of the legal, regulatory, institutional, and policy environment is therefore required to determine whether existing legislation adequately supports the collection, processing, retention, sharing, and protection of traveller information and biometric data and to identify any legal, regulatory or operational gaps that could affect implementation, in compliance with national legislation, international obligations, human rights standards, and recognised principles of data protection and privacy.

Particular attention shall be given to legal provisions governing data sharing, cross-border transfers of personal information, the processing of sensitive personal information and biometric data, and safeguards necessary to ensure compliance with applicable data protection requirements.

IOM therefore seeks the services of a qualified legal expert to undertake a comprehensive legal assessment to inform the development and strengthening of the legal and institutional framework governing border management data in Lesotho, including recommendations and a roadmap for its implementation.

Objective of the Consultancy

The overall objective of the consultancy is to conduct a comprehensive legal assessment of the legislative, regulatory, policy, and institutional framework governing border and migration management, personal data protection and privacy, biometric data processing, information management and information-sharing arrangements, and interoperability between government information systems in Lesotho, in order to determine the legal basis for the deployment and operation of MIDAS in Lesotho.

The assessment shall examine the extent to which existing national legislation, including the Data Protection Act, 2011 (Act No. 5 of 2012) and applicable immigration and border management legislation, supports the lawful collection, processing, retention, sharing, and protection of personal and biometric data within MIDAS.

The assessment shall further evaluate compliance with applicable regional and international obligations, international human rights standards, and internationally recognized data protection principles, and provide practical recommendations to address identified legal, institutional, operational, and policy gaps necessary for the sustainable implementation and operation of MIDAS in Lesotho.

Specific Objectives

The consultant shall:

1. Review the legal and institutional framework governing border management and migration governance in Lesotho.

2. Assess the adequacy of the legal basis for the collection, processing, storage, retention, transmission, sharing, protection and lawful use of personal and biometric data for border management purposes, including in the context of MIDAS.

3. Evaluate the alignment of the national framework with applicable constitutional protections, international human rights obligations, regional commitments and international data protection principles.

4. Assess the legal, regulatory and institutional arrangements governing interoperability and information-sharing between relevant national systems and institutions.

5. Identify legal, regulatory, policy, and institutional gaps that may affect the effective governance of border management data and the sustainable deployment of MIDAS.

6. Develop recommendations and a roadmap to strengthen the legal, regulatory and institutional framework governing border management data, including measures required to support the sustainable deployment and operation of MIDAS.

    

   Scope of Work

The consultant shall conduct a legal and institutional assessment of the national framework governing border management data in Lesotho. The assessment shall focus on the collection, processing, storage, retention, sharing, protection, transfer and governance of border management data, including personal and biometric data, and shall identify gaps and recommendations necessary to strengthen the national framework in line with national legislation and applicable regional and international standards.

The consultant shall include the following components:

1. Review of the Legal and Regulatory Framework

Conduct a detailed review of relevant constitutional, legislative, regulatory, and policy instruments governing border management, migration management, identity management, data protection, privacy, information management, cybersecurity, and related areas.

The review shall assess the extent to which the existing framework provides an adequate legal basis for the collection, processing, storage, retention, sharing, protection and lawful use of border management data by competent authorities.

The review shall also examine the legal mandates and powers of competent authorities involved in border management, migration governance, identity management, law enforcement, and national security, insofar as these relate to the collection, access, use, and sharing of border management data.

This includes, but is not limited to, the Immigration Act and Regulations, passport and citizenship legislation, and refugee and asylum legislation. Human trafficking and transnational organised crime legislation, Border management policies, strategies and operational frameworks, National migration policies and strategies, Civil registration framework, National identity management framework, Population registry systems, Foundational identification systems, constitutional privacy protections, Data protection laws and regulations, ICT legislation, Cybersecurity frameworks, Evidence and electronic transactions legislation.

2. Stakeholder Consultations

Undertake consultations with relevant governmental and non-governmental stakeholders involved in border management, migration governance, identity management, data protection, information and communications technology, law enforcement and national security.

This may include, as appropriate, the following actors: Ministry of Home Affairs and Police; Department of Immigration Services; Ministry of Justice; national ICT authorities; National Identity Management Agencies; Civil Registration Authorities; Lesotho Mounted Police Service; National security stakeholders: border agencies operating at Points of Entry, development partners, and technical stakeholders.

The consultations shall seek to map institutional mandates and responsibilities, identify existing practices relating to border management data governance, assess institutional coordination and oversight mechanisms, identify challenges, gaps, and priority needs, and validate preliminary findings and recommendations.

3. Assessment of Institutional Arrangements and Data Governance Frameworks

Examine the mandates, functions and responsibilities of institutions involved in the collection, management, sharing, protection and oversight of border management data.

The assessment shall analyse:

• institutional roles and responsibilities;

• coordination and accountability mechanisms;

• data governance and oversight arrangements;

• safeguards governing access to, use, disclosure and sharing of border management data;

• institutional capacities and challenges affecting effective data governance.

4. Assessment of Information sharing, interoperability and cross-border data exchange

Assess the legal, regulatory and institutional arrangements governing the exchange of border management data within and between competent national authorities and with external partners. This may include legal provisions governing data exchange between immigration systems, national ID systems, passports systems, civil registration systems, law enforcement systems, and international systems (e.g. INTERPOL). 

Particular attention shall be given to:

• inter-agency information sharing mechanisms;

• interoperability between border management, identity management, civil registration and law enforcement systems;

• legal safeguards governing data exchange;

• cross-border sharing of personal and biometric data;

• applicable requirements, limitations and safeguards relating to international data transfers.

5. Assessment of Data Protection and Privacy Safeguards 

Assess the adequacy of existing legal and institutional safeguards relating to the protection of personal and biometric data processed for border management purposes.

The assessment shall consider:

• lawfulness of processing;

• data protection principles;

• processing of sensitive personal information and biometric data;

• purpose limitation and data minimization requirements;

• rights of data subjects;

• retention and disposal requirements;

• security and confidentiality safeguards;

• oversight and accountability mechanisms;

• remedies and redress mechanisms.

6. Analysis against Regional and International Instruments

Assess the alignment of the national framework with applicable regional, continental and international obligations, standards and good practices, including where relevant:

• ICAO standards and recommended practices

• African Union legal instruments relating to migration and border governance

• The SADC Model Law on Data Protection and relevant regional data protection frameworks

• Relevant SADC protocols and regional cooperation frameworks related to migration, border management and information sharing

• Relevant International human rights instruments

• Refugee and migration-related conventions ratified by Lesotho

• Internationally recognized principles and standards relating to privacy, data protection and biometric data processing

7. Gap Analysis and Recommendations

Identify legal, regulatory, institutional and operational gaps affecting effective border management data governance and provide recommendations to strengthen the national framework. 

Recommendations should include:

• legislative and regulatory reforms;

• institutional strengthening measures;

• governance and accountability mechanisms;

• information-sharing and interoperability arrangements;

• data protection and privacy safeguards;

• standard operating procedures and cooperation frameworks;

• priority implementation actions.

The recommendations shall include a roadmap for the implementation of the recommendations, including immediate actions, medium--term legal, policy, and operational reforms, long-term legislative and institutional strengthening measures, as well as a draft framework for data-sharing agreements and institutional protocols. 

The assessment is not intended to constitute a technical, operational, cybersecurity or compliance audit of any specific border management information system. Any reference to existing or planned information systems, including MIDAS, shall be made solely for the purpose of assessing the broader legal, regulatory and institutional framework governing border management data. The assessment shall focus on the national framework for border management data governance rather than on the performance or compliance of any particular system.

Required Qualifications and Experience

Education

• Advanced university degree (Master's degree or equivalent) in: Law, International Law, Public Law, Human Rights Law, Information Technology Law, Data Protection Law, Related field

   

Experience

The consultant must possess:

• Minimum 7 years of professional experience in legal and regulatory analysis.
• Experience conducting legal assessments for government institutions.
• Demonstrated knowledge of migration governance and border management.
• Experience in data protection, privacy, cybersecurity or ICT regulation.
• Experience working with international organizations or development agencies.
• Experience in Southern Africa or SADC region is highly desirable.
• Knowledge of biometric identification systems, border management information systems, or digital identity systems is an advantage.

Skills

• Technical Competencies

  Strong legal drafting skills, analytical ability, policy analysis expertise, research skills, knowledge of data protection principles, knowledge of migration governance frameworks.

• Core Competencies

  Professionalism, integrity, accountability, teamwork, effective communication, cultural sensitivity

Languages

For this consultancy,  proficiency in English, the required language (s), will be specifically evaluated during the selection process, which may include written and/or oral assessments.

Required Competencies

IOM’s competency framework can be found at this link. Competencies will be assessed during the selection process.

Values - all IOM staff members must abide by and demonstrate these five values:

• Inclusion and respect for diversity: Respects and promotes individual and cultural differences. Encourages diversity and inclusion.
• Integrity and transparency: Maintains high ethical standards and acts in a manner consistent with organizational principles/rules and standards of conduct.
• Professionalism: Demonstrates ability to work in a composed, competent and committed manner and exercises careful judgment in meeting day-to-day challenges.
• Courage: Demonstrates willingness to take a stand on issues of importance.
• Empathy: Shows compassion for others, makes people feel safe, respected and fairly treated.

Core Competencies – behavioural indicators

• Teamwork: Develops and promotes effective collaboration within and across units to achieve shared goals and optimize results.
• Delivering results: Produces and delivers quality results in a service-oriented and timely manner. Is action oriented and committed to achieving agreed outcomes.
• Managing and sharing knowledge: Continuously seeks to learn, share knowledge and innovate.
• Accountability: Takes ownership for achieving the Organization’s priorities and assumes responsibility for own actions and delegated work.
• Communication: Encourages and contributes to clear and open communication. Explains complex matters in an informative, inspiring and motivational way.

Notes

IOM covers Consultants against occupational accidents and illnesses under the Compensation Plan (CP), free of charge, for the duration of the consultancy. IOM does not provide evacuation or medical insurance for reasons related to non-occupational accidents and illnesses. Consultants are responsible for their own medical insurance for non-occupational accident or illness and will be required to provide written proof of such coverage before commencing work. 

Any offer made to the candidate in relation to this vacancy notice is subject to funding confirmation.

Appointment will be subject to certification that the candidate is medically fit for appointment, accreditation, any residency or visa requirements, security clearances.

IOM has a zero-tolerance policy on conduct that is incompatible with the aims and objectives of the United Nations and IOM, including sexual exploitation and abuse, sexual harassment, abuse of authority and discrimination based on gender, nationality, age, race, sexual orientation, religious or ethnic background or disabilities.

IOM does not charge a fee at any stage of its recruitment process (application, interview, processing, training or other fee). IOM does not request any information related to bank accounts.

IOM only accepts duly completed applications submitted through the IOM e-Recruitment system (for internal candidates link here). The online tool also allows candidates to track the status of their application.

No late applications will be accepted. Only shortlisted candidates will be contacted.

For further information and other job postings, you are welcome to visit our website: IOM Careers and Job Vacancies