RFI_72011723RFI00001 CO SIGNED.pdf

Issue Date 09/12/2023

Closing Date & Time 11/13/2023, 13:00pm, Chisinau, Moldova Time

Activity Title Safeguarding Moldova's Digital Transformation

Submission must be sent to sjohnson@usaid.gov, etakahashi@usaid.gov, dprodan@usaid.gov, icernea@usaid.gov

Subject Request for Information (RFI) #72011723RFI00001 for USAID/Moldova

To All Interested Parties:

The United States Agency for International Development (USAID) is seeking information, comments, suggestions, and recommendations in the attached draft requirement documents (Attachment 1 - Requirements Document and Attachment 2 - Questions) for a new USAID award. Subject to the availability of funds, information from respondents may inform one or multiple awards. It is also possible no awards will be made. These potential awards are anticipated to have a multi-year period of performance.

Interested parties are invited to provide comments/responses in Microsoft Word compatible format no later than 11/13/2023 via email to Suzanne H. Johnson, Contracting/Agreement Officer at sjohnson@usaid.gov with a copy to Ethan Takahashi, Director of the Office of Acquisition and Assistance at etakahashi@usaid.gov, Dan Prodan, Acquisition and Assistance Specialist at dprodan@usaid.gov and Ion Cernea, Acquisition and Assistance Specialist at icernea@usaid.gov with subject line “Request for Information – Safeguarding Moldova's Digital Transformation.”

Responses on any or all questions is appreciated. USAID does not expect respondents to provide information on all questions. While the limit on the length of submissions is ten pages, USAID is seeking concise, issue-specific comments that respond to the objective specific questions in Attachment 2. You may receive an electronic confirmation acknowledging receipt of your response. Responses will be kept confidential and will not be made publicly available or shared outside of USAID. However, USAID will apply information, recommendations and suggestions made in the submissions to refine potential statements of objectives associated with future procurements, if any, associated with this RFI. This RFI is issued solely for information and planning purposes and does not constitute a Request for Applications/Request for Proposals (RFA/RFP). Responses to this RFI shall not be construed as proposals and will not be accepted by the U.S. Government (USG) to form a binding agreement.

Responding or providing comments on this RFI will not give any advantage to any organization in any subsequent procurement. USAID will not provide answers to any question submitted in response to this request and will not host a pre-solicitation conference. USAID reserves the right to modify the scope and scale of the RFI.

Thank you for your interest in USAID/Moldova programs.

Sincerely, Suzanne H. Johnson, CFCM, CPCM Contracting/Agreement Officer USAID/Moldova

ATTACHMENT 1: DRAFT REQUIREMENTS DESCRIPTION INTRODUCTION

INTRODUCTION

Through this Request for Information (RFI), USAID/Moldova seeks to gather information to inform a program approach to support the safeguarding of Moldova's digital ecosystem in line with respect for human rights and democratic values. Dependent on multiple factors, including availability of funds, such information may inform future award(s). Responses for this RFI is intended to enable USAID/Moldova to engage a variety of stakeholders including government counterparts, private sector companies and professional associations, civil society organizations and media, academia, think tanks, and regional and multilateral organizations in understanding the needs and opportunities for supporting Moldova in ensuring a fair and secure digital transformation in line with best global practices.

BACKGROUND AND PURPOSE

Background

Digital transformation is one of the Government of Moldova's four major policy priorities (2021-2025) and will enable the country to achieve EU accession benchmarks1, including fighting corruption and implementing public administration reform. The recently drafted Strategy for Digital Transformation of the Republic of Moldova 2023-20302 outlines the full scope of the government's ambitious digital aims, which include fully digitizing public institutions and services, establishing the cross-use of all data by public platforms, automating government processes, implementing algorithmic decision-making in the public sector, establishing a digital ID, and in the near future, promoting and implementing artificial intelligence, blockchain, and other emerging technologies.

Realizing these and other goals3 related to digital transformation will undoubtedly bring Moldovans greater economic and societal benefits. However, such progress will also introduce new risks, as evidence suggests that vast amounts of personal digital data will enter a digital ecosystem that lacks adequate safeguards to prevent it from being misused and abused (please see below). Absent significant attention and resources, digital transformation will challenge the government's capacity to protect Moldovans' human rights and prevent foreign adversaries from accessing and weaponizing data -whether directly or through intermediary data brokers - in the context of the ongoing war in Ukraine.

An April 2023 report by leading Moldovan human rights organization Promolex found that “digital technologies are developed without mechanisms to ensure the respect of human rights.”4 For example, the Strategy for Digital Transformation only “addresses tangentially the promotion and protection of rights and freedoms online.” While there are currently several legal instruments and government institutions,5 “limitations to digital rights could arise from gaps in legislation which has not been expressly designed for the online environment.” For example, the government enjoys wide powers to monitor online data and block webpages, and uses facial recognition technologies (e.g., at border control or in traffic monitoring), without providing a mechanism for seeking remedy should rights be violated. Judges, prosecutors, and lawyers lack the necessary digital literacy to adjudicate such cases.

This lack of literacy has knock-on negative effects on the business climate.

1 https://neighbourhood-enlargement.ec.europa.eu/european-neighbourhood-policy/countries-region/moldova_en 2 https://eufordigital.eu/new-digital-transformation-strategy-to-guide-moldova-in-european-integration/ 3 Other goals of the strategy include advancing digital literacy, digital infrastructure, the ICT sector, digital economy and ensuring cybersecurity.

4 https://promolex.md/23333-raport-de-tara-cso-meter-moldova-2022/?lang=en 5 The Law on Electronic Communications, the International Convention on Cybercrime (ratified in 2009), the Law on Preventing and Combating Cybercrime 20/2009, and the Law on Personal Data Protection 133/2011 (a new law is also expected) as well as actors such as the E-governance Agency, the National Regulatory Agency for Electronic Communications and Information Technology (ANRCETI), the National Center for Personal Data Protection (NCPDP), the Directorate for Combating Cyber Crimes, and the Information Technology and Cyber Security Service (STISC).

Promo-LEX warns that “public awareness on digital rights as such is essentially non-existent” and that debate on related issues rarely occurs. Its recommendations include the development of a multi-sector dialogue platform (between the state, business sector, and civil society) focusing on human rights in digital contexts, the integration of a rights-based approach into legislation and strategies, training for judicial actors, a national program on digital literacy, and civil society’s proactive involvement in promoting human rights in the digital age. Per the European Commission, "enhancing the involvement of civil society in decision-making processes at all levels" is one of the nine improvements Moldova must make to progress on the path to EU membership6.

Consultations held by USAID with civil society groups in August 2023 supports these findings and indicated that similar gaps of knowledge and capacity exist in the private sector, where ICT companies, including Internet Service Providers and Mobile Network Operators, largely lack understanding of how to comply with new and changing legislation on data protection. The ICT sector contributes 7% of Moldova's GDP7 and represents 5% of the country's total trade, and compliance will become increasingly urgent as Moldova's Ministry of Justice is expected to table a law in Parliament in Fall 2023 that better harmonizes Moldova's legal and regulatory framework on data protection with that of the EU's Global Data Protection Regulation -- comprehensive privacy legislation that applies across sectors and to companies of all sizes and outlines the rules for the protection of personal data and the movement of data. Adequate compliance with this legislation, which mandates that each company have an internal independent expert charged with monitoring personal data protection, will be necessary to drive continued foreign investment in the private sector, and equip Moldovan companies to thrive in the European market.

As outlined by the European Commission, strengthening the protection of human rights is one of the nine improvements Moldova must make to progress on the path to EU membership.8 In digital contexts, the right to privacy and the protection of personal data, in particular, have been widely recognized as instrumental in preserving and promoting fundamental values and rights; and to exercising other rights and freedoms (e.g. freedom of expression and peaceful assembly). The People's Advocate Office - Moldova's National Human Rights Institution - has named digital technologies (including artificial intelligence) and business and human rights - as two of their main priorities in their 2030 strategy, which was approved in February 2023.

Purpose

The goal of a future award(s) - preliminarily referenced as Safeguarding Moldova's Digital Transformation - would be to support the safeguarding of Moldova's digital ecosystem in order to "strengthen the protection of human rights, particularly of vulnerable groups." It would also "enhance the involvement of civil society in decision-making processes at all levels" -- these are two of the nine improvements Moldova must make to progress on the path to EU membership9. The program would place citizens at the center, working with civil society and academia to build on existing (and when appropriate forming new) multi-stakeholder partnerships with the government and the private sector to develop legal expertise, draft EU-harmonized legislation and policies, build advocacy capacity, conduct independent oversight, and strengthen knowledge and skills, including among the public at large.

Together, stakeholders should identify opportunities for productive engagement, leverage incentive structures, and create shared language for tackling the most pressing human rights issues in the digital age.

This approach is consistent with and outlined in USAID's Digital Strategy. It would support the protection of human rights in Moldova today, and also help to future-proof Moldovan society so that digital data

6 https://neighbourhood-enlargement.ec.europa.eu/opinion-moldovas-application-membership-european-union_en 7 https://particip.gov.md/ro/document/stages/anunt-privind-initierea-elaborarii-strategiei-de-transformare-digitala-a-republicii-moldova-pentru-anii-20232030-stdm-2030/9355 8 Step #9 is "Strengthening the protection of human rights": https://neighbourhood-enlargement.ec.europa.eu/european-neighbourhood-policy/countries-region/moldova_en 9 https://neighbourhood-enlargement.ec.europa.eu/opinion-moldovas-application-membership-european-union_en collected today does not drive democratic decline and human rights abuses tomorrow. This is a particular risk given the upcoming presidential and parliamentary elections in 2024 and 2025.

The preliminary development hypothesis under the Program is as follows:

If the Moldovan government better harmonizes its legal and regulatory frameworks concerning data privacy and protection with relevant E.U. legislation, regulation, and directives; and if Moldovan public and private sectors effectively implement and provide oversight on the implementation of these frameworks; and if civil society and citizens meaningfully inform decision-making on digital issues that affect their enjoyment of rights and freedoms, then Moldova's digital transformation will strengthen the protection of human rights and enhance the country's advancement towards future EU membership.

OBJECTIVES AND ILLUSTRATIVE ACTIVITIES

This support will be achieved through the following objectives and illustrative activities.

Objective I - The Government of Moldova harmonizes its legal and regulatory frameworks on the management, use, and deployment of digital data with its international human rights commitments10 and relevant European Union laws and conventions that promote respect for human rights in digital contexts.11

Illustrative Interventions:

Interventions could strengthen the alignment and harmonization of Moldova's domestic legal and regulatory frameworks that govern or impact the development, use, and deployment of data and information with their international human rights commitments and relevant European Union laws and conventions that promote respect for human rights online and in digital contexts12. These interventions could include strengthening or developing frameworks that govern data privacy and protection, including for related data-driven technologies and automated systems -- for example, those that employ artificial intelligence / machine learning. They could also support and strengthen existing multi-stakeholder13 working groups and committees, and existing executive branch institutions such as ministries or legislative bodies, including legislative committees. Support to the executive branch or legislature could be provided for local actors engaged in reform of existing laws and regulations or drafting new ones in line with international and E.U. standards and principles. Additional illustrative activities could include support for interested government actors to develop or strengthen safeguards that prevent the misuse of personal data, including impact assessments for public service platforms and other types of digital infrastructure and systems that facilitate data collection, exchange, and storage.

Emphasis could be placed on encouraging multi-stakeholder approaches to legal and regulatory processes and oversight or accountability functions in each branch of government–including strengthening processes for engagement with civil society.

Objective II - The Government of Moldova and the private sector implements laws and regulations on the management of digital data in alignment with respect for human rights and democratic values.

10 These include the Universal Declaration of Human Rights (UDHR), the International Covenant on Civil and Political Rights (ICCPR), and the UN Guiding Principles for Business and Human Rights. The right to privacy, specifically, is set forth in the European Convention on Human Rights, the UDHR (Article 12), and the ICCPR (Article 17), all of which Moldova have ratified. Also relevant is the European Commission's European Declaration on Digital Rights and Principles, the first principle of which is putting people and their rights at the center of the digital transformation.

11 These include the European Union Global Data Protection Regulation (GDPR), Directive (EU) 2016/680 of the European Parliament and of the Council, and the EU Digital Services Act, which have already gone into effect, as well as the Council of Europe's Convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law, and the EU Artificial Intelligence Act, which are in the process of being drafted and negotiated.

12 Ibid 13 In this context, multistakeholder must include civil society stakeholders.

Interventions could strengthen the ability of the public and private sectors to collect, manage, use, deploy, and store digital data in alignment with Moldova's international human rights commitments and standards and relevant European Union laws and conventions that promote respect for human rights in digital contexts. Support should be provided to ensure the implementation of legal and regulatory frameworks across national14 and subnational15 governance entities. Support should also be provided to judicial actors to include capacity building and training for the interpretation and application of relevant legal and regulatory frameworks, including in relation to rulings by the European Court of Human Rights (ECHR). Cross-cutting support should also be provided to strengthen institutional oversight mechanisms within government, including support for the National Center for Personal Data Protection (NCPDP) and the People's Advocate Office16. Additional illustrative activities include support for interested government actors to develop or strengthen safeguards that prevent the misuse of personal data, including impact assessments for public service platforms and other types of digital infrastructure and systems that facilitate data collection, exchange, and storage.

Objective III - Moldovan civil society and the broader public meaningfully informs decision-making on the governance and use of personal digital data.

Illustrative Interventions

Interventions should support local and/or regional civil society, independent technologists, professional associations, independent oversight bodies, activists, and the general public to engage directly and regularly with government and private sector actors to promote rights-respecting practices and ensure accountability for protecting human rights obligations, especially as they relate to the governance and use of personal digital data. These interventions include strengthening the capacity of civic actors to monitor, advocate, and influence the government and the private sector. Efforts can focus on increased collaboration and learning through support for global or regional networks of civil society actors.

Support could be provided to strengthen multistakeholder initiatives and platforms, which could elevate civil society engagement with government and the private sector. Illustrative interventions can also include public media and information campaigns - including with influencers, and formal and informal education opportunities to help increase citizen awareness of and engagement with digital and human rights issues, especially related to privacy and personal data protection. Activities should also provide training and technologies to strengthen the digital security capacity of civic actors; strengthen existing networks of civil society actors working on digital security to increase learning and information sharing;

support monitoring, advocacy, and reporting of gaps in human rights protections and/or human rights violations; conduct digital security audits; and strengthen community emergency response teams, hotlines, and/or other forms of rapid support to civic actors experiencing cyberattacks.

END of DRAFT REQUIREMENT DESCRIPTION

14 These could include the State Chancellery, the Ministries of Justice; Internal Affairs; Finance, Customs, Institute of Public Administration, and the E-Governance Agency, among others.

15 These could include mayors offices, city halls, and rayon councils.

16 According to the European Commission Opinion on the Republic of Moldova’s application for membership of the European Union: The Ombudsperson institution – the People’s Advocate – is designated as the National Human Rights Institution and accredited with “A” status by Global Alliance of National Human Rights Institutions as largely complying with the Paris Principles. Its financial and functional independence should be strengthened

ATTACHMENT 2: QUESTIONS

The program will focus on harnessing a comprehensive, multi-stakeholder approach for protecting and respecting human rights and fostering democratic values across the digital ecosystem. USAID/Moldova may significantly revise this proposed Program and planned solicitation resulting from the comments received, and from other stakeholder consultations. By issuing the activity requirement draft for comment, USAID/Moldova aims to consult with a broad community of public and private sector stakeholders. Stakeholder comments are requested to help maximize development impact and coordination with existing and planned development partner programs. Respondents are not expected to respond to all of the below questions. Respondents should only provide responses and information related to those areas they have technical expertise and experience in working on. USAID welcomes responses that address any of the following questions:

1. Does the background/problem statement adequately capture the major challenges to safeguarding Moldova's digital ecosystem, and harmonizing it with EU-based approaches, especially as related to privacy and personal data protection? What additional factors should be considered?

2. Are the proposed objectives clear and realistic? If some are not clear and/or realistic, please provide detailed suggestions.

3. To what degree do the illustrative interventions enable the public sector - across the executive, legislature and judiciary - to align Moldova's digital transformation agenda with a human rights-based approach, especially when it comes to privacy and personal data protection? What focus areas and interventions are missing?

4. To what degree do the illustrative interventions enable the private sector to implement relevant legal and regulatory frameworks on data protection in alignment with a "business and human rights" approach? What approaches and interventions are missing?

5. To what degree do the illustrative interventions equip civil society and the broader public to meaningfully inform decisions about the governance and use of digital data? What approaches and interventions are missing?

6. What existing multi-stakeholder coalitions or working groups could be leveraged, if any, to address the challenges listed in the background and purpose? What additional stakeholders should be included if relevant? If none exist, what is the ideal scope and structure of a multistakeholder coalition that could effectively address the challenges mentioned?

7. How do you suggest we support bridging the persistent gap in understanding between the people building, financing, and deploying digital technologies and the people raising the alarms about the need for safeguarding digital systems?

8. What indicators (context and outcome) to measure results should be considered?

END of QUESTIONS