Text
16 June 2020
Re: CONFLICT OF INTEREST ON A DATA PROTECTION OFFICER DESIGNATED AS A COMPLIANCE OFFICER
Dear [Redacted],
We write in response to your request for an advisory opinion seeking clarification on matters relating to the role of a data protection officer (DPO) vis-à-vis the department reorganization within your company. Essentially, you ask whether there will be an independence issue and conflict of interest if the DPO who is currently under the Executive Department and reports to the highest officer in the plant, will be transferred to the Risk and Assurance Department (Risk Department), and will be assigned to function as the Compliance Officer at the same time.
We understand that the Compliance Officer handles the monitoring of the company’s various compliance requirements and activities, i.e. renewal of permits, licenses, third party contracts, working visas, alien employment permits, health insurance of expatriate employees, etc. You claim that the tasks of a Compliance Officer would require processing the personal data of employees which gives rise to a conflict of interest vis-à-vis the duties as a DPO.
Discussion
Data protection officer; independence; autonomy
It is true that a DPO must be independent in the performance of their functions and shall be afforded a significant degree of autonomy by the personal information controller (PIC) or personal information processor (PIP).1 However, this principle must be harmonized with the employer’s right to fully manage and control his or her business, subject only to the limitations provided by law.
You mentioned that it is proposed that the Risk Department will facilitate the overall implementation of the Compliance Management System that covers Data Privacy Compliance. From acursory reading of the facts, it seems that the Risk Department will only be overseeing Data Privacy Compliance and may not necessarily interfere with the functions of the DPO. Further, being placed under the direct supervision of any of the company’s departments does not necessarily entail the loss of the DPO’s independence and autonomy.
NPC Advisory No. 2017-01 is clear in its requirement that a DPO shall be allowed to enjoy a sufficient degree of autonomy, and that for this purpose, he/she must not receive instructions from the PIC or PIP regarding the exercise of his/her tasks. A DPO is not required to have total or complete autonomy as the independence required only pertains to the exercise of his/her tasks.
Direct supervision of a company department can pertain to various aspects of employment such as monitoring and implementing compliance with company rules and regulations, or the setting of qualitative and quantitative parameters for accomplishments. These, however, does not necessarily encroach on the performance of a DPO’s functions and/or tasks and the DPO can still perform each task independently without any interference from the department he was assigned to.
Furthermore, under the doctrine of management prerogative, every employer has the inherent right to regulate, according to his own discretion and judgment, all aspects of employment, including hiring, work assignments, working methods, the time, place and manner of work, work supervision, transfer of employees, lay-off of workers, and discipline, dismissal, and recall of employees.2
Nonetheless, if based on your assessment, there will indeed be an independence issue if the DPO would made to report to the Risk Department, you are not precluded from formally communicating the same to the pertinent officers in your company and documenting the outcome.
Simultaneous designation as DPO and Compliance Officer; conflict of interest
Another related concern you raised is the seeming conflict of interest with the designation of the DPO as the Compliance Officer simultaneously. You stated that the conflict of interest arises mainly because of the functions to be performed by a Compliance Officer conflicts with the functions of a DPO.
Specifically, you pointed out that the function of monitoring company compliance for the operations and maintenance makes a Compliance Officer a process owner, and thus creates the conflict vis-à-vis a DPO’s functions.
To backtrack, conflict of interest refers to a scenario wherein a DPO is charged with performing tasks, duties, and responsibilities that may be opposed to or could affect his performance as DPO, i.e. holding a position that leads him to determine the purposes and the means of the processing of personal data.3
Further, we note the pertinent discussions under Article 29 of the Data Protection Working Party of the European Commission - Guidelines on Data Protection Officers (‘DPOs’)4 on the matter of conflict of interest, to wit:
“… This entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. Due to the specific organisational structure in each organisation, this has to be considered case by case.
As a rule of thumb, conflicting positions within the organisation may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing.”
We understand the concern about processing personal data by the DPO as a Compliance Officer. Nevertheless, we note that this will essentially entail monitoring compliance with a predetermined or set compliance requirements with various government agencies or other third parties, i.e. submission of reportorial requirements, securing permits, renewing business licenses, reviewing contracts, etc. These are recurring and standard tasks that are accomplished on a regular basis.
In a sense, a Compliance Officer does not technically have much discretion or flexibility to actually determine the purposes and the means of the processing personal data as most, if not all, of the compliance requirements are pursuant to a specific law or regulation.
Nevertheless, a DPO can make his or her opinion on the matter known to management to help the latter in identifying the positions which would be incompatible with the function of a DPO. Pursuant to the Article 29 of the Data Protection Working Party of the European Commission - Guidelines on DPOs, internal rules may be drafted to avoid conflict of interests, where such rules may provide for the following, to wit:
- Identification of the position/s which would be incompatible with the function of DPO;
- Draft internal rules to avoid conflicts of interests;
- Provide an explanation about conflicts of interests;
- Declare that the DPO has no conflict of interests with regard to his/her function as a DPO, as a way of raising awareness of this requirement;
- Include safeguards in the internal rules of the organization and to ensure that the vacancy notice for the position of DPO or the service contract is sufficiently precise and detailed in order to avoid a conflict of interests.5
As provided in NPC Advisory 2017-01, the “opinion of the DPO or the Compliance Officer for Privacy(“COP”) must be given due weight. In case of disagreement, and should the PIC or PIP choose not to follow the advice of the DPO or COP, it is recommended, as good practice, to document the reasons therefor.”
This opinion is provided based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
National Privacy Commission, Designation of Data Protection Officers NPC Advisory No. 2017-01 (March 14, 2017). ↩
-
Rural Bank of Cantilan, Inc. v. Julve, 545 Phil. 619 (2007). ↩
-
NPC 2017-01, Definition of Terms. ↩
-
European Commission, Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’), Adopted on 13 December 2016, As last Revised and Adopted on 5 April 2017, page 16, available at https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612048 (last accessed: 17 June 2020). ↩
-
See: European Commission, Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’), Adopted on 13 December 2016, As last Revised and Adopted on 5 April 2017, page 16, available at https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612048 (last accessed: 17 June 2020). ↩