NPC Issuance Wiki

NPC Advisory Opinion No. 2021-005 — Conflict of Interest in the Designation of a Data Protection Officer

Issued Advisory Opinion

Official opinion tags

Text

24 February 2021

Re: CONFLICT OF INTEREST IN THE DESIGNATION OF A DATA PROTECTION OFFICER

Dear [Redacted],

We write in response to your letter requesting for clarification on whether there is conflict of interest in relation to the designation of the Executive Director of the Land Transportation Office (LTO) as the data protection officer (DPO) of the said agency.

Discussion

Designation of DPOs; NPC Advisory No. 2017-01; independence; conflict of interest

NPC Advisory No. 2017-01 on the Designation of DPOs emphasizes the requirement that a DPO or a compliance officer for privacy (COP) must be independent in the performance of his or her functions, and should be accorded a significant degree of autonomy by the PIC or PIP.1 Further, the Advisory provides that in his or her capacity as DPO or COP, an individual may perform (or be assigned to perform) other tasks or assume other functions that do not give rise to any conflict of interest.2

Conflict of interest refers to a scenario wherein a DPO is charged with performing tasks, duties, and responsibilities that may be opposed to or could affect his/her performance as DPO, i.e., holding a position that leads him/her to determine the purposes and the means of the processing of personal data.3

Further, we note the pertinent discussions under Article 29 of the Data Protection Working Party of the European Commission - Guidelines on Data Protection Officers4 on the matter of conflict of interest, to wit:

The absence of conflict of interests is closely linked to the requirement to act in an independent manner. Although DPOs are allowed to have other functions, they can only be entrusted with other tasks and duties provided that these do not give rise to conflicts of interests. This entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. Due to the specific organisational structure in each organisation, this has to be considered case by case.

As a rule of thumb, conflicting positions within the organisation may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing.

While there may be a perceived conflict given that the position of an Executive Director is a senior management position in a government agency, there is a need to further evaluate if indeed there is actual conflict of interest as the determination of the same can be made on a case-to-case basis.

We note in this scenario that generally, LTO’s purposes for the processing of personal data, is already determined by law and regulation, and not by any official or employee, including the Executive Director.

Nevertheless, LTO may internally re-assess if the position of an Executive Director would be incompatible with the functions of a DPO. It can be good practice to:

  • identify the other positions within the agency which would be incompatible with the function of a DPO;
  • draw up internal rules to this effect to avoid conflicts of interests;
  • include a more general explanation about conflicts of interests; and
  • upon evaluation, declare that your DPO has no conflict of interests with regard to his/her function, as a way of raising awareness of this requirement;

where the above also takes into consideration the particular circumstances of LTO - its activities, size, and structure as a government agency.5

This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Footnotes

  1. National Privacy Commission, Designation of Data Protection Officers [NPC Advisory No. 17-01] (March 14, 2017). ↩

  2. Id. Independence, Autonomy and Conflict of Interest. ↩

  3. Id. Definition of Terms. ↩

  4. European Commission, Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’), Adopted on 13 December 2016, As last Revised and Adopted on 5 April 2017, page 16, available at https://ec.europa.eu/newsroom/article29/itemdetail.cfm?item_id=612048 (last accessed: 23 Feb 2021). ↩

  5. See generally: European Commission, Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’), Adopted on 13 December 2016, As last Revised and Adopted on 5 April 2017, page 16, available at https://ec.europa.eu/newsroom/article29/itemdetail.cfm?item_id=612048 (last accessed: 23 Feb 2021). ↩

Backlinks

  • No backlinks found