Text
ADVISORY OPINION NO. 2024-0061
03 June 2024
RE: CONFLICT OF INTEREST IN APPOINTING A DATA PROTECTION OFFICER
Dear [Redacted],
We respond to your request for an Advisory Opinion on whether a conflict of interest may arise in the appointment of certain officers of [Redacted] as its Data Protection Officer (DPO).
Discussion
You state that [Redacted] is a real estate development company. [Redacted]’s management intends to appoint a new DPO. The primary candidate for the position is the Head of its Regulatory and Compliance Group (HRCG) who is also in charge of the Records Management Unit (RMU) and the Registration and Titling Unit (RTU). You aver that the RMU focuses on secure document storage and safekeeping, while the RTU handles the registration and titling of sold properties. Both units do not participate in determining the purposes and methods of data collection; their roles are exclusively dedicated to document safekeeping and liaising with administrative bodies. Instead, it is the Sales, Customer Service, and Human Resources units that have the decision-making powers in the processing of personal data. The alternative candidate is the Head of Systems and Methods (HSM), who oversees the Information and Technology Group, in case there is a finding of conflict of interest in the appointment of the HRCG.
Thus, you seek guidance on the propriety of the appointment of [Redacted]’s DPO candidates.
Data Protection Officer; Autonomy; Conflict of Interest
Under National Privacy Commission (NPC) Advisory No. 2017-01, a DPO must have a sufficient level of autonomy to perform their responsibilities effectively. While absolute autonomy is not mandated, the DPO must execute their duties independently.
It is in this context that the propriety of the appointment of a DPO candidate must be determined. Based on our assessment of the facts presented, both the HRCG and the HSM have sufficient autonomy to execute their current responsibilities concurrently with the DPO position. Thus, we see no legal hindrance in their appointment as a DPO.
We recognize, though, that there may be conflict of interest situations that may arise in the course of the performance of the DPO functions of either the HRCG or HSM. In which case, you may consider the guidelines from Article 29 of the Data Protection Working Party of the European Commission - Guidelines on DPOs,2 to determine whether there would be potential conflict of interest:
• Identification of the position/s which would be incompatible with the function of DPO; • Draft internal rules to avoid conflicts of interests; • Provide an explanation about conflicts of interests; • Declare that the DPO has no conflict of interests with regard to his/her function as a DPO, as a way of raising awareness of this requirement; • Include safeguards in the internal rules of the organization and to ensure that the vacancy notice for the position of DPO or the service contract is sufficiently precise and detailed in order to avoid a conflict of interest.
Additionally, please note that registering a DPO is solely for the purpose of appointing an official contact for the NPC. Internally, an organization may appoint or designate more than one DPO or establish a data privacy structure that is best suitable for its needs. is neither restricted nor prohibited from appointing more than one DPO under the DPA.
Please be advised that the foregoing was rendered based solely on the information you provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.
Please be guided accordingly.
Very truly yours,
(Sgd.) FRANKLIN ANTHONY M. TABAQUIN, IV Director IV, Privacy Policy Office
Footnotes
-
Tags: Data Protection Officer; conflict of interest; autonomy. ↩
-
European Commission, Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’), Adopted on 13 December 2016, as last Revised and Adopted on 5 April 2017, page 16, available at https://ec.europa.eu/newsroom/article29/items/611235 ↩