DATA PRIVACY PROGRAM HEAD

Job Summary

The Data Privacy Program Manager (DPPM) is primarily responsible in assisting the Data Protection Officer (DPO) in the implementation of timely and relevant data protection programs that would promote the privacy culture of BPI employees and stakeholders while ensuring that the right to privacy of data subjects is upheld. The DPMM shall be tasked with the supervision of Data Privacy Program Management Officers (DPPMO) to ensure that assigned tasks are delivered properly and on-time.

Duties & Responsibilities

Program Implementation

• Management of Special Projects (e.g. Data Privacy Management Maturity Assessment)
• Management of the Governance, Risk and Compliance (GRC) platform for the Data Privacy Office
• Designs and tests assessment tools and metrics to determine the level of the Bank’s compliance with the Data Privacy Act of 2012 (DPA, RA 10173)
• Provides consultancy services to business units (BU) on the privacy risks of processing personal data
• Facilitates the consolidation and preparation of reports on the effectiveness of the data privacy program for reporting to Senior Management and the Board of Directors
• Assists the Data Protection Officer in fulfilling his role as the Bank’s liaison officer to the National Privacy Commission (NPC), the regulatory body for data privacy
• Develops the Bank’s policies, standards and guidelines on data privacy (DP) to ensure appropriate processing of personal data
• Reviews contracts and service agreements of BUs with third parties, ensuring the requirements of the DPA are incorporated
• Reviews privacy impact assessments of new products, services or processes to ensure the suitability of the risk mitigation plan
  
  

People Development

Responsibilities

Promotes awareness on data privacy to employees and stakeholders (subsidiaries, business partners, etc.) and emphasizes their responsibilities in protecting the personal data being processed by the bank and its agents and service providers through the following:

• Managing the review of the data privacy awareness program in coordination with the business units; and
• Proposing sustainable activities to improve the data privacy awareness, such as developing training programs and campaigns on data privacy available for the employees (and other stakeholders, as necessary) and sending constant and timely bulletins on DP concepts & the issuances and circulars of the NPC
  
  

Incident Management

Helps the Incident Handling Team (IHT) Lead, in cases of data privacy-related incidents/requests, through:

• Assessing the validity of the reported incidents/requests
• Coordinating with the BUs in the complaints investigation or access requests facilitation
• Communicating the recommendation of the Data Privacy Office to the BUs concerned on the appropriate handling, and
• Assessing incidents vis-à-vis reporting criteria of the Data Privacy Act of 2012; preparing reports to NPC and/ or affected data subjects, if necessary
  
  

Skills & Qualifications

• Knowledge (Minimum training/certification course requirements)
  
  

Should Be Knowledgeable On

• Basics of data protection
• Data privacy risk management
• Banking and related business processes
• Project management