Data Protection Officer/Senior Adviser - Head Office

Background:

In the Global Strategy 2018-2020, NRC set the ambition to become a leader in the use of data and technology to deliver better. As part of achieving this, NRC intends to invest resources in developing an organizational “responsible data culture” in which data protection will be a key element.

Furthermore, in May 2018, the European General Data Protection Regulations (GDPR) will come into effect and add a further element of compliance on data protection issues. In a recent review of global risk mapping, the NRC Board identified non-compliance with data protection regulations as a high risk; particularly considering the additional financial and reputational consequences a data breach may result in after the GPDR comes into effect.

Going from principle to practice at organisational level, will be the overall goal of the Data Protection Officer/Senior Adviser’s work. Embedded in the Organisational Department the DPA will work in close collaboration with the Legal Advisor and regularly present progress reports to the Senior Management Team (SMG) and produce an annual report to the Board.

Role and responsibilities

The Data Protection Officer/Senior Adviser will play a key role in maturing NRC’s data protection awareness and practice. S/he will be contributing to disseminating policy and practice and provide expert advice to NRC staff dealing with the processing of personal data in their work and systems.

Generic responsibilities

• Foster a data protection culture within NRC;

• Support relevant working groups dealing with data processing activities within the organization;

• Provide expert advice to all NRC units (at field offices, COs, ROs, Representation offices and Head Office) on aspects of data protection;

• Inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to the Norwegian data protection provisions;

• Monitor compliance with the Norwegian data protection provisions and with the policies of NRC in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

• Provide expert advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;

• Cooperate with the supervisory authority;

• Act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter;

• Promote data protection best practices within NRC by sharing success stories, internal learnings and advances from other peer organisations on the subject.

• Report regularly to the SMG on data protection mainstreaming progress, shortcomings and risks;

   

Specific Responsibilities:

• Keep a systematic and publicly available list of all (personal data) processing;

• Ensure that NRC has a system of internal control that complies with Personal Data Protection Regulations;

• Create and disseminate guidelines on data protection in NRC;

• Assist individual data subjects with personal data related queries and complaints;

• Liaise with the Data Protection authorities when required;

• Support contract reviewing on aspects of data protection across the organization;

• Stay up to date with regards to developments within the field of data protection;

• Regularly participate in meetings with senior and middle management to ensure involvement of the DPO in a timely manner in all issues relating to the protections of personal data;

• Coordinate the mapping of the organisation’s personal data inventory;

• Regularly conduct a risk assessment to detect and flag any specific data protection risks;

• Keep NRC staff aware about data protection policies, guidelines and processes using NRC’s information tools;

• Develop processes for handling data subject requests to view, edit or delete their data;

• Collaborate with other peer organisations on advancing data protection understanding and application across the sector and the sector’s interlocutors & stakeholders;

• Visit field and carry out audit-like reviews of how personal data is handled – reporting back to senior management and suggesting action where not up to standard.

Critical interfaces

By interfaces, NRC means processes and projects that are interlinked with other departments/units or persons. Relevant interfaces for this position are:

• All NRC units processing personal data
• Legal Advisor
• Internal Audit unit
• ICT and other staff working with digital solutions involving personal data
• Information Security Adviser and focal point/s
• External Relations Department and private fundraising teams
• Compliance units/staff
• NetHope Data Protection and Information Security working groups
• Data Protection authorities
• Data Protection networks
• Data Protection units/counterparts in peer organisations, UN agencies and donors
• Peers from other organisations working on similar solutions (particularly in NetHope community)

Competencies

 1. Professional competencies

These are skills, knowledge and experience that are important for effective performance.

Generic professional competencies for this position:

• Higher than average interest and understanding of Data Protection issues and laws;

• Understanding of the data processing operations carried out in humanitarian sector organisations;

• Understanding of information technologies and data security principles;

• Knowledge of the humanitarian sector and contexts in which NRC operates;

• Ability to promote a data protection culture within an organisation;

• Proven problem solving capabilities;

• Proven ability to maintain confidentiality;

• Willingness to undergo further training in data protection frameworks;

• Willingness to travel;

• Ability to work independently;

• Good communicator;

• Previous experience of humanitarian sector, particularly in the field, is considered an asset

• Fluent in both written and spoken English

Context/Specific skills, knowledge and experience:

• Expertise/advanced knowledge in national and EU data protection laws and practices including an in-depth understanding of GDPR;

• Desire to continuously learn and develop skills and knowledge in data protection;

• Comfortable with user-facing roles such as support and training;

• Good experience in developing instruction materials and delivering trainings;

• Experience in using innovative approaches and technology in capacity building is an advantage;

• Able to write sufficient and easy-to-understand documentation and guidelines.

   

   2. Behavioural competencies

• Strategic thinking: Thinks big, seeks sustainable solutions, and sets high standards and constantly looks for better ways of doing things.
• Planning and delivering results: Takes initiatives and sees things through to completion; anticipates problems and solves them, can operate with little to no direction.
• Communicating with impact: Able to explain ideas and ask for input in a clear and understandable way to most people; Has the discipline to regularly document important ideas and lessons learned and to communicate frequently with the team. Very good interpersonal skills.
• Coping with change: Adopts the "Agile" mind-set, is comfortable with uncertainty, and can adapt plans quickly.
• Working with people: Able to build bridges across silos, supports colleagues in achieving their goals and focuses on solutions rather than obstacles.

We Offer

The position is advertised for an initial duration of 24 months with the possibility of extension. The position is based at the NRC office in Oslo. The contract conditions are as per national NRC Oslo terms of employment.

Please note that you are required to enter the geographical location for all your previous positions while registering your CV. There is no specific field for this information in our CV form, but you can use the "Company name" field for both company and location.

Only CVs and applications written in English will be assessed.

Late applications will not be considered.

NRC reserves the right to conduct a full background check on shortlisted candidates.

In case any questions - please send email to ict.help@nrc.no and reference job advert, please note however that all applications must go through Webcruiter in our systems.

In addition to the CV, applicants are required to submit links (or attach files) of their portfolio showcasing previous projects they have worked on.