Data Protection Officer

The Position & Role

Kildare County Council is entrusted with a vast amount of confidential and private information in the delivery of a wide range of services by over 1,100 staff and various service providers. It is important that such information is gathered, stored, processed, and kept secure in line with legislation, and best practice policies and procedures. The Data Protection Officer will work with all departments in Kildare County Council to establish and maintain effective corporate and departmental information management processes and systems to effectively manage the information life cycle. The successful candidate will be required to manage and monitor standards, processes, communications, training and systems to ensure all information controlled by Kildare County Council is managed in line with relevant policies, procedures and guidelines (or directions of the Data Protection Commission) and relevant legislation, with particular regard to the General Data Protection Regulations (GDPR), the Data Protection Act 2018 (as amended), the Data Sharing and Governance Act 2019 and any successor or newly enacted statutory instruments related to data protection.

Liaising regularly with Senior Management in the organisation, the DPO shall ensure that they are involved appropriately and in a timely manner, in all issues which relate to the protection of personal data. In this regard they shall embed themselves within the organisation to ensure they are positioned to maximise opportunities to participate regularly in meetings of senior and middle management and develop a data protection compliant culture.

The DPO shall, subject to budgetary management, ensure their level of expertise and professional development is maintained to assist Kildare County Council’s ongoing GDPR compliance.

Data Protection, FOI and Records Management.

The DPO shall support the organisation to be compliant with data and information regulations (including FOI, Records Management, GDPR and the Data Protection Acts). The post holder will take the Strategic and operational lead for compliance with corporate governance standards within the organisation in the areas of:

• Information Governance

• Data Protection

• Records Management and Retention

• Freedom of Information

• Access to Information on the Environment.

The Competition

The purpose of this recruitment campaign is to form a panel for Kildare County Council from which temporary posts may be filled at Data Protection Officer Grade as vacancies arise.

The Candidate

It is desirable that candidates demonstrate through their application form and at the interview that he/she:

• Is a self-starter, with strong attention to detail and with an ability to work on their own and with others.

• Has strong organizational, project management, and multi-tasking skills.

• Has ability to work closely with peers and build strong partnerships with key stakeholders.

• Possesses excellent ICT skills.

• Has experience in national and European data protection laws and practices including an in-depth understanding of the GDPR.

• Has understanding of information systems, data security and data protection.

• Has experience of successfully managing information management projects from initiation through to implementation.

• Understands the legislative background affecting the local government sector and of the processing operations carried out in that environment.

• Has experience working with third party organisations, such as regulators, auditors or legal agents to resolve issues.

• Has strong communication skills with the ability to communicate clearly at both business and technical level and has strong presentation and influencing skills.

Duties and Responsibilities

The duties to be assigned include the following although this list is not exhaustive and may be reviewed from time to time as organisational needs require:

• Ensuring that Kildare County Council remains in compliance with the GDPR and related data protection legislation;

• Engage at all levels across the organisation with members and staff and develop relationships with external partners and stakeholders, to maximise compliance and efficiency in management of personal data;

• Work with Senior Management to ensure that information is reviewed and managed appropriately, supporting change management and embedding the benefits of change, as it relates to the processing of personal data;

• Research and advise how technology can be used to further enhance privacy management and make information management processes more efficient;

• Monitor data protection compliance, working with others across the organisation and develop and conduct an ongoing programme of checks to identify issues and recommend solutions;

• Conduct an audit/baseline of Data Protection Compliance throughout the organisation including a data breach analysis and develop multi-annual plans to achieve and sustain compliance;

• Proactively identify risks to compliance and recommend mitigations including advice regarding requirements for and conduct of data protection impact assessments (DPIA), data sharing and processing agreements, records of processing and monitor Kildare County Council’s compliance regarding Article 35 of the GDPR;

• Keeping up to date, on all matters about data privacy and data protection law, ensuring the organisation is adequately informed and providing evidence based, risk balanced advice to colleagues, including Senior Management and presenting complex considerations in clear and non-technical terms;

• Ensuring public information and websites are up to date providing information to the public on their rights;

• Report and manage all data protection incidents and breaches and liaise with employees, affected data subjects, processors and the Data Protection Commission (DPC) as required;

• Have decision making responsibility for anonymisation and pseudonymisation techniques appropriate for particular data processing activities;

• Identify, review and amend as needed all third-party contracts involving data processors to ensure that they are compliant with relevant data protection legislation and offer suitable technical and organisational measures to protect personal data and bring into compliance any international data transfers;

• Work with ICT and Senior Management to ensure appropriate information security measures are in place to comply with legislative requirements and Kildare County Council policies and procedures;

• Promote and embed a data protection culture within the organisation including delivery of staff induction and awareness programmes, developing and maintaining resources such as portals, guides, tips and supporting data protection champions as needed;

• Be responsible for cooperation with and act as the contact point with the Data Protection Commission on issues relating to processing, including prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter;

• Where required, devise, review and update best practice policy and procedures, in light of business needs, developments in the law and guidance from the Data Protection Commission;

• Represent Kildare County Council on data protection networks and on sectoral projects;

• The DPO shall work with relevant staff to ensure that policies and procedures related to records management are GDPR compliant and represent a best practice approach to information management, and shall progress, review and implement any policies approved by Management Team;

• Report in a structured, written format both quarterly and annually on the DPO’s activities and provide other reports on Data Protection in the organisation where required;

• Liaise with and facilitate appropriate access to personal data with other statutory organisations including An Garda Síochána etc and any other bodies where joint controller sharing agreements exist or are required;

• Act as a contact point for data subjects with regard to all issues related to processing of their personal data and to the exercise of their rights under the GDPR, managing subject rights requests and ensuring that processes to exercise such rights are organisationally efficient;

• Ensure that each business unit maintains a current record of all categories of processing activities (ROPA) and is compliant with GDPR;

• Carry out duties of Freedom of Information Liaison Officer under the Freedom of Information Act 2014.

• Other duties that may arise relevant to Data Protection.

Candidates must also:

• Have the knowledge and ability to discharge the duties of the post concerned;

• Be suitable in all other relevant respects for appointment to the post concerned; candidates, if successful, will not be appointed to the post unless they:

• Agree to undertake the duties attached to the post and accept the conditions under which the duties are, or may be required to be, performed;

• Be fully competent and available to undertake, and fully capable of undertaking, the duties attached to the position.

Qualifications

Character: Each candidate must be of good character.

Health: Each candidate must be in a state of health such as would indicate a reasonable prospect of ability to render regular and efficient service.

Education, Training and Experience etc.: Each candidate must, on the latest date for receipt of completed application forms:

a) Hold a relevant 3rd level qualification in Data Protection, Information Compliance or Records Management,

And,

b) Have a minimum of 3 years’ experience in the area of data protection, data management, audit risk management or compliance.

Please supply copies of any certificates, diplomas or degrees you may have with the application form.

*Non-Irish Qualifications must be accompanied by a determination from Quality and Qualifications Ireland (QQI) to establish their comparability against the Irish National Framework of Qualifications, overseas qualifications must also be accompanied by a translation document.

Driving Licence

Applicants should at the date of application hold a full valid Irish /EU licence, for Class B vehicles, they must be a competent driver and, shall drive a car in the course of their duties and for this purpose provide and maintain a car to the satisfaction of the local authority. The council must be indemnified on their insurance.

Competencies for the post of Data Protection Officer

Key Competencies for the post include the following and candidates will be expected to demonstrate sufficient evidence within their application form of competence under each of these. Please take particular note to these when completing the application form as any short-listing or interview processes will be based on the information provided by the candidates:

Management and Change

Strategic Ability

Displays the ability to think and act strategically

Can translate strategy into operational plans and outputs. Evaluates capacity and performance against objectives.

Demonstrates innovation and creativity to secure successful strategic outcomes.

Political Awareness

Has a clear understanding of the political reality and context of the organisation.

Networking and Representing

Develops and maintains positive and beneficial relationships with a range of stakeholders.

Builds networks of technical and professional contacts.

Promotes and sustains an appropriate, positive, and cohesive image for the organisation it represents.

Bringing about Change

Demonstrates flexibility and an openness to change.

Develops and initiates change management programmes to meet end objectives. Influences others and fosters commitment to change.

Performance through People

Leading and Motivating

Motivates others individually and in teams to deliver high quality work and customer focused outcomes.

Develops the competence of team members and helps them meet their full potential. Leads by example in terms of commitment, flexibility and a strong customer service ethos.

Managing Performance

Effectively manages performance including underperformance or conflict.

Empowers and encourages people to deliver their part of the operational plan.

Communicating Effectively

Recognises the value of communicating effectively with all employees.

Actively listens to others.

Has highly effective verbal and written communication skills. Presents ideas clearly and effectively to individuals and groups.

Delivering Results

Problem Solving and Decision Making

Can pinpoint critical information and address issues logically. Understands the context and impact of decisions made.

Acts decisively and makes timely, informed and effective decisions.

Operational Planning

Contributes to operational plans and develops team plans in line with priorities and actions for their area of operations.

Delegates, tracks and monitors activity.

Establishes high quality service and customer care standards.

Managing Resources

Manages the allocation, use and evaluation of resources to ensure they are used effectively to deliver on operational plans.

Drives and promotes reduction in cost and minimisation of waste.

Delivering Quality Outcomes

Promotes the achievement of quality outcomes in delivering services. Organises the delivery of services to meet or exceed the required standard.

Evaluates the outcomes achieved, identifies learning and implements improvements required.

Personal Effectiveness

Relevant Knowledge

Keeps up to date with current developments, trends and best practice in their area of responsibility.

Demonstrates the required specialist knowledge, understanding and training for the role.

Resilience and Personal Well Being

Demonstrates appropriate and positive self-confidence.

Remains calm under pressure and operates effectively in an environment with significant complexity and pace.

Integrity

Behaves in an honest, trustworthy and respectful manner and is transparent, fair and consistent in dealing with others

Personal Motivation, Initiative and Achievement

Is enthusiastic about the role and sets challenging goals to achieve high quality outcomes.

Is self-motivated and persistent when faced with difficulties.

Engages in regular critical reflection in order to identify how own performance can be improved.

Knowledge, Experience and Skills

Knowledge and understanding of the structure and functions of local government including service requirements.

Knowledge of current local government issues.

Understanding of the role of a Data Protection Officer.

Understanding key challenges facing the local government sector and Kildare County Council.

Knowledge and experience of operating ICT systems

Particulars of Employment

The Post

The post is wholetime (i.e.,35 hours per week) and appointment may be permanent or temporary.

Location

Kildare County Council reserves the right to assign the successful candidates to any premises in use by the Council, now or in the future. The person appointed will be required to report to their place of work by their own means of transport and at their own expense.

Commencement

Kildare County Council shall require a person to whom an appointment is offered to take up such appointment within a period of not more than one month and if they fail to take up the appointment within such period, or such other longer period as the Council in its absolute discretion may determine, Kildare County Council shall not appoint them.

Working Hours

The current working hours are 35 hours per week, Monday to Friday. Kildare County Council reserves the right to alter the hours of work from time to time in line with Government Circulars. Kildare County Council also has a flexi time system in operation, details of which are available from the Human Resources Section. You may be required to work overtime on various occasions. All hours worked are subject to and recorded in accordance with the provisions of the Organisation of Working Time Act, 1997, and the Organisation of Working Time Regulations, 2001. Kildare County Council requires employees to record their hours using a Clocking system.

Reporting Arrangements

The Data Protection Officer will report directly to the section head or to any other employee of Kildare County Council such as the Director of Service or any other appropriate employee that may be designated for this purpose. A system of regular appraisal will be operated during employment, which will involve discussions between the employee and the line manager regarding performance and conduct.

Probationary Period of Employment

Where a person is permanently appointed to Kildare County Council, the following provisions shall apply –

a) there shall be a period after appointment takes effect, during which such a person shall hold the position on probation;

b) such period shall be twelve months, but the Chief Executive may, at their discretion, extend such period;

c) such a person shall cease to hold the position at the end of the period of probation, unless during this period the Chief Executive has certified that the service is satisfactory;

d) the period at (a) above may be terminated on giving one weeks’ notice as per the Minimum Notice and Terms of Employment Acts;

e) there will be assessments during the probationary period.

Remuneration

€60,011 per annum to €72,790 per annum (maximum)

€75,395 per annum (LSI 1) (after 3 years satisfactory service at maximum)

€78,015 per annum (LSI 2) (after 6 years satisfactory service at maximum)

On appointment successful candidates will be placed on the first point of the salary scale. Appointment to a higher point of the salary scale may apply to candidates employed elsewhere in the public service, subject to verification of service history. Remuneration is paid fortnightly by PayPath directly to the employees nominated bank account. The current wage pay cycle may be revised during the period of employment. Remuneration is subject to all statutory deductions, e.g., P.A.Y.E. and P.R.S.I. Increments are paid annually subject to satisfactory attendance, conduct and performance and national agreements. Increments may be withheld if performance, attendance and/or conduct are not satisfactory.