The purpose of this role is to develop, maintain and implement a privacy framework and the resulting privacy policies, procedures and documentation for the processing of personal data in coordination with appropriate members of the organisation (e.g., business process owners, legal, information security, operational risk, compliance officers and supplier management).

Where applicable, to place the interests of customers at the centre of all activities, act in a way that is consistent with achieving good outcomes for consumers; and to comply with the FCA and PRA's Conduct Rules.

Job Description

Key Responsibilities:

Governance

• Devise and update policies and procedures for customers, employees and data breach response activities, ensuring alignment with the actual implementation of personal data processing activities.
• Monitor continuous adherence to the privacy framework requirements.
• Work to ensure the organisation maintains the appropriate privacy and confidentiality consent procedures, authorisation forms, and information notices.
• Establish and work with a multidisciplinary team, including audit and risk, compliance, HR, legal, business process owners, IT, security and other internal stakeholders to ensure enterprise-wide coverage of the privacy discipline.
• Work with procurement, vendor management and legal to ensure that third-party suppliers' contracts and operating-level agreements meet [international] privacy requirements.
• Implement and maintain an internal reporting mechanism for intended (new or changed) personal data processing activities, to which business unit/process owners must adhere. Part of this mechanism will determine when and how to conduct the necessary impact assessment(s).
• Notify data protection authorities of the organisation's processing activities and/or obtain guidance where required.
• Inform/direct response to privacy-related emergencies and other potentially damaging events.
• Communicate with regulatory authorities and the public concerning privacy issues (for example, answering data subject’s questions and requests).

Privacy Impact Assessment

• Determine the enterprise's specific privacy-related requirements and potential vulnerabilities.
• Receive and manage internal reports from business stakeholders to maintain insight over all project and innovative initiatives, including change management, to ensure timely attention for privacy bottlenecks and hiatuses.
• Develop, improve and manage the privacy impact assessment process, in close collaboration with business stakeholders.
• Conduct regular privacy policy compliance assessments to ensure that AL’s privacy policies are being adhered to.

Personal Data Inventory and Usage

• Oversee the creation of an inventory that documents how and why the company collects, shares and uses personal data.
• Build processes to continuously update and re-evaluate the extent to which customer and employee information is collected and shared internally and externally.
• Maintain AL’s registry of all personal data stores and processing activities.
• Strengthen alignment between privacy and data-centric stakeholders by assisting them in refining and operationalising AL’s retention schedule using output from privacy management activities (e.g. PIA) to facilitate deletion or anonymisation of personal data that is no longer needed for identified purpose(s), and in accordance with applicable requirements.

Information Technology

• Ensure that data security practices — in particular, logging, monitoring and auditing practices — do not conflict with privacy requirements.
• Work closely with the technology service teams to anticipate potential privacy problems embedded in the use of emerging technologies.

Managing privacy risks in the context of new technologies and change initiatives:

• Assessing the privacy implications of emerging technologies like artificial intelligence (AI), machine learning (ML), and blockchain.
• Developing and implementing privacy-by-design principles into the development of new technologies and products.

Risk:

• Responsible for managing risks inherent to the role by diligently observing internal policies and procedures.

Key Interfaces

• Data Protection Officer
• Chief Information Officer & CISO
• Compliance Officers
• Supplier Management and Supplier Managers