Data Protection Specialist, Rome, Italy

MAIN ACCOUNTABILITIES/RESPONSIBILITIES:

Support in developing, implementing and operationalizing Data Protection and Privacy policies, governance mechanisms, procedures and tools to maximize program efficiency and comprehensive roll out across WFP different divisions and offices. 

• Review current WFP’s policy and governance framework (e.g. policies, guidelines and toolkits) to adapt them to WFP’s Privacy Program and corporate operational needs. 

• Draft SOPs/ position papers/guidance as well as conduct legal research and documentation activities, with the objective of keeping abreast of key global Data Protection developments, trends and regulations on personal Data Protection and Privacy (e.g. biometrics, digital identities, blockchain, big data) and its impact on the humanitarian environment.  

• Provide consistent advice to HQ divisions, regional bureaus and field offices on a variety of issues in the context of Data Protection and Privacy, identifying needs and priorities arising out of the interpretation or application of WFP principles, policies, guidelines, relevant international standards, conventions and best practices on Personal Data Protection and Privacy. 

• Support the Data Protection Office in operationalizing the different elements of WFP’s Data Protection and Privacy Program (e.g. privacy notices, PIAs, register of processing, LIAs, training and awareness campaigns, SARs and data breach response mechanisms). 

• Prepare and/or review Data Protection and Privacy agreements and contracts with public and private entities to meet unique client needs.  

• Proactively contribute to continuously improve systems, tools, processes and templates to align them to WFP’s operational needs.  

• Provide support in the development of reporting mechanisms to allow monitoring of Data Protection and Privacy activities and identify related risks and gaps and support remediation. 

• Document, track and report relevant program metrics and milestones on the implementation of the Privacy Program.  

• Prepare Notes for the Record, reports, memoranda, talking points and correspondence on data protection issues as required.  

• Conduct training and awareness activities as required. 

• Perform any other related duties, as required. 

SPECIFIC QUALIFICATIONS & EXPERIENCE REQUIRED:

Education

• Advanced university degree in relevant discipline (including but not limited to law, computer science, information technology) or related field with relevant work experience.

• LLM or Master of Law on data protection, privacy, computer and communications law, compliance, international, digital or media law.

• Knowledge of international security management systems industry standards (ISO 27001, ISO 27701, NIST…) desired.

Required Experience            

• At least 3 years of responsible professional experience in Data protection, Privacy and Information Security, in a law/ consultancy firm and/or large public/private sector organization on Data Protection.

• Experience in implementing Privacy and Data Protection compliance programs, operations and/or risk management programs in large corporations.

• Experience in conducting PIAs, LIAS, maintaining records of processing activities, of incident response management and SARs mechanisms, drafting contracts, SOPs, policies and guidelines.

• Experience working in a global, large-scale, complex, and fast-paced environments.

• Experience in roles that demand accuracy and quality, prioritization and execution against timelines.

• Experience working autonomously with minimal supervision and as part of a team, well as to cooperate within a team, across different regions and time zones.

• Experience working within a law firm and/or the United Nations system, or similar international organization, is highly desirable.

Knowledge & Skills:

• In depth knowledge of Data protection, Privacy and Information Security regulations, international security standards and specific key legal issues;

• Understanding of information technologies and their impact in the protection of personal data (e.g. privacy by design and by default, AI, big data, biometric technologies, digital identities, blockchain, SNSs…);

• Ability to identify Data Protection related risks and gaps based on local legal environment, developments and projects;

• Ability to contribute to large cross-functional projects;

• Strong analytical interpersonal, communications and presentational skills;

• Excellent drafting skills with the ability to write concisely and synthetize information from a variety of legal and jurisprudential sources;

• Demonstrated, cultural sensitivity and diplomatic skills;

• Ability to work harmoniously with people of different national and cultural backgrounds;

• Ability to plan and organize work programme with pre-defined

reporting lines;

• Effectiveness orientation and pro-activity;

• Strong sense of responsibility, confidentiality and accountability.

Languages:

Fluency (level C) in English language.

Intermediate proficiency at level B in an additional UN official language (Arabic, Chinese, French, Russian, Spanish) and/or the WFP’s working language is desirable.