With privacy concerns on the rise, more officers are wanted at the PCPD

Being able to lead an investigation sounds great, but such an action is usually considered the reserve of the police. If an aversion to handcuffs or blue shirts has always held you back from a career with Asia’s Finest, however, there is another avenue you can pursue – and all you need is a university degree, some work experience and the right soft skills.

That path is with the Office of the Privacy Commissioner for Personal Data (PCPD). For the level of personal data officer (PDO) or assistant personal data officer (APDO), any recognised university degree can get your foot in the door, together with four or two years of relevant work experience, respectively.

“Data-privacy concerns exist wherever there is collection, dissemination or storage of personal data,” says Vanessa Wu, chief personal data officer at the PCPD.

“Improper handling of personal data by organisations may cause distress and harm to the subjects of that data, such as by exposing them to identity fraud and possible financial loss,” she adds.

PDOs are the guardians of such personal data, including people’s names, ID card numbers and phone numbers.

“PDOs handle public enquiries and complaints, and follow-up on media reports by conducting pro-active compliance checks or investigations into suspected contravention cases. They also come up with suggestions on how to avoid similar incidents in future,” Wu says.

After receiving a public complaint, a PDO has to screen and investigate the case, which includes communicating with and taking statements from complainants, reviewing documents, and analysing information.

If there is no contravention of the personal data privacy ordinance, they have to make recommendations on how to deal with the complaint.

If, however, there is suspected contravention, the PDO has to attempt reconciliation between the two parties. In actual cases of contravention where the party at fault is unwilling to take any remedial action, the PDO has to recommend formal investigation by the police.

PDOs also have to carry out inspections, privacy impact assessments and privacy compliance audits on personal data systems. Experienced employees are required to work on cases independently and take them to a conclusion.

APDOs take care of simpler cases. “For complaints, APDOs may carry out initial screenings of incoming cases by communicating with the complainants. In cases completely irrelevant to personal data privacy, they will explain the jurisdiction of the Personal Data (Privacy) Ordinance and the PCPD to the complainants,” Wu says.

The PCPD employs about 80 people, split into seven divisions. The operations division and compliance and policy division employ 14 assistant PDOs, nine PDOs, eight senior PDOs and three chief PDOs.

Junior staff members only require university degrees as they are expected to do most of their learning on the job. Those joining at senior or chief PDO levels need to have a relevant university degree, such as in law, public administration or information technology, as well as eight years of relevant work experience for senior PDOs and 15 years for chief PDOs.

Relevant work experience for PDO and APDO positions includes law enforcement, dispute resolution, public-service complaint handling, social services, customer service and public relations.

Good communication and interpersonal skills are very important for any PDO position, as the role involves direct contact with complainants and alleged perpetrators. An analytical mind is also needed to successfully conduct impact assessments and investigations, and to examine and analyse evidence.

Writing follow-up recommendations and reports, closing letters, draft guidelines and leaflets are all in a day’s work, and requires good language skills. Applicants are tested on their language abilities in English, Cantonese and Mandarin.

PDOs and assistant PDOs learn through on-the-job training provided by their superiors, which usually involves case discussions and advice on how to move forward. According to Wu, new recruits quickly learn how to cope with the job’s requirements.

In-house sharing sessions conducted by the legal and IT divisions keep staff up to date with the latest trends and views on particular issues.

Professional training is provided to help employees cope with unreasonable complainant conduct and learn how to manage complainants’ emotions. PDOs also learn how to communicate with other parties, conduct phone conversations to obtain more information, write enquiry letters, contact witnesses, take statements and review evidence.

Wu says working for the PCPD differs from working for a private corporation in several areas. PCPD employees are usually employed on two-year contracts, where instead of annual bonuses they receive an end-of-term gratuity. Also, with the PCPD’s mission being to enforce the data privacy ordinance and ensure the safety of the general public’s personal data, its primary stakeholders are not shareholders, but the general public, political parties and the government.

“As for the culture, we focus on teamwork,” Wu says. “These kinds of organisations usually involve rather harmonious working relationships.”

Career development depends on performance and ability, she adds, but there are no strict rules. It may take about five years to be promoted from PDO to senior PDO, and roughly another five years to chief PDO, but these figures are for general reference only.