Data Protection Officers

Data Protection Officers must be appointed for all public authorities, and where the core activities of the controller or the processor involve “regular and systematic monitoring of data subjects on a large scale” or where the entity conducts large-scale processing of “special categories of personal data” (such as that revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and the like). This is likely to apply to some of the larger scale Marketing Service Providers and Research Organisations – but needs further clarification.

Although an early draft of the GDPR limited mandatory data protection officer appointment to organisations with more than 250 employees, the final version has no such restriction.

The regulation requires that they have “expert knowledge of data protection law and practices.” The level of which “should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor.”

The data protection officer’s tasks are also delineated in the regulation to include:

Informing and advising the controller or processor and its employees of their obligations to comply with the GDPR and other data protection laws.
Monitoring compliance including managing internal data protection activities, training data processing staff, and conducting internal audits.
Advising with regard to data protection impact assessments when required under Article 33.
Working and cooperating with the controller’s or processor’s designated supervisory authority and serving as the contact point for the supervisory authority on issues relating to the processing of personal data.
Being available for inquiries from data subjects on issues relating to data protection practices, withdrawal of consent, the right to be forgotten, and related rights.

Data Protection Officers may insist upon company resources to fulfill their job functions and for their own ongoing training.

They must have access to the company’s data processing personnel and operations, significant independence in the performance of their roles, and a direct reporting line “to the highest management level” of the company.

Data Protection Officers are expressly granted significant independence in their job functions and may perform other tasks and duties provided they do not create conflicts of interest.

The regulation expressly prevents dismissal or penalty of the data protection officer for performance of her tasks and places no limitation on the length of this tenure.

A company with multiple subsidiaries (a “group of undertakings”) may appoint a single data protection officer so long as they are “easily accessible from each establishment.”

The GDPR also allows the data protection officer functions to be performed by either an employee of the controller or processor or by a third party service provider. Below is a video from The Bunker in regards to the roles of a DPO

https://www.youtube.com/watch?v=-fLITVXBxYo