Data Protection Officer: Appointment and Status (Chapter 6, Section 1) — Guide to the GDPR

The General Data Protection Regulation (GDPR) introduces a new formal role that of data protection officer (DPO), not known to the Directive 95/46/EC.

A DPO formally is not responsible for an organisation’s compliance with the provisions on data protection. The responsibility for GDPR compliance rests upon the management of the organisation and cannot be ceded to the DPO. When a DPO is mentioned in the GDPR, their role is to consult, raise awareness, advise and inspect. Consequently, we advise against formally conferring responsibility for implementing the GDPR upon a DPO. It is better to appoint a different person to head up such a project or programme, while the DPO, where appointed),should be included as an essential participant in all activities.

According to the GDPR, a DPO should act as an intermediary between the interested parties (e.g., the personal data protection authority and data subjects or individuals within a business) and a data controller. A DPO’s role is therefore quite unique for anything we know before the GDPR (even for Member States where a similar function was foreseen by national legislations prior to the GDPR), unifying an in-house and external lawyer, a compliance officer, an information security specialist, a privacy advocate, an internal auditor, an adviser to the board, a consultant and a representative of a regulator within an organisation.

Moreover, there a popular misconception exists that a DPO is responsible for compliance with the GDPR and other data protection laws. To the contrary, a DPO is NOT responsible for data protection compliance. A DPO should be treated more like an ombudsman of data protection in an organisation, but responsibility and liability remains with a management. ‘It’s not the responsibility of the DPO if there is an enforcement action,’ WP29 Chairwoman Andrea Jelinek said. ‘It’s the responsibility of management. Our enforcement action won’t be against DPOs, it will be against the company. The DPO must be independent.’

An entity is obliged to designate a DPO when:

In any case, every entity must analyse (and document to comply with the principle of accountability) whether it is obliged to appoint a DPO.

Where an entity designates a DPO without being formally obliged to do so, none of the rules concerning the DPO’s appointment, status or duties resulting from the GDPR apply.

Nothing stands in the way of an employer hiring an external consultant to facilitate GDPR compliance, regardless of whether a DPO has been designated. In such a case, though, the controller must take care to ensure that the consultant is not mistaken for a DPO. In particular, there should be nothing in that person’s job title that could justify their being treated as a DPO. The role of a data protection specialist may be described similarly to the statutory role of a DPO, though specific points of distinction (e.g., ‘under-executive’ point of reporting, limited access rights) should be inserted to discourage anyone (and in particular the DP specialist her/himself) from trying to requalify themselves to a DPO upon dismissal.

As DPOs are formally difficult to terminate, they are often employed for a limited period of time.

The GDPR does not define what is to be understood as a public body or entity. Even though the Article 29 Working Party says that the scope of public entities should result from domestic provisions of law, at the same time, it refers in its guidelines to definitions contained in Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the reuse of public sector information (OJEU C 345, p. 90). Therefore, domestic, regional and local authorities, as well as public law entities (such as ministries, central bodies of federal and provincial administration) should be treated as public entities.

Article 37 (1)(a) GDPR states that the obligation to appoint a DPO does not apply to courts ‘acting in their judicial capacity’. And of course it means something opposite to what it seems. A court as a public entity must have a DPO, but a court DPO is not competent to assess how cases are considered and ruled on.

The two remaining cases when a DPO must be appointed are based on the criterion of the type of processing activity.

Under the GDPR, an entity’s core activity is that which is key in terms of achieving the controller’s or the processor’s goals. For an insurance company, the core activity is analysing risk, selling insurance and handling claims. Auxiliary activities such as using information technology (IT) services or keeping payroll lists are not treated as main activities, even though they support the main activity.

You can find a basic definition of monitoring in the GDPR Recital 71:

any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements and Article 4 point 4 GDPR:

any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

As usual for unknown reasons, the wording of both definitions differ slightly, and as usual for the GDPR that difference does not have any meaning.

To determine whether a processing activity can be considered ‘monitoring of the behaviour’ of data subjects, it must be established to what extent data subject’s decisions and actions are being recorded and then analysed. For example, monitoring takes place when natural persons are tracked on the internet, ‘including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes’.

As the Article 29 Working Party points out, requirement for appointing a DPO does not cover all cases of monitoring, but only those that are regular and systematic.

Regular monitoring is that which:

In turn, systematic monitoring is that which:

The following are examples of activities that may constitute regular or systematic monitoring of natural persons: servicing a telecommunications network; providing telecommunications services; redirecting email; marketing activities based on data, profiling and evaluations for risk assessment purposes (e.g., to evaluate credit risk, determine insurance premiums, avoid fraud, detect money laundering); location tracking (e.g., by mobile apps); running loyalty programmes; behavioural advertising; monitoring personal data on health and physical conditions using portable devices; video monitoring or servicing communication devices (e.g., smart meters, smart cars, household automation). One can say with complete confidence that the GDPR will make its mark in all key sectors of the economy.

The issue what constitutes a regular monitoring is a subject to a heated debate within the EDPB. For example, the EDPB seems to consider all electronic monitoring of employees as regular and systematic large-scale monitoring irrespective if it concerns twenty employees or twenty thousand employees. This results from a relative or subjective measure of ‘large scale’ (relative to a context in which the specific data controller operates). We strongly oppose to such approach as it promotes bigger (and better off) entities operating on a (namely) larger scale and as it directly opposes to the rule of proportionality and it seems against rules of competition. We recon that ‘large scale processing of special categories data’ is different from ‘monitoring public spaces on a large scale’. But this is a totally different story.

Large-scale processing is that which is defined in Recital 91 GDPR. That recital refers to operations:

which aim to process a considerable amount of personal data at regional, national or supranational level and which could affect a large number of data subjects and which are likely to result in a high risk, and states further on that:

The processing of personal data should not be considered to be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer.

It is not possible to say how many data must be processed for the activity to qualify as ‘large-scale’. The Article 29 Working Party did not come up with any clear definition.

The Working Party count the following as examples of processing on a large scale:

‘Surprisingly’ and to our relief the Article 29 Working Party Guidelines do not consider the processing of patients’ data by individual doctors, or of data on rulings by an attorney, as large-scale processing.

Legislative discussions considered introducing an obligation to have a DPO when more than 5,000 records were processed annually. Ultimately, though, no quantitative threshold was agreed. The figure of 5,000 remains, though, as a kind of mental anchor for monitoring. Yet, the non-invasive monitoring of unknown persons is one thing, but monitoring a fixed group of people or tracking and profiling unknown persons is another. This is why we propose using a number of quantitative parameters:

Employee monitoring. For video and other monitoring of employees, we propose a threshold of 500 employees, based on the following logic: with less than 250 employees, an employer is small from the GDPR perspective; with 250–500 employees, an employer is considered medium-sized; with above 500, it is a large employer; and so then monitoring of employees is on a large scale.

Monitoring identified persons. For monitoring identified persons other than employees (e.g., energy consumers), and for tracking people based on electronic tags (e.g., cookies) or other tracking that makes it possible to build personality profiles, we propose a threshold of 6,000 persons equal to the threshold of a number of records involving special categories of data we recon. We believe that monitoring identified persons generates an intimate knowledge about them comparable to knowing about what the GDPR calls special categories data. And yes, we believe most of the current e-commerce businesses actively profiling, retargeting, affiliating, etc. should appoint a DPO.

Special categories data. We have assumed that four physicians constitute a team and that they are capable of processing (examining) 1,500 patients per year each, resulting in 6,000 patients per year. And that is our threshold for large-scale processing of special category data. Vilijar Peep – head of the Estonian data protection authority – proposed 5,000 in his LinkedIn post, while the Dutch supervisory authority proposed 10,000 health records.

Public spaces monitoring. Video monitoring of public spaces seems to be the hardest to quantify. We believe that in each case where there is at least a team of people (security team) constantly watching a public space, having to intervene frequently (maybe not once in a month but what if ten times per month) and watching people on a daily large scale, it amounts to large-scale monitoring. So, why not to apply the same threshold of 6,000 people as in case of special category data but per day instead of per year. We understand that it means a lot of organisations would have to appoint a DPO (and conduct a data protection impact assessment of their monitoring operations). But we believe that video surveillance can reveal a lot about people being monitored. As an example, a shopping mall security probably knows ‘mall girls’ and ‘mall boys’ operating in their establishment, as well as their clients. Such knowledge can be used in different ways, and it should be controlled.

You do not have to stick with these figures and can question them for a particular industry, but they and the logic behind them at least provide a starting point for considering your own circumstances and operations.

Alternatively, we recommend using qualitative (negative) criteria such as ‘a little frequented location’ or ‘accessory monitoring’ if the cameras covering a given building only ‘catch’ a public space incidentally.

Pursuant to Article 37(2) GDPR, a group of undertakings (businesses) may designate a single DPO. Recital 37 states that a group of undertakings covers a controlling undertaking and its controlled undertakings (a dominant relationship). A group of undertakings may extend beyond the borders of the European Union (EU).

According to the GDPR, a single DPO should be able to effectively perform their duties across the whole group of undertakings. If this is physically impossible due to the complexity of the structure of the business and the number of duties involved, the group should appoint more DPOs, dividing their duties into particular companies from the group. A group DPO may though have her/his supporting team.

When designating a single DPO for a group of businesses, you have to ensure that the DPO is able to communicate easily with the individual units of the organisation. The concept of ease of communication applies to a DPO’s duties relating to communicating with data subjects, with the contact point of the supervisory authority, and within the organisation as well, taking account of the fact that one of the DPO’s tasks is ‘to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation’ (Article 39(1)(a) GDPR). In practice, such an international DPO must have a supporting team, and such a team should be able to speak in all the languages used by personnel and customers of the group of businesses.

Appointing a group DPO is just like appointing a DPO for a single organisation, except that the DPO is in charge of several companies rather than just one. This means that the process of appointing a group DPO does not differ from the standard process. Every member of a group of businesses appoints a DPO in accordance with the rules of representation and decision-making in force in a given company.

Article 37(4) GDPR suggests appointing a DPO even where it is not obligatory, particularly in the case of associations or other bodies representing specific categories of controllers or processors. The idea of an ‘industry DPO’ might be useful.

Pursuant to Article 37(5) GDPR:

The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.

Recital 97 GDPR states that the level of knowledge needed by a DPO should be determined by analysing the data processing operations they are to carry out.

A person holding a DPO post should have: a deep understanding of the GDPR; knowledge of European and domestic data protection law; knowledge of the industry of the controller and of the controller itself, including its IT systems and the security measures it employs and of its needs concerning data protection; and in the case of public entities and bodies, knowledge of administrative procedures and the principles according to which those establishments operate. A controller should apply these indications cautiously when formulating the requirements for a DPO position. They seem to require a DPO who not only is a one-man band but also has deep insight into the GDPR itself. In 2018 and 2019, wishing for a simultaneous a deep insight into the GDPR, law, IT and cybersecurity is wishful thinking. Probably in the next few years as well. To be realistic, there is probably not a single person among the personnel of supervisory authorities across the EU to meet these requirements.

The GDPR allows organisations to choose how they employ a DPO. The position may be performed on the basis of an employment contract or of an agreement on the provision of services – including outsourcing a DPO from a professional entity.

The GDPR does not make the rights and obligations of a DPO dependent on the form of their cooperation with an organisation; an outsourced DPO will also have to meet the criteria for independence and will need to be protected against termination.

Once a DPO is selected, the organisation must publish the DPO’s contact details and notify the supervisory authority of the appointment. The DPO’s contact details should enable data subjects and the supervisory authority to easily contact them. To this end, the contact details should include not only the DPO’s correspondence address but also their telephone number and email address. When necessary due to the nature of the DPO’s activities, they should also include other means of communication with the public, such as an infoline or contact form on the controller’s or processor’s website. When notifying the supervisory authority of a data protection breach, in addition to the DPO’s contact details, their first and last name must also be provided.

As indicated above, the GDPR protects the DPO and sets out their scope of duties quite clearly.

An organisation must ensure:

that the data protection officer is duly and promptly included in all matters concerning personal data protection (Art. 38(1) GDPR).

The DPO should be informed about all issues concerning data processing at the earliest possible stage.

In accordance with their role – regardless of the form of employment – the DPO should be treated by the appointing organisation as a discussion partner and not as an employee carrying out specific instructions. In accordance with the Article 29 Working Party Guidelines, an organisation should ensure, among other things, that:

Moreover, the stance taken by the DPO should always be taken into consideration. It is recommended that cases and the causes of any actions taken that are contrary to the DPO’s recommendations be documented. Where there has been a breach or other event related to personal data, the controller must immediately consult with the DPO.

For the DPO to carry out their duties, they must be granted access to personal data and data processing operations and must be supported by the management of the establishment.

One of the organisation’s important obligations is to provide the DPO with the resources they need to carry out their duties, including:

In principle, the more complex the data processing operations and the more data processed, the more resources should be allocated to the DPO.

The general regulation grants a DPO an exceptional amount of formal independence.

In particular, a controller is obliged to ensure that:

A controller cannot issue the DPO binding instructions on ‘how to deal with a matter, for example, what result should be achieved, how to investigate a complaint or whether to consult the supervisory authority. Furthermore, they must not be instructed to take a certain view of an issue related to data protection law, for example, a particular interpretation of the law’.

As in the case of legal counsel or a compliance officer, a DPO cannot be dismissed or penalised by the controller or processor for the performance of their duties, including for refusing to go along with the controller’s instructions (pertaining to the DPO’s tasks). An agreement with a DPO should expressly state that it cannot be terminated by the employer (or client in case of DPO outsourcing) if the DPO does not comply with the controller’s instructions.

According to the Article 29 Working Party, the prohibition on penalties concerns not only direct penalties but also indirect ones, such as not giving or delaying promotion, hindering professional development or limiting access to benefits offered to other employees. It is a little intriguing what kind of promotion could the DPO be deprived of. Should an organisation foresee further positions to a regular DPO like a Senior DPO, Staff DPO, General DPO? We do not mean it seriously. Again, we are just a little critical here of a precision of Article 29 Working Party/EDPB guidelines.

However, hiring a DPO under an agreement for a defined period of time is allowed.

#1.1 DPO: Evolution or Revolution?

#1.2 Who Is Obliged to Appoint a DPO?

#1.2.1 Public Body or Entity

#1.2.2 Activity Requiring Systematic, Regular Monitoring and Processing on a Large Scale

#1.2.2.1 Core Activity

#1.2.2.2 Monitoring of Persons

#1.2.2.3 Large-Scale Processing

#1.3 Acting Within a Group of Undertakings

#1.4 Qualifications of a DPO

#1.5 Employing a DPO

#1.6 Status of a Data Protection Officer

#1.6.1 Obligations of the Controller Towards the DPO

#1.6.2 Independence of the DPO