Duties of a Data Protection Officer

#2.1 Confidential Information and Avoiding Conflicts of Interests

Given the confidential nature of the information processed by a DPO, they are obliged to maintain the confidentiality of those data. Article 38(5) GDPR refers us here to relevant Member States or EU laws. For the avoidance of doubt, the issue of confidentiality must be addressed in any agreement with a DPO.

A DPO should also avoid conflicts of interests. This does not exactly mean that a DPO cannot be engaged in other work. But they cannot hold another position in the organisation that entails establishing data processing means and purposes. Particularly, they must not act as a member of the management board or any other director in the company in which they act as DPO.

According to the Article 29 Working Party, a conflict of interests arises in the case of managerial positions (general director, operations director, financial director, medical director, marketing director, HR director, IT director) and also lower positions where these take part in establishing data processing purposes and means. A conflict of interests may arise if a DPO is asked to represent the controller or processor before the courts in a case concerning personal data protection (in other words, a DPO should not do this).

You should consider the following steps:

1. 1)identifying (in writing) positions that involve a conflict of interests with the role of the DPO in the organisation;
2. 2)developing internal rules and procedures that make it impossible for positions that involve a conflict of interests to be combined (there should at least be such a general clause in an agreement for the provision of DPO services, as a control);
3. 3)having the DPO declare they have no conflict of interests.

In practice, all of those three points can be covered by a proper template DPO agreement.

#2.2 Duties of a Data Protection Officer

Under the GDPR, a DPO has the following duties:

1. 1)educating – to inform management and other personnel of the organisation about their duties resulting from the GDPR and other data protection related laws;
2. 2)monitoring – to monitor data protection compliance by:
   1. a)gathering information on how the organisation (and its particular departments) processes data,
   2. b)analysing and verifying the compliance of processing,
   3. c)recommending specific actions to the organisation.
3. 3)consulting – to consult, on request, data protection related decisions of the organisation and data protection impact assessments performed by the organisation (remember, conducting a data protection impact assessment is an obligation of the controller – the DPO’s acts as a consultant);
4. 4)cooperating – to cooperate with the supervisory authority, including by acting as a contact point for the authority on issues related to processing, including for prior consultations and consultations on all other matters where appropriate;
5. 5)communicating – the DPO is also a point of contact for data subjects.

The above list describes the minimum duties of a DPO.

A DPO may be entrusted with other duties (e.g., keeping the RDPA) if these do not conflict with the nature of the DPO’s work. However, you must consider the

need to provide the DPO with the resources and time needed to perform those duties.

All of the DPO’s tasks must be performed with ‘due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing’ (Article 39(2) GDPR). The activities of a DPO are also based on the principle of risk-based approach, in the sense that the DPO must assess where their involvement is most needed, and where less so since not everything can be done at once. This selective, pragmatic approach should make facilitate it easier to consult with the controller on what methodology to apply when conducting a data protection impact assessment, what areas should be audited internally or externally, what internal training to conduct for employees or managers responsible for data processing and what processing operations should be given more time and resources.

#2.3 DPO: GDPR Versus Reality

Applying the GDPR provisions on the DPO in practice will obviously look differently in larger organisations than in smaller ones. Small and medium enterprises might not be able to afford a full-time DPO, so they will either outsource or appoint an employee having other duties as well.

Organisations with undeveloped data protection culture usually expect their DPO to be fully responsible for data protection compliance. Acknowledging that a DPO might be the most data protection savvy person on board, we always recommend to formally appoint another person as ‘responsible’ for data protection compliance, even if then the organisation relies fully on the DPO.

According to Article 38(2) GDPR, the organisation should support their DPO by providing ‘resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge’. At the same time according to Article 38(6) GDPR the DPO ‘may fulfil other tasks and duties’. Providing resources necessary to carry tasks and maintaining expert knowledge while charging with other tasks seems slightly contradicting.

So, the principle of lack of conflict of interest as well as the risk-based approach need to account for limitations of the organisation.