Does Every Company Need a DPO?
The appointment of a Data Protection Officer (DPO) is essential when an organisation falls into one of the following categories:
If a public authority or body is carrying out the processing of user data, then they have to appoint a Data Protection Officer (DPO).
- Core Data processor and controllers:
Organisations that carry out ‘regular and systematic processing’ of data as their core activity must also fulfil this mandatory requirement. For data processing to be considered a core activity, it should be critical to the operations and goals of the organisation. For instance, IT and HR management
are support functions and not the core activities of an organisation. Then, there is the term ‘regular and systematic’ which means at regular intervals. As per a pre-determined arrangement, monitoring of data subjects, profiling them, and so on. By the way, it is irrelevant whether the collection and systematic monitoring of data are taking place online or offline. Once the data is collected and is being processed, it comes under the purview of the GDPR.
- Large-scale data processor and controllers:
Organisations that process data of data subjects on a large-scale also have to appoint a Data Protection Officer (DPO) as a mandatory requirement. Again, article 29 working party states that to be considered a large-scale processor, it is not just the volume of the data that is being processed is under consideration. Multiple other factors must be taken into account. These factors include:
- Number of data subjects
- A volume of data processed
- How long the data is processed
- Geographical coverage of the data being processed
- Processing Sensitive Data:
Another set of organisations that fall under the purview of GDPR are those who are data controllers and processors of sensitive data on a large scale. The sensitive data can include data related to children, health-related information, criminal convictions, and so on. If an organisation falls under any of the above categories, then it is mandatory for it to appoint a DPO. An organisation can also voluntarily appoint a DPO.
- Appointment, Responsibilities, and Liabilities of a DPO
Once the organisation has ascertained whether they must appoint a DPO. The next step is to understand the roles and responsibilities of a DPO under GDPR.
✓ The Appointment
A DPO should be appointed based on professional competence and more importantly, the knowledge of data protection and privacy landscape. The knowledge of the DPO should be a function of the nature of the data processing operations and the degree of protection required. A DPO should also have a complete understanding of the data processing operations of the organisation and should have expert knowledge of data protection laws of the country as well as GDPR. A Data Protection Officer (DPO) can be both internal and external.
✓ The Responsibilities
A Data Protection Officer (DPO) must be apprised of and should be involved in all the issues related to data protection law and practices at the earliest since it is their responsibility to ensure compliance with GDPR. They have to create processes and oversee the security of the data and to conduct periodic data protection impact assessments. Since the primary role of a DPO is to monitor an organisation’s compliance with GDPR. They cannot hold any other position within the organisation.
✓ The Liability
It is critical that organisations have complete clarity over who is held liable in the case of non-compliance. It is interesting to note here that the DPO cannot be personally held responsible. If there is a breach of the regulation, it is still the data controller and processor that will be held liable. Of course, it is the organisation’s call to determine if they want to appoint another DPO, but that’s an entirely different matter altogether.
The Way Forward
An organisation should ascertain whether they have to mandatorily appoint a DPO under GDPR or not. If they do not have to, they can still create a position. However, they should know that even if they choose to appoint a DPO by choice, they will have to abide by the same set of rules as an organisation for which it is mandatory to appoint a DPO. If an organisation is not required to and does not want to appoint a DPO, it is recommended that they do document the reason for not doing so. Given the hefty amounts of fines amounting up to €20 million or 4% of the global turnover, appointing a Data Protection Officer (DPO) is a smart decision on the part of the organisations. They must have a dedicated professional looking after the GDPR compliance and raising a red flag whenever there is an infringement or any potential of it. A DPO appointment also works well in favour of the organisation, if there is a breach.
It is already common knowledge that the regulatory authorities take infringement cases on an individual basis. So, if the organisation does find itself a victim of a breach, an active DPO is an indication that the organisation took all the steps to ensure the security of the data and its processing. This way, they can save themselves the heavy cost of fines and penalties.
A DPO has a significant role to play in making the whole GDPR regime a success. With a DPO in place, organisations will find it easier to comply with GDPR, and they can do business as usual, without worrying about flouting the laws all the time. They know the DPO is always watching. What do you think about this new compliance requirement? Is it only a cost or a valuable addition to the organisation and the data & privacy landscape?