Data Protection Officers
Article 37 of the GDPR states that organisations "shall designate a Data Protection Officer (DPO) in any case where:
-
the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
-
the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
-
the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10"
The Information Commissioners Office (ICO) is clear that, whilst many businesses will not meet the above criteria and thus won't be mandated to appoint a DPO, they recommend that businesses seriously consider doing so voluntarily, as a way of demonstrating to customers, suppliers and other third parties that data protection is taken seriously. This can have a really positive impact on the perception of the business.
Article 37 goes on to state that "The Data Protection Officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39" and that "Data Protection Officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner. The controller and processor shall ensure that the Data Protection Officer does not receive any instructions regarding the exercise of those tasks. The data protection officer shall directly report to the highest management level of the controller or the processor."
It is perfectly possible to appoint a DPO from within the business, but there are issues to consider i.e. do you have anyone who has expert knowledge of data protection law and practices, do they have the capacity to be DPO in addition to their other duties, and importantly, can they operate independently, not be involved in decisions in respect of data processing, will they be able to have free access to and to take senior management/directors to task etc.?
Organisations register their DPO with the ICO, and the DPO becomes the key point of contact with customers/data subjects on any data protection issues. The DPO also liaises directly with the ICO where required.
External DPO
There are several benefits of appointing a part-time external DPO. Firstly you are able to chose a specialist who has the proper experience and qualifications to fulfil the role. Secondly, an external DPO can act independently, and thirdly an external DPO can engage with top management on potentially sensitive issues, and where necessary raise concerns, without fear of it affecting their career!
Nick has been a valued advisor since operations began at our company. In addition to helping us achieve the full certification we required, he provides continuing support. Dealing with sensitive data, our business has constantly changing needs. Nick is professional, responsive, friendly, and accommodating. Nick and his team have an understanding of and eye for commercial consequences, as well as a robust and up to date knowledge of data security and privacy regulations. This practical approach is invaluable to any business, ensuring compliance as well as good practice, both of which are increasingly important to clients and regulatory bodies alike.
Vinod Kathuria, Consultant Orthopaedic Surgeon and Clinical Director, Tula Medical Experts
What does a DPO do?
The duties of a DPO are varied. This is what the GDPR says.
"The data protection officer shall have at least the following tasks:
-
to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
-
to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
-
to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
-
to cooperate with the supervisory authority;
-
to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter
Our DPO Services start at just 3 hours per month. If you would like to discuss our DPO services then why not get in touch for a no obligation chat about how we can help.