By:
Catarina Conti
Eric De Grasse
6 December 2016 - The new General Data Protection Regulation (GDPR) is set to replace the Data Protection Directive 95/46/EC effective 25 May 2018.
Although many companies have already adopted privacy processes and procedures consistent with the Directive, the GDPR contains a number of new protections for EU data subjects and threatens significant fines and penalties for non-compliant data controllers and processors once it comes into force in the spring of 2018.
With new obligations on such matters as data subject consent, data anonymization, breach notification, trans-border data transfers, and appointment of data protection officers, to name a few, the GDPR requires companies handling EU citizens' data to undertake major operational reform.
GDPR (Article 37) acknowledges the value of "privacy on the ground" by requiring designation of a data protection officer. Readers on our EU job lists have seen the spike in data protection officer job postings. They are in high demand ... and difficult to find.
But Article 37 does not establish the precise credentials data protection officers must carry, but does require that they have "expert knowledge of data protection law and practices." The GDPR's recitals suggest the level of expert knowledge "should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor."
The International Association of Privacy Professionals has published figures that estimate a global requirement for 75,000 data protection officer posts to be filled in the run up to the full application of the GDPR.
Most large companies have a person with a DPO title or job responsibility, but it is the smaller companies that risk being left further ... and further behind ... even though they might be working in data-driven sectors. At a recent Bloomberg Law event addressing the issues involved in undertaking the major operational reform under GDPR it was noted that with privacy compliance in general
"the divide is getting bigger between larger and smaller companies. Experienced people are in highest demand by multinationals in the finance, pharmaceuticals, information technology and retail sectors". Said one presenter:
These companies are simply "topping up" their existing teams, while smaller data processors are aware that something is coming up, but are likely to look for external data protection compliance assurance, rather than to recruit in-house data protection officers.
In the end, this is all about having a corporate governance structure ... and global companies may already have a DPO team in the headquarters supported by data protection coordinators worldwide. Companies that operate in countries such as Germany and Singapore, which already have requirements around data protection officers, would have an advantage, but companies without any existing experience on the DPO side may struggle finding the right person and integrating that person into the corporate structure. And the roles and responsibilities of data protection officers certainly need further interpretation and additional guidance. The Article 29 Working Party of EU data protection commissioners is expected to publish guidance on data protection officers this month.
What is required by GDPR: a summary
Data controllers and processors alike must designate a data protection officer to comply with the GDPR. Under Article 37 of the GDPR, data protection officers must be appointed for all public authorities, and where the core activities of the controller or the processor involve "regular and systematic monitoring of data subjects on a large scale" or where the entity conducts large-scale processing of "special categories of personal data" (such as that revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and the like, defined in Article 9).
Note: although an early draft of the GDPR limited mandatory data protection officer appointment to companies with more than 250 employees, the final version has no such restriction.
The data protection officer's tasks are also delineated in the Article 39 of the Regulation to include:
- Informing and advising the controller or processor and its employees of their obligations to comply with the GDPR and other data protection laws.Monitoring compliance with the GDPR and other data protection laws, including managing internal data protection activities, training data processing staff, and conducting internal audits.
- Advising with regard to data protection impact assessments when required under Article 35.
- Working and cooperating with the controller's or processor's designated supervisory authority and serving as the contact point for the supervisory authority on issues relating to the processing of personal data.
- Being available for inquiries from data subjects on issues relating to data protection practices, withdrawal of consent, the right to be forgotten, and related rights.
These responsibilities mirror those of privacy professionals elsewhere around the globe and signal a growth spurt for the profession in the EU. In fact, the GDPR borrows some concepts from Germany's Federal Data Protection Act, which already requires a data protection officer to be appointed by firms with at least nine people employed in the automated processing of personal data, or at least 20 people who are engaged in non-automated data processing.
Note: under German law, data protection officers must be suitably qualified and are protected against dismissal except for severe breach of their duties. Many firms out-source the data protection officer responsibilities to specialized agencies or law firms. Failure to comply with Germany's compulsory data protection officer requirements can lead to significant fines.
Under the Regulation, moreover, data protection officers have many rights in addition to their responsibilities:
- They may insist upon company resources to fulfill their job functions and for their own ongoing training.
- They must have access to the company's data processing personnel and operations, significant independence in the performance of their roles, and a direct reporting line "to the highest management level" of the company.
Data protection officers are expressly granted significant independence in their job functions and may perform other tasks and duties provided they do not create conflicts of interest. Job security is another perk; the GDPR expressly prevents dismissal or penalty of the data protection officer for performance of her tasks and places no limitation on the length of this tenure.
A company with multiple subsidiaries (a "group of undertakings") may appoint a single data protection officer so long as she is "easily accessible from each establishment."
AND A BIGGIE ... the GDPR also allows the data protection officer functions to be performed by either an employee of the controller or processor or by a third party service provider, creating opportunities for consulting and legal firms to offer outside DPO services.
If you want to place an advert for a
data protection officer on our EU-wide job lists email us at [email protected].
