Are you unsure as to whether you have to appoint a Data Protection Officer under the mandatory requirements of GDPR?

GDPR has been clarified by the Article 29 Working Party Guidelines on Data Protection Officers. Certain terms such as ‘large scale’ have been somewhat clarified. For example the processing personal data would not be considered large scale if the processing was undertaken by “an individual physician“ . However it is clear that a large multi-partner medical practice would need to. The European Parliament considered the processing of 5000 records per year to be large scale.

It is now clear that very many existing “data protection officers“ may not have the expertise or knowledge to act as a Data Protection Officer as specifically defined by GDPR and cannot be considered or referred to as Data Protection Officers. GDPR makes it clear what objective qualities are required.

So, no longer may “John from IT“ be an organisation’s Data Protection Officer. Furthermore it has become clear from guidance and case law in Germany that if there is a conflict of interest between the tasks of the Data Protection Officer and the other tasks within the organisation, the appointment may not be compliant with GDPR. Thus, Heads of HR, Legal, or IT and suchlike would be conflicted from being appointed.

The DPO® Data Protection Officer will have no such conflict and will be a certified expert GDPR practitioner.