Is your company required to appoint a Data Protection Officer (DPO)? Are you unsure whether this obligation applies to your organization?
Before reading this article, we invite you to read a previous piece on the subject at the following link: GDPR: which organizations must appoint a DPO?
Once you have established whether you are required to appoint a DPO, another question arises. Since an organization's DPO must meet independence requirements, how can we make sure we do not run the risk of appointing a DPO who has a conflict of interest?
First of all, there are numerous safeguards that allow the DPO to operate independently:
- no instructions from the controller or the processor regarding the performance of the tasks assigned to the DPO;
- no penalization or dismissal in connection with the performance of the tasks assigned to the DPO;
- no conflict of interest with any other tasks and duties.
GUIDELINES FOR INTERNAL APPOINTMENTS
Under the WP29 Guidelines on DPOs (WP 243 rev.01) or WP29 (WP 243 rev.01), endorsed by the European Data Protection Board (EDPB), and Art. 38(6) GDPR, although the Data Protection Officer is allowed to hold other positions within the company or public administration and to perform additional tasks, it is vitally important that no conflicts of interest arise with regard to the person appointed.
The aforementioned guidelines do not provide an exhaustive list of incompatibilities, but they present some cases, among senior and middle management positions (e.g. chief executive, chief operating, chief financial, chief medical officer, head of marketing, head of human resources and head of IT).
According to the Italian Data Protection Authority (the Garante), "assigning this role to the heads of staff functions (for example, the head of the legal function) could be considered, subject to verifying in the specific context that there is no conflict of interest."
GUIDELINES FOR EXTERNAL APPOINTMENTS
Where it is decided to appoint as DPO a person external to the organization (which may be either an individual or a legal entity), assigning the role to parties who, in providing services in the interest of the controller, could find themselves in a position of conflict of interest (e.g. IT service providers, software houses, etc.) is incompatible with the independence requirements of Art. 38 of the GDPR.
GOOD PRACTICES
According to the EDPB, the following are good practices for avoiding conflicts of interest when appointing a DPO:
- draft internal rules for this purpose in order to avoid conflicts of interest;
- provide a more detailed explanation of conflict-of-interest cases;
- declare that the DPO is not in any situation of conflict of interest with regard to the DPO functions, in order to raise awareness of the requirement in question;
- provide specific safeguards in the internal rules and ensure that, when advertising the DPO position or drafting the service contract, sufficiently precise and detailed wording is used so as to prevent conflicts of interest. In this regard, it should also be remembered that a conflict of interest can take various forms depending on whether the DPO is appointed from within or outside the organization.
Not sure whether your company's prospective DPO presents potential conflicts of interest? Rely on Argo. Send us an email at info@argobs.com and tell us about your needs.