Role of Data Protection Officer (DPO) under General Data Protection Regulation (GDPR)
After four years of preparation and debate the General Data Protection Regulation (GDPR) was finally approved by the EU Parliament on 14 April 2016. The Regulation was adopted and published on 27 April 2016 and will be enforceable on and from 25 May 2018. The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU) whilst addressing the export of personal data outside the EU. It regulates the EU citizen data in every part of the world and in every organization processing or storing an EU Citizen’s data. The EU GDPR replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy. This new law will have a profound impact on the operational and control environment of the organisations, not only within EU but also within the organisations based outside the EU including India. It extends the scope of EU data protection law to all foreign companies processing data of EU residents. It provides for a harmonization of the data protection regulations throughout the EU, thereby making it easier for non-European companies to comply with these regulations. However, in some areas, the precise interpretation of the GDPR remains unclear, and businesses therefore face uncertainty in terms of their compliance obligations. To address this issue, the GDPR is supplemented by guidance issued by the Article 29 Working Party (WP29), an advisory body made up of representatives of the national Data Protection Authorities of each EU Member State. Provision for Data Protection Officer (DPO) The GDPR has a mandatory provision for the appointment of Data Protection Officer by pertinent organisations. The role of Data Protection Officer (DPO) is an important GDPR innovation and a cornerstone of the GDPR’s accountability-based compliance framework. In addition to supporting an organisation’s compliance with the GDPR, DPOs will have an essential role in acting as intermediaries between relevant stakeholders e.g., supervisory authorities, data subjects and business units within an organisation. All organisations who will be required by the GDPR to appoint a DPO should do this as soon as possible and well in advance of May 2018. With the authority to carry out their critical function, the Data Protection Officer will be of pivotal importance to an organisation’s preparations for the GDPR and meeting the accountability obligations. A DPO may be a member of staff at the appropriate level with the appropriate training, however, GDPR also provides for an option of an external DPO who will be shared by a group of organisations. It is important to note that DPOs are not personally responsible where an organisation does not comply with the provisions of GDPR. The GDPR makes it clear that it is the Controller or the Processor of the organisation who is required to ensure and to be able to demonstrate that the processing is in accordance with the GDPR. Data protection compliance is ultimately the responsibility of the Controller or the Processor. Who needs a DPO For the first time Data Controllers as well as Data Processors are required to appoint a Data Protection Officer in three situations as per Article 37(1) of the GDPR. Where the processing is carried out by a public authority or body Any organisation that is a public authority or a public body must appoint a DPO. However, the GDPR does not define the expression ‘public authority or body.” Rather, the GDPR leaves it to each EU Member State to determine which organisations are public authorities and public bodies. Where a private business performs outsourced public functions on behalf of a public authority or a public body, the WP29 recommends that such business should appoint a DPO, not merely in relation to those outsourced public functions, but also in relation to all of the other data processing activities of that business, including processing activities that are unrelated to the outsourced public functions. Where the core activities of the Controller or the Processor comprise processing operations, which require regular and systematic monitoring of data subjects on a large scale Under this provision companies whose primary activities involve processing personal data on a large scale for the purposes of behavioural advertising, online tracking, fraud prevention, detection of money laundering, administering loyalty programs, running CCTV systems, monitoring smart meters etc., will be caught by the DPO requirement. Core activities can be defined as the key operations necessary to achieve an organisation’s (Controller or Processor’s) goals. For example, a private security company which carries out surveillance of private shopping centres and/ or public spaces using CCTV would be required to appoint a DPO as surveillance is a core activity of the company. On the other hand, it would not be mandatory to appoint a DPO where an organisation undertakes activities such as payroll and IT support, as while these involve the processing of personal data, they are considered ancillary rather than core activities. Where the core activities of the Controller or the Processor consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences Article 37(1)(b) and (c) requires that the processing of personal data be carried out on a large scale in order for the designation of a DPO to be triggered. Article 37(1)(c) addresses the processing of special categories of data pursuant to Article 9, and personal data relating to criminal convictions and offences set out in in Article 10. Qualifications Article 37(5) of the GDPR provides that a Data Protection Officer shall be designated on the basis of professional qualities, and in particular, expert knowledge of data protection law and practices, and the ability to fulfil the tasks referred to in Article 39. “It is important to note that DPOs are not personally…