25 May 2020

The internal Data Protection Officer (DPO): a position in jeopardy?

The date 25 May 2020 might ring a bell. It marks two years since the General Data Protection Regulation (GDPR for short) came into force – a robust legislative text that ratified a number of existing obligations, but also introduced new rules and positions, such as that of the Data Protection Officer (DPO).

The GDPR obliges certain undertakings to appoint a Data Protection Officer (DPO). This applies to governmental organisations and government bodies (with the exception of legal entities) and organisations that process data pertaining to data subjects on a large scale. The DPO himself can be viewed as the internal or external supervisor overseeing compliance with the privacy regulation within your organisation.


Appointing a DPO is not without “danger”

Whether or not a DPO is compulsory, what exactly his remit entails and how he is supposed to perform his duties has since been laid down in this framework. As a company you are free to appoint either someone from outside the organisation or from within it (e.g. a member of staff) as DPO.

  • The advantage of an external DPO is his independence and objective view of your company. Given his experience you do not have to give him ongoing training in the (regularly updated) data protection legislation. The disadvantage is his lack of knowledge of the ins and outs of your organisation, to which you therefore do have to give him an introduction.
  • The advantage of an internal DPO is that he or she knows your organisation (and staff). This person does not have to hold down this position on a full-time basis, and may even – under certain conditions – combine it with another post. But in that case a risk of conflict of interests does arise.

 

Who is definitely not eligible?

The GDPR’s WP29 guidelines state that a DPO may under no circumstances perform duties that “can determine the purposes and resources of the data processing within the undertaking”. In other words: management positions (CEO, CFO, CTO, etc.), and IT and HR managers are absolutely out of the question.

The consequence is that many companies currently appoint a department head, such as the Head of Compliance or the Head of Legal Affairs, as the internal DPO, because he or she is already well acquainted with the analysis and enforcement of legislative texts. Unfortunately the Data Protection Authority wants things to be even stricter.

 

The Proximus case: a precedent?

In May 2020 the Belgian Data Protection Authority (DPA) imposed a EUR 50,000 fine on Proximus for a conflict of interests in respect of its Data Protection Officer, since the latter was also Head of the Compliance, Audit & Risk Department.

The DPA asserted that the Head of the Compliance, Audit & Risk Department can also be the party with ultimate responsibility for the processing of personal data in the context of an organisation’s Compliance, Audit and Risk activities. The concept of “conflict of interests” is therefore applied very strictly here.

 

What are the implications?

Proximus could lodge an appeal with the Market Court, but announced that it would comply with the decision and adapt the position of its DPO. Nevertheless, this case raises a lot of questions. Proximus was penalised on the grounds of a hypothetical conflict of interests. So one might wonder whether an internal DPO is actually a good idea at all.

Unfortunately there is (as yet) no definite answer to this. Depending on your company and activities, a dual role is certainly permitted. We would recommend in any case that you account for your DPO’s remit very comprehensively and also designate a stand-in DPO at one fell swoop.

 

Conclusion: better safe than sorry

It is now two years since the GDPR was brought into force. The lack of guidance and controls in the initial months led to many companies becoming less vigilant. But the facts speak for themselves: since then more and more companies have got into trouble with the DPA or have been the victims of phishing. A GDPR-proof data security policy is more urgent than ever.

Related articles

Do I pay up my cash contribution in full when incorporating a private limited company or not?
Optimal management
22 June 2020

Do I pay up my cash contribution in full when incorporating a private limited company or not?

If you wish to incorporate a private limited company, you should bear in mind that all contributions from the moment of incorporation should be paid ...

Read more
Tax deductibility of company cars: WLTP or NEDC from 2021 onwards? The tax office throws more light on the matter
Optimal management
05 June 2020

Tax deductibility of company cars: WLTP or NEDC from 2021 onwards? The tax office throws more light on the matter

In the middle of 2019 the tax authorities shed some light on the matter of what values should be used to determine the tax deductibility of private ...

Read more
Steven Vermeeren (Eldi): “Our annual audit runs like clockwork”
Optimal management
02 June 2020

Steven Vermeeren (Eldi): “Our annual audit runs like clockwork”

The family-owned electrical goods chain Eldi chose VGD as its audit partner a few years ago. “VGD is well and truly at home in the SME sector”, says ...

Read more