Before answering the first question posed, it is advisable to know some differences between a Data Protection Officer (“DPD” or, “DPO” in its English acronym, which means: “Data Protection Officer”) and a lawyer. Well, the difference lies in the fact that the DPD exercises an independent role, offering a multidisciplinary vision beyond mere legal advice. In the following sections, we will answer the first question posed, by becoming more precise about the circumstances in which a DPD must be appointed, the functions it performs, as well as the DPD’s relationships with the different agents, both within and outside its organization.
Let's get started. The DPD is a new figure introduced by the Data protection regulations to ensure compliance with it within an entity. It can be either a natural or legal person, as long as they meet the profile of an expert in data protection and, in addition, have specialized knowledge in law; however, it is not necessary that they be a lawyer to do so.
Next, after this initial approximation, it is now necessary to know under what circumstances it operates, and therefore to know whether its designation is necessary. Well, according to the Regulations the designation of the DPD will be mandatory when: (i) the processing is carried out by a public body; (ii) when the operations of the processing involve the processing of large quantities of personal data “large scale”or (iii) such operations consist of the “large-scale” processing of special categories of personal data (for example, health data, genetic or biometric data).
Given the above, if one of the three assumptions is met, such designation will be mandatory, regardless of other aspects such as the size of the company or its sector of activity, among others. Thus, without delving into the aspect of the designation, it should be added that it must publish the contact details of the DPD, in order to clearly establish the point of contact between the entity and the interested party; and, in addition, The appointment, renewal and dismissal of the DPD must be communicated to the competent control authority. (e.g. www.aepd.es).
Thus, whether we are obliged or not, if we want to appoint a DPD, he/she must, at a minimum, perform the following functions within his/her organization, let’s see: (i) inform and advise on the obligations arising from data protection regulations, with a multidisciplinary vision beyond the purely legal aspects (e.g., privacy from the design and by default); (ii) independently monitor compliance (e.g., internal auditor), awareness-raising and training of personnel in data protection; (iii) provide advice on the Personal Data Protection Impact Assessment; (iv) cooperate with the competent supervisory authority; and, (v) serve as a point of contact with that supervisory authority.
In short, our recommendation is that Be well informed about this new figure, get to know it, and more importantly, when choosing the DPD, the entrepreneur, whether in his capacity as responsible or as person in charge of the processing, should ensure that the DPD has the necessary knowledge in data protection; for a simple reason, because poor practice by the DPD could lead to risks of non-compliance, as well as create obstacles that prevent or delay the company’s activity, and even the organization’s innovation. Thus, according to Article 83.4 of the GDPR, Such non-compliance may lead to serious infringements that are subject to a two-year statute of limitations; these penalties can range from up to 10 million euros, or an amount equivalent to 2% of the company's total annual turnover.
If you have any questions or think you need a data protection delegate, we would be delighted to help you in this regard.