Organizations are responsible for compliance with Brazil's General Data Protection Law and, therefore, must adopt effective measures capable of proving compliance with the rule. One of the determinations provided for in the LGPD is that the controller designates the data protection officer, who will act as a communication link between the controller, the data subjects (individuals) and the Autoridade Nacional de Proteção de Dados.
The DPO will be the person responsible for the dissemination of privacy protocols in the organization, reporting to senior management and developing communication channels for dialogue with executive, operational and administrative positions, permeating the entire organization to promote a true culture of data protection.
It is important to emphasize the DPO must be granted the necessary functional independence and freedom to, for example, accept complaints and communications from data subjects, provide clarifications and adopt measures without external influence with the sole purpose of supporting the decision-making of the board of directors regarding personal data protection matters. Thus, it is strongly recommended the DPO should be free of conflict of interest in its functional performance and respond directly to senior management.
In these terms, prior to the appointment of the DPO, it is of utmost importance that companies identify incompatible positions, confirm the absence of conflicts of interest regarding the functions that will be performed, guarantee the functional autonomy of the DPO, and allocate a specific budget for the execution of their daily activities.
Regarding the recommended qualifications, the DPO should assume a multidisciplinary approach, whereby skills for interpersonal relationships need to be combined with the ability to manage the privacy programs, in addition to understanding the internal business processes that involve the processing of personal data. It will also be necessary for the DPO to assess the risks to privacy and personal data protection based on the provisions of the LGPD and future regulations, in addition to the internal and external communication channels.
The DPO must possess significant knowledge, theoretical and practical competence regarding personal data protection and information security, as well as extensive knowledge of specific rules involving data protection applicable to the sector of relevant economic activity, to perform the functions set out in the LGPD and by the ANPD.
Considering this is a role that, by its nature, brings with it the inherent functions of a company spokesperson, management of personal data processing activities and the possibility of issuing opinions to senior management in the event of a violation or incident, it is recommended the DPO possesses extensive knowledge of the organization's business, has leadership skills, the ability to guide decision making, and possess fluid written and verbal communication skills.
Still, in relation to the recommended actions of the DPO, it is understood as a measure of good international practice that whenever a DPO’s opinion is not followed by senior management, the reason must be disclosed — which may vary widely, such as the organization's risk appetite, the impossibility of cash disbursement, among others.
Further, interpersonal relationships must be carefully evaluated, since the DPO will depend on the creation of the entire team’s empathy to maintain the engagement and perpetuate a culture of privacy at all levels of the organization, coordinating the work of the Privacy and Protection of Personal Data Committee, which will assist with multidisciplinary and ongoing contributions.
The DPO is charged with the task of ensuring compliance with internal policies, especially with regard to information security and data protection, taking into account that the appointed professional can be an external service provider or an employee of the organization, provided that it possesses all or most of the mentioned competencies and that an internal team can be established that responds directly to the DPO, assisting it in its daily demands.
It is important to emphasize the DPO's responsibility will be limited to the proper due diligent exercise of its functions under the organization, and any civil or administrative liability for any incident or damage caused to the data subject will fall to the organization.
In essence, there is no "silver bullet." A careful prior evaluation of each specific case must be carried out to define the appropriate job description. It is essential to verify the organization’s situation, its culture, the nature and volume of the data processed, the field of activity (if it is regulated or not) and, in a complementary way, for the option of hiring an external consultancy composed of a team that brings together qualified and experienced professionals to provide legal advice and guidance to the internal DPO.
In addition to assisting with direct contact with data subjects and relevant authorities, an external consultancy can provide additional support in ensuring compliance with all legal requirements, in reviewing legal documents, enabling the reduction of costs through staff training and with activities that can be absorbed by the external consultancy whether immediate, continuous or on-demand.
Photo by Tetiana SHYSHKINA on Unsplash
