The data protection officer role is a new feature for many organizations now subject to the EU General Data Protection Regulation. Critically, for many companies, designating a DPO is not optional. The Article 29 Working Party (now the European Data Protection Board) further suggests that it may be in the interest of companies not legally required to designate a DPO to do so anyway, whether “internal” or “external.” Considering that data protection officers — whether inside or outside of the organization — counsel about legal and regulatory compliance and are therefore on the front lines of enterprise risk, could they be exposed to staggering personal liability for data protection violations by their employers or clients? What are the risks of liability for both internal and external DPOs and what options might be available to them to mitigate or insure against that risk? IAPP Westin Fellow Lee Matheson, CIPP/A, CIPP/E, CIPP/US, CIPM, answers these questions and more for The Privacy Advisor.
Full Story