In this second post in a series on conundrums within the EU General Data Protection Regulation, Morrison & Foerster’s Lokke Moerel writes about one of the most debated and amended provisions: the data protection officer requirement. Moerel looks at the final version in the context of the current Data Protection Directive and previous iterations, determining there is a great need for some clear guidance — particularly around terms such as “large-scale” data processing and “core activities.” Moerel writes, "Given the substantial obligations and investments required for companies to appoint a DPO, such guidance cannot come quickly enough.” Editor’s Note: Read the first post in this series, on data transfer under the GDPR, here. (IAPP member login required.)
Full Story