One of the biggest game-changers in the new EU General Data Protection Regulation is that it will force many businesses across the bloc to appoint a data protection officer.
So far, countries like the U.K. advise companies who engage in lots of data processing to appoint a DPO, but only one country – Germany – mandates the role. So what better place to look to see how well such systems work?
The German law requiring DPOs came into force in 2001. It was actually quite welcome for many companies, because it's a largely self-regulatory system that meant they no longer had to make regular filings to data protection authorities whenever they changed their processes.
"The internal DPO within a company is quite a strange cat," said Freiherr von dem Bussche.
The DPOs are in a curious position, appointed by the board but answerable to the country's data protection laws, not management. They can't be blocked from looking into certain processes, and they can't be fired for doing their jobs. However, they report to the board, telling them what they have to do to be in compliance, and if the company doesn't follow their advice, they don't then have to go snitch to the authorities – their job is done.
According to Thomas Spaeing, the CEO of the German Association of Data Protection Officers (BvD), their primary job is not supposed to be about protecting their company, but rather protecting people whose data is processed by the company.
However, not all companies are actually appointing DPOs when they're supposed to (an obligation on all companies who have more than nine people handling personal data), he said. But this is changing as data protection infects the public consciousness.
"In the last six to eight years, data protection has become very important for the companies, because a lot of things happen [that become] a good story for the newspaper," Spaeing said. "A lot of companies understood it’s a good thing to have a DPO. It's like a trust centre for the customer … kind of a competitive advantage."
Axel Freiherr von dem Bussche, a partner at Taylor Wessing, also said companies have recently started taking the mandate more seriously, particularly after the revelations of Edward Snowden.
"In the beginning, companies were very happy to get rid of their data protection compliance requirements and took anyone who was close enough to the door of the board," he said. "Everyone was laughing about them; they had no clue. Today, in the post-Snowden world, this role becomes much more serious. You have far more professional, full-time DPOs."
This is particularly the case in larger companies. That said, German DPOs come from all sorts of backgrounds – they can be assistants, secretaries or directors, who have been given new responsibilities.
According to Spaeing, this means there's a complicated disparity in how much they get paid. The companies aren't supposed to use their salaries as leverage to manipulate them, but at the same time there's no standard rate for how much a DPO should be paid. "With payment, sometimes it's difficult," he said.
In any case, Spaeing said, there's real value in DPOs coming from varying backgrounds.
"A good thing for a company is to nominate someone who is good in the process of the company, who knows how the company works and can integrate the law in how the company works," he said. "We have a lot of people with a legal background in this, but legal people are usually not good in processes or IT. As a DPO you should understand how the IT is working, for example catching an iPhone ID in a shop, how that works. That's usually difficult for people with a legal background, but for classical IT people, programming people or whatever, it's difficult to understand the law."
DPOs become the "go-to person for everyone within the company," said Freiherr von dem Bussche, who noted they have to know what is going on across operations and "negotiate and balance interests between the board, the workforce, maybe a work council, and third parties such as customers who have data protection-related questions," as well as the authorities, when they want to approach the company.
"The internal DPO within a company is quite a strange cat," he added.
Not all DPOs are internal, of course. The job can be outsourced, which generally happens with smaller or medium-sized companies. The option means not having to comply with the strict DPO labor laws, although companies also can’t just immediately cancel contracts with their outsourced DPOs when they don't like what they say.
Freiherr von dem Bussche warned against outsourcers and their clients who see the role as a box-ticking exercise.
"There are some external DPOs who are quite good," he said. "Some are really bad. They just come in and tick the box and everyone is happy. The external DPO is happy because he or she gets an extra 150 euros a month for doing nothing. Both believe they are compliant with German data protection law – in the world of today, I believe you should at least know where you are not compliant."
So what of the GDPR's version? From the German perspective it's "a compromise," said Freiherr von dem Bussche, because it mostly applies to companies whose core activities involve large-scale data processing. However, the GDPR should also ensure DPOs' independence, whether they're internal or external.
The new rules will, according to the Taylor Wessing lawyer, probably spark a "huge business" in DPO outsourcing, as mid-sized companies suddenly find themselves having to comply with the law, without wanting to appoint someone internally.
"Particularly in the Anglo-Saxon world, they hate the idea; they think it's a waste of money," Freiherr von dem Bussche said. "An internal DPO who they do not have under full control, they don’t like the idea that they're independent, they're afraid they are a loose cannon. My feeling is that they're very likely [going] to prefer an external DPO."
The biggest lesson for companies in other countries, according to Spaeing, is to see the DPO as a partner: "He's not a spy for the authorities; he's a specialist who can help companies implement data protection processes."