TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

The Privacy Advisor | Where should the new mandatory DPO sit? Related reading: GDPR conundrums: Clarity needed on the DPO requirement



Privacy works best when the right person is in the right place, at the right time, asking the right questions. That's according to Microsoft CPO Brendon Lynch, CIPP/US, who spoke in Brussels recently alongside IAPP Publications Director Sam Pfeifle and Accenture Senior Director of Data Privacy Florian Thoma, FIP, CIPM, CIPP/E, CIPP/US. 

Lynch and Thoma were at the IAPP's Data Protection Congress to talk about the role of the mandatory data protection officer. Under Article 37 of the General Data Protection Regulation, public authorities, as well as entities whose core activities involve "regular and systematic monitoring of data subjects on a large scale," or that control or process special categories of personal data, must designate a DPO.

Separate and distinct from legal privacy affairs at Microsoft, Lynch sits within the corporate External and Legal Affairs office. He said when he looks at the future role of a DPO, he sees it as relatively similar to his role, but also as part of the privacy office, itself. Thoma said the DPO role at his company is distinctly different from him, but the two work together on projects frequently. 

"My hope is certainly that it's not this niche independent role, because that has all the potential to be less strategic if you're not involved in decision making and just adjudicating after the fact." -Brendon Lynch, Microsoft

The DPO's role, in part, will be to communicate with and be a representative of a company's or public entity's data protection authority. Which raises the question: Can the DPO play a role arm-in-arm with the supervisory authority while still strategically advising the company? Or should the DPO be a truly independent role, almost outside of operations? 

"I think it remains to be seen," Lynch said. "My hope is certainly that it's not this niche independent role, because that has all the potential to be less strategic if you're not involved in decision making and just adjudicating after the fact. I personally think it works best if the CPO/DPO role is strategic and involved in key decision making around business models that involve data, so they can be influential in that role, rather than it being this audit function on the side."

While independent audits are important, Lynch said they shouldn't exist within the DPO role. 

At Accenture, Thoma said, there are people playing the DPO role, but nontheless, the company plans to invest in headcount, "because we believe the GDPR is a kind of opportunity to revise what we have and make changes where needed. That's the way we took the GDPR, as an opportunity to look at, 'Do we have the right approach; do we want to make changes?'" 

Accenture does see the DPO as an extended arm of the supervisory authority, Thoma said. He said he sees an inherent conflict of interest for a DPO to be seated within certain areas of the organization. Human resources, for example. How can a position that's expected to be the eyes and ears of the DPA within the company also be involved in collecting data as sensitive as that which an HR department collects and still be objective about what's happening there? 

But Lynch feels differently. While he acknowledges that there are different cultures within different companies and in different countries and understands the DPO will likely often be an independent role, he doesn't think that's necessarily the right approach. 

"In some ways I reject the notion in this context," he said. "What it implies is that the privacy goals and the business goals are in conflict." And that's not the goal. 

"Fundamentally, you should not oversee what you're doing yourself." -Florian Thoma, Accenture

But Thoma said sometimes it's just important to have someone who's positioned to maybe see things through another lens, while still working toward the same goal. However, he said, "fundamentally, you should not oversee what you're doing yourself."

Lynch countered, though, using the analogy of a restaurant, where food and safety is important. 

"You want all the chefs to have a certain level of proficiency, and they are in the kitchen all the time so in the best position to spot where issues are going wrong," he said. "That might work better than having an office manager who doesn't see the day to day. Is it better to be someone embedded within, who's more influential with changing practices than with being an outside auditor?" 

As for whether the DPO function should be taken on by someone already performing similar duties at organizations, Thoma said DPOs should be called such and be recognized for the role they're performing at the company. But he said the DPO should be in charge of "just a couple of countries, a couple of entities as needed." It shouldn't be one-size-fits-all. Otherwise, the DPO, in certain cases hired at companies with 500 or 600 legal entities, would need to delegate much of his or her role to other people. 

That being said, size matters. A company as small as his local bakery, which happens to be processing data like email addresses, for example, doesn't need a DPO. On the other hand, a processor like a notary public perhaps could benefit from some privacy advice from someone who understands the business.

"Probably not as part of their organization, but, you would outsource that job," Thoma said. 


If you want to comment on this post, you need to login.

  • comment Stuart Ritchie • Nov 29, 2016
    If it was 12 months ago this uncertainty discussion would have made sense. But the final GDPR text has been with us for 11 months.
    There's no GDPR contradiction between being in a "niche independent role" and being strategic. 
    Further or alternatively, if there were any such contradiction then in any event the GDPR has confirmed there is only one choice, with the explicit and plain phrasing in Article 38(6). Its meaning seems crystal clear. And, just in case anyone hasn't been paying attention, it was confirmed last month by the Bavarian fine.
    In my view the correct starting point for considering the statutory office of DPO is precisely that: it's a statutory office. Its statutory controls aren't as woolly or negotiable as directorships, where potential conflicts are ok if reported, and where even crystallized unreported conflicts can be forgiven by the company rather than litigated or penalized. Further, its obligations are onerous. As one of my practitioner textbooks says, company law imposes upon directors a demanding standard of honesty and an undemanding standard of competence. The same cannot be said of DPOs - even substituting "independence" for "competence". Finally, as Bavaria has shown, you can be fined for the mere appointment of a potentially conflicted person, even if nothing bad has happened or will happen. Still, it's only 2% max for that scenario, so nobody need worry...
  • comment Winfried Tilanus • Dec 2, 2016
    This article reminded me of this experience:
    It is the middle of the night. I am sitting beside a sergeant in a jeep, watching how groups of soldiers make their way during an exercise. “Where did you do your obligatory military service?” he asked me. “I was conscientious objector.” “Then how comes you are sitting beside me, in battledress?”
    He asked exactly the right question. The short answer: I was doing an internship as humanist counselor, I was there to give spiritual care to the soldiers. But to understand what a Data Protection Officer (DPO) has to do with Dutch spiritual care, I need to explain a bit more. In the Netherlands there is a strong tradition of independent spiritual care. Hospitals, Prisons and the Army are obliged to employ chaplains, imams and humanist counselors. Their task is to look after the “spiritual wellbeing” of patients, prisoners and serviceman. They are positioned outside the organization, in the sense that they only have to take responsibility to their spiritual fellowship. Their direct employers can’t command them and they have to adhere strict confidentiality, up to the point where they may not testify in court about their clients.
    At the same time, to give proper spiritual care, they have to be very close to the organization they are working for. They must have a profound understanding of the processes in the organization and how those effect people. They must know every corner of the organization, so they can signal problems and people must know how to find them if a problem arises. Their goal is the well-being of the people they are responsible for, and though that often is in line with the goals of the organization they are working for, it not necessarily is. In that sense they are placed outside the organization, they have to be critical about how the goals of the organization affects the people involved. At the same time they need to be strongly embedded in the organization to be effective. Sometimes the most effective way to care for the people, is by playing the game of changing the organization while not having any formal power.
    There is always a tension between being inside the organization and being independent to it, a tension between helping the organization and being critical to it. And you can’t give spiritual care if you don’t accept at least the existence and goals of the organization. A nice example of the tension was during my internship when a captain send one of his soldiers to me, the captain felt I needed to talk to him. After just a short talk, the picture was clear. The soldier had made up his mind and wanted to quit (and was in a position where he could do so). He had not the slightest doubt about it. So I got back to the captain: where was that for? The soldier was the best recruit the captain had for years and the captain hoped I could convince the soldier to stay. Bad luck: if the soldier had any doubt, I could have helped him to make up his mind, whatever outcome it would have. It was my job to care for the soldier, even if it conflicts with the goals of the army.
    This article remembers me of my internship at the army. To function as DPO, your goal is compliance with the GDPR, and that is not necessarily the goal of the organization you work for. And you are the most effective if you know the processes in your organization by heart, if you can help out with designing processes and even advise on the strategic level. And if you are convinced your organization is GDPR compliant, you can speak out publicly and represent the organization. But you always have to steer between being close to your organization and keeping your professional distance. When you are outside the organization you are not effective, when you are too close to it you drift away from what you are there for.
    So when the sergeant asked me that night why I was conscientious objector and still sitting beside him in battledress, I answered: “Being a soldier is a hell of a job. I couldn’t unite it with my conscience, but I don’t want to leave people who made an other choice alone.” The sergeants face reflected years of witnessing war crimes in Bosnia: “That is good”.
    I hope DPO’s will keep a sharp eye on their goal of compliance with the GDPR , but I also hope that they won’t leave the people alone who are struggling with privacy while doing their job. DPO is a paradoxical but great position!
  • comment Roger Edwards • Dec 22, 2016
    Amidst all the discussion of where the DPO should sit and whether lawyers or IT executives are better suited, it is important to keep in mind the most important task of the DPO.  Identifying GDPR violations will be a pure factual exercise, but once the aggregate maximum fine is tallied it will likely be the dynamic interaction between the DPO and the DPA that determines where on the fine scale the hammer lands.  In the early days of "requesting" that large US IT vendors to execute model clauses there was almost 0% awareness and 100% push back creating numerous ongoing violations of the Directive.  By way of example, when similar gaps occur in implementing the GDPR it will be the task of the DPO to drive and document the conduct of a failed third party obligation "flow down" so that it can be presented to a DPA as evidence of the commitment of the company and the full engagement of the DPO.  The confident persuasive advocacy of the DPO and his or her comfort in challenging a DPAs preliminary assessment are likely to be large determining factors in whether the regulatory"prescription" is closer to remedial action with name & shame or an attention-getting, headline-grabbing fine.  Wherever this person sits their role will go way beyond fielding data subject access requests.