The General Data Protection Regulation introduces a general EU-wide obligation to appoint a formal data protection officers. This role is responsible for overseeing the data protection (or privacy) management programs within data controllers or data processors' companies in order to satisfy regulators and assure that organizations remain in compliance with GDPR over time.
Even though varying jurisdictions around the world don't mandate a DPO, it can only play well for your companies' DPO role to be truly global. But that's for each company and privacy office to decide for itself, depending on varying factors we'll discuss in this article.
The responsibilities of a DPO include, but are not limited to:
- Provide focal points for decisions that may affect the use of personal data across multiple departments, including carrying out data protection (or privacy) impact assessments;.
- Coordinate with other appropriate persons responsible for related disciplines and functions within the organization, such as human resources, marketing, internal audit group, information technology area, and information security area, among others;
- Manage any risks that might arise with regard to processing operations of personal data, taking into account the nature, scope, context and purposes of processing;
- Ongoing assessment of controls to ensure key data protection processes are being respected;
- Handle and manage personal data protection related queries and complaints from the data subjects in an appropriate manner, including any actions to be taken by the organization to address the complaint;
- Develop, review and revise policies, process and procedures to handle personal data in electronic or non-electronic forms;
- Foster a data protection culture and accountability among employees and communicating personal data protection policies to stakeholders;
- Ensure compliance with data protection laws, as well as that feedback from regulators gets implemented in personal data protection policies;
- Review and adapt data breaches management response protocols to implement best practices or recommendations and lessons learned from post-breach reviews; and
- Report directly to the board of directors and cooperate with the data protection authorities.
Most of the corresponding data protection laws outside Europe do not explicitly make any mention of a DPO. Nevertheless, some data protection authorities have emphasized that the function of a DPO is considered as an essential and strategic component of the accountability principle. This principle ensures that companies are able to demonstrate compliance with the data protection principles.
In the matter of M Stars Movers & Logistics Specialist Pte. Ltd., the Personal Data Protection Commission of Singapore found that M Stars failed to appoint a Data Protection Officer. In this case, the PDPC highlighted:
“ … From the foregoing, it is clear that regardless of the size of an organization, the DPO plays a vital role in building a robust data protection framework to ensure the organization’s compliance with its obligations under the PDPA.”
In the matter PIPEDA Case Summary #2006-346, the Office of the Privacy Commissioner of Canada found that the defendant did not have appropriate privacy policies or procedures in place, nor was there initially a designated privacy officer accountable for compliance, among other findings, contrary to the accountability principle.
The findings cited above demonstrate that without a DPO there is greater potential for organizations to fail to comply with applicable data protection rules and with the policies, processes and procedures.
Additionally, organizations must provide the necessary resources and supports for their DPOs to effectively carry out their tasks (e.g. IT resources, governance structure, staffing resources, technical and legal advisors). Organizations must also ensure that DPOs strengthen their proficiencies in order to effectively comply with their responsibilities under law, such as, for instance,
- Managing appropriate and effective measures to put into effect the principles relating to personal data processing;
- Monitoring the policies, practices and procedures to the handling of personal information; and
- Making sure that organizations are able to fulfill their responsibilities as data controllers or data processors.
However, the role is more than that.
Apart from having the necessary understanding of local laws and regulations, a DPO must proactively map laws and/or regulations related to protecting personal data in countries where legal requirements exist, including the data protection authorities' website. There are number of advantages to this.
First, many data protection regulations apply to organizations operating or doing business transactions around the world. The DPO must develop an internal program that detects in the regulations the same types of obligations imposed on his or her organization, as well as those specific rules. This will help meet all requirements of each data privacy regulation.
Second, in certain countries, the data protection authorities have not developed tools or guidelines to help businesses and organizations understand roles and responsibilities under data protection laws. The DPO can adopt tools or guidelines from other authorities in order to encourage consistent application of the organization’s obligations during the collection, use, disclosure and safeguarding of personal information.
Third, organizations can learn from others to anticipate events that they may face, and take prompt, reasonable steps to respond to the situation and reverse the possible effects it can cause to the rights and freedom of individuals.
For example, both the Colombian and Singapore authorities fined two companies for leaving the personal data exposed to the World Wide Web via unprotected URL links. These breaches were essentially copies of the same personal data breach. Therefore, had one of the two companies known about the other case, it could have avoided or remedied the event and avoided a breach.
By tracking enforcement actions carried out by data protection authorities around the world, the DPO can:
- Identify risks on a timely basis;
- Review policies and methods of personal data processing, if any exist;
- Support the implementation of any change as is necessary to remedy the situation and avert an investigation. This strategy would allow organizations to avoid penalties.
In view of the above, having a DPO with a global knowledge about data protection and privacy, an organization ensures that it not only follows the policies implemented in third countries, but also aligns its business with the best practices to minimize risks involved by the processing of personal data carried out and anticipates any change to privacy practices.
In any event, each organization will need to decide how to structure its data protection program and designate the DPO. Organizations should take into consideration a number of factors, including the size of the organization, the business and locations, the complexity and scale of data processing, the amount of personal information it handles, the sensitivity of the data processed and the protection required for the data being processed. This is the approach, of the Office of the Data Protection Commissioner of Ireland in its guide on DPOs.