Who is the data protection officer?
The function of the Data Protection Officer (DPO) is regulated in Article 37 of the GDPR, which specifies the circumstances in which the controller is obliged to appoint a person responsible for aspects related to data protection when:
- the processing is carried out by a public authority or body, with the exception of courts in the exercise of their judicial powers;
- the core activities of the controller or processor consist of processing operations which, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale;
- the main activity of the controller or processor consists in the large-scale processing of special categories of personal data, and personal data relating to criminal convictions and offences.
Independence of the DPO
It should be noted that the DPO must maintain independence, meaning that they are prohibited from issuing binding orders or instructions regarding the performance of their duties. To achieve this, the DPO must report to the highest management level of the controller or processor. Furthermore, they must be consulted on all matters and new initiatives that may, even indirectly, relate to the processing of personal data.
IOD and whistleblowers
One such matter in which the DPO should be involved to some extent is the protection of whistleblowers. To ensure an adequate level of data security and, consequently, prevent retaliation, it is essential for the DPO to participate in the process of implementing internal regulations regarding whistleblowers within the controller's organization. This means that they should review the relevant policies and procedures for data protection and mitigate the risks associated with the processing of whistleblowers' personal data. Furthermore, they should be involved in the selection of appropriate IT systems for handling reports, issue recommendations regarding the adequate security of communication channels and registers, and develop guidelines for the secure storage of such data. In subsequent stages, the DPO serves as a point of contact for resolving any concerns related to the protection of whistleblowers' personal data.
Risk of conflict of interest
The DPO's role can be combined with other tasks, so the DPO could potentially also be involved in the process of receiving reports and conducting investigations. It is important, however, that they should not handle whistleblower reports involving violations of privacy and personal data protection. In such a case, the DPO would become, in a sense, a "judge in his own case.
Aspects related to whistleblower management should be delegated to individuals dedicated to compliance to avoid conflicts of interest with the duties of the DPO. It is therefore recommended to avoid combining functions within both departments. In particular, it is essential to separate the roles of the DPO from those of the Compliance Officer, the person responsible for ensuring the company's operations comply with internally adopted procedures and policies.
The Belgian supervisory authority takes a similar position and in 2020 imposed a fine of EUR 50,000.00 on an entity that commissioned the functions of DPO and head of compliance to the same person.
Graś i Wspólnicy law firm supports businesses in implementing personal data protection regulations and whistleblower procedures. We encourage you to contact us.
This article is for informational purposes only and does not constitute legal advice.
Legal status as of April 24, 2024.
author:
