Article
When do you have to appoint a Data Protection Officer (dpo)?
Global Knowledge
- Date: 12 July, 2017
The General Data Protection Regulation (GDPR) takes effect May 2018 and has many consequences for how we handle data security and privacy. All organizations that process personal data from EU citizens will have to deal with the GDPR. One of the issues that many people are asking themselves is "when am I obligated to appoint a Data Protection Officer and what is his/her role?".
What is a Data Protection Officer?
The DPO monitors compliance with the law regarding privacy and data and is also the corresponding contact person internally and externally. It is important that he/she recognizes privacy risks and can prevent them. Not only technically, but also especially by properly setting up processes and making sure that they are also properly executed. The DPO has the overview of all activities that regard data security. In addition, he/she ensures that the culture considers security and privacy issues. The creation of awareness is therefore also a role for the Data Protection Officer.When are you Obligated to appoint a Data Protection Officer?
There are three cases in which an organization is obligated to have a DPO. The law describes it precisely, but basically you need to have a DPO when:- Your organization is a governmental organization or government agency
- When your organization monitors people regularly or systematically on a large scale by processing data. Although there is no definition in the GDPR, monitoring is, in any event, every form of tracking and profiling on internet or offline. Therefore, behavioral advertising or email re-targeting are also included in monitoring
- When you process data that is in one of the special categories of personal data. This is personal data from which race or ethnic origin, political views, religious or ideological convictions or the membership in a trade union are apparent and processing of genetic data, biometric data with the view of unique identification of a person, or data about health, or data regarding someone's sexual behavior or sexual orientation, or data about criminal convictions and criminal offenses. In any event, in order to be able to process all of this data, special additional rules are applicable.