The obligation to appoint a data protection officer (DPO) affects many companies. There are two ways to comply with this obligation: either companies appoint an employee as an internal DPO or they appoint an external DPO. In both cases, selecting the right person can be difficult. The European Court of Justice (ECJ) recently addressed the question of whether works council members can also serve as DPOs ECJ remains vague.
Qualifications of a data protection officer ECJ remains vague
Article 37 (5) GDPR stipulates that the selection of the DPO should be based primarily on professional qualifications and expertise in data protection law and practice. Furthermore, switzerland business fax list Article 38 (6) GDPR stipulates that the person appointed as DPO may perform other tasks within the company in addition to their role as DPO, but these tasks must not lead to a conflict of interest.
When does a conflict of interest exist?
A conflict of interest exists when the role of DPO is performed by senior management (company management, CFO, head of specific . Dspartments such as marketing, email privacy and gdpr compliance human resources, or IT). However, even lower-level positions are not suitable for DPOs if the functions or areas of responsibility in question involve. Determining the purposes and means of data processing, which would require oversight of one’s own work. At least, this is the view of the European Data Protection Board . Which remains entirely in line with its legal predecessor, the Article 29 Working Party.
Conflict of interest: Works council members as data protection officers?
In the first instance, the Dresden Labor Court (Dresden District Court. Judgment of June 27, 2018 – 10 Ca 234/18) held that a conflict of interest did not exist because . The DPO is obligated to work toward compliance with data protection regulations while simultaneously maintaining confidentiality. Furthermore, albania business directory the duties of works council members are. Contradictory to those of a DPO, but rather a similar set of obligations.
Even in the second instance, the Saxony State Labor Court (LAG Sachsen judgment of August 19, 2019 – 9 Sa 268/18) found no reason for the removal of the works council member as DPO. The case has now reached the third instance before the Federal Labor Court (BAG).
Preliminary ruling procedure
As part of the preliminary ruling procedure, the Federal Labor Court (BAG) has submitted several questions to the ECJ. The majority of the questions concern the relationship between the GDPR and the Federal Data Protection Act (BDSG), which we will not discuss further here. However, the BAG also raised the question of whether a conflict of interest exists if the offices of DPO and works council chair are held jointly. The ruling on this matter was issued last week (C-453/21).