A huge number of data controllers and processors alike must designate a data protection officer to comply with the GDPR.
Under Article 37, data protection officers must be appointed for all public authorities, and where the core activities of the controller or the processor involve “regular and systematic monitoring of data subjects on a large scale” or where the entity conducts large — scale processing of “special categories of data” (such as that revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and the like, defined in Article 9).
Although an early draft of the GDPR limited mandatory data protection officer appointment to companies with more than 250 employees, the final version has no such restriction.
Article 37 does not establish the precise credentials data protection officers must carry, but does require that they have “expert knowledge of data protection law and practices.” The GDPR’s recitals suggest the level of expert knowledge “should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor.”
These responsibilities mirror those of privacy professionals elsewhere around the globe and signal a growth spurt for the profession in the EU. In fact, the GDPR borrows some concepts from Germany’s Federal Data Protection Act, which already requires a data protection officer to 2 The Mandatory DPO Operational General Regulation 8 be appointed by firms with at least nine people employed in the automated processing of personal data, or at least 20 people who are engaged in non — automated data processing. Under German law, data protection officers must be suitably qualified and are protected against dismissal except for severe breach of their duties. Many firms out-source the data protection officer responsibilities to specialized agencies or law firms. Failure to comply with Germany’s compulsory data protection officer requirements can lead to significant fines.
Under the regulation, moreover, data protection officers have many rights in addition to their responsibilities. They may insist upon company resources to fulfill their job functions and for their own ongoing training. They must have access to the company’s data processing personnel and operations, significant independence in the performance of their roles, and a direct reporting line “to the highest management level” of the company. Data protection officers are expressly granted significant independence in their job functions and may perform other tasks and duties provided these do not create conflicts of interest. Job security is another perk; the GDPR expressly prevents dismissal or penalty of the data protection officer for performance of her tasks and places no limitation on the length of this tenure.
A company with multiple subsidiaries (a “group of undertakings”) may appoint a single data protection officer so long as she is “easily accessible from each establishment.” The GDPR also allows the data protection officer functions to be performed by either an employee of the controller or processor or by a third-party service provider, creating opportunities for consulting and legal firms to offer outside DPO services.
Regardless of who fills these roles both inside and outside of the EU, there ought to be considerable competition for talented and trained DPOs. The IAPP recently released a study showing demand for at least 28,000 data protection officers by the spring of 2018.