5 ms·

Even if he was _required_ to appoint one (which I don't see how he is), he can appointment himself to do it. It's really not a huge deal...

CobrastanJorji 8y ago
I don't think he can. The DPO may not be assigned any tasks that would result in a conflict of interest between their role as a DPO and their other responsibilities. I suspect that means that the sole proprietor can't be the DPO. But, you know, not a lawyer, not even European, could be wrong. See article 38, paragraph 6, 2nd sentence.
- BinaryIdiot 8y ago
  Yup, I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases. But, yeah, I'm not a lawyer too. Edit: DPO Network says this which I think is a pretty good summary (though it's not part of the explicit legal policy, it's someone's opinion) > CAN WE ASSIGN ONE OF OUR EMPLOYEES AS OUR DPO? > Yes. However, you must ensure that other professional duties of this employee must be compatible with his/her new duties as DPO and do not result in a conflict of interests. https://www.dponetwork.eu/faqs.html https://www.dponetwork.eu/faqs.html
  - ucaetano 8y ago
    > I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases Being the sole owner and manager and being the DPO is clearly a conflict of interest.
    - netsharc 8y ago
      If you're Zuck or anyone working for FB, that'd be true. But what if one of my interests in running my company is the protection of my users' data?
      - ucaetano 8y ago
        Can you imagine yourself trying to convince a regulator of that?
        netsharc 8y ago
        Like Zuck before senate? I imagine when running a business one faces many stupid bureaucrats, this could be another one (or they could be competent and understand and accept the technical explanation of how my imaginary company complies with GDPR). But yeah, why quit because of the n + 1th bureaucrat, when you've dealt with n of them while starting and running of your business?
        ucaetano 8y ago
        > Like Zuck before senate? No, like Google, Microsoft and Intel before the European Commission.
    - BinaryIdiot 8y ago
      > Being the sole owner and manager and being the DPO is clearly a conflict of interest. Could you clarify why you think this is so? As an owner, my interests would align with the DPO's interests so it's hard to me to find where the conflict of interest would reside in the case of being the sole employee _and_ DPO. Now if it's a large company where they make money per GDPR policy workaround then I could see it being required another person than the owner, but it could still certainly be an employee.
      - deleted 8y ago
        [deleted]
      - ucaetano 8y ago
        No, as an owner your interests do not necessarily align with the DPO. They might, but they do no necessarily.
    - lagadu 8y ago
      If you're selling your stored PII to third parties without user consent then yes, it would be.
  - stordoff 8y ago
    I would say there is a definite conflict of interest for the sole owner to be the DPO - you are responsible for the entire direction of the company, thus have considerations beyond data protection (rather than an individual who ONLY has to consider the data protection outcomes in the exercise of his duties). Even if you make data protection a paramount concern, and intend to be fully compliant, there is the possibility that you could e.g. make more money or provide a better service by making a different choice, therefore there is a conflict of interest.
- s_dev 8y ago
  Sole proprietor has to be the DPO in that instance.
ThePhysicist 8y ago
That's not possible as the DPO must not have any conflict of interest (https://gdpr.dpkit.com/gdpr/chapter-iv/section-4/article-38.html https://gdpr.dpkit.com/gdpr/chapter-iv/section-4/article-38....), so he/she cannot be an owner or executive of the company.
- quietdean 8y ago
  That's a big assumption. In an executive/owner role where, say, you are the CTO, surely data protection (and therefore the risks and penalties involved in controlling this data) are a core concern? Owning or being in an executive position seems to me to be an investment of interest, not a conflict. And even if such a conflict does arise, as it surely will somewhere, the text linked states that the controller and processor shall ensure that such a conflict does not exist. It does not say that "You can't do this because 'conflict of interest'", it just says those two roles will ensure there will be no conflict of interest. If you read all the guidance, you will see that the DPO is the most protected role. It has the least liability. The data controller and processor have their own responsibilities, from a liability pov. Unless you are the business owner/executive, DPO, data controller and data processor...I can't see this being a conflict of interest. Ever.
  - ThePhysicist 8y ago
    I don't think it's a big assumption as the law as well as the guidelines clearly state that point (from "Guidelines on Data Protection Officers" [1] by WP29, pages 16 ff.): > The absence of conflict of interests is closely linked to the requirement to act in an independent manner. Although DPOs are allowed to have other functions, they can only be entrusted with other tasks and duties provided that these do not give rise to conflicts of interests. This entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. Due to the specific organisational structure in each organisation, this has to be considered case by case. > As a rule of thumb, conflicting positions within the organisation may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing. In addition, a conflict of interests may also arise for example if an external DPO is asked to represent the controller or processor before the Courts in cases involving data protection issues. In summary, if you have power to decide how or for what purposes the processing of the data is to be carried out you're probably not allowed to serve as DPO. Of course in the end it's the company's decision who to give that role to, but not following the guidelines increases the chance of non-compliance. 1: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612048 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...

CobrastanJorji 8y ago

I don't think he can. The DPO may not be assigned any tasks that would result in a conflict of interest between their role as a DPO and their other responsibilities. I suspect that means that the sole proprietor can't be the DPO. But, you know, not a lawyer, not even European, could be wrong. See article 38, paragraph 6, 2nd sentence.

BinaryIdiot 8y ago
Yup, I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases. But, yeah, I'm not a lawyer too. Edit: DPO Network says this which I think is a pretty good summary (though it's not part of the explicit legal policy, it's someone's opinion) > CAN WE ASSIGN ONE OF OUR EMPLOYEES AS OUR DPO? > Yes. However, you must ensure that other professional duties of this employee must be compatible with his/her new duties as DPO and do not result in a conflict of interests. https://www.dponetwork.eu/faqs.html https://www.dponetwork.eu/faqs.html
- ucaetano 8y ago
  > I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases Being the sole owner and manager and being the DPO is clearly a conflict of interest.
  - netsharc 8y ago
    If you're Zuck or anyone working for FB, that'd be true. But what if one of my interests in running my company is the protection of my users' data?
    - ucaetano 8y ago
      Can you imagine yourself trying to convince a regulator of that?
      - netsharc 8y ago
        Like Zuck before senate? I imagine when running a business one faces many stupid bureaucrats, this could be another one (or they could be competent and understand and accept the technical explanation of how my imaginary company complies with GDPR). But yeah, why quit because of the n + 1th bureaucrat, when you've dealt with n of them while starting and running of your business?
        ucaetano 8y ago
        > Like Zuck before senate? No, like Google, Microsoft and Intel before the European Commission.
  - BinaryIdiot 8y ago
    > Being the sole owner and manager and being the DPO is clearly a conflict of interest. Could you clarify why you think this is so? As an owner, my interests would align with the DPO's interests so it's hard to me to find where the conflict of interest would reside in the case of being the sole employee _and_ DPO. Now if it's a large company where they make money per GDPR policy workaround then I could see it being required another person than the owner, but it could still certainly be an employee.
    - deleted 8y ago
      [deleted]
    - ucaetano 8y ago
      No, as an owner your interests do not necessarily align with the DPO. They might, but they do no necessarily.
  - lagadu 8y ago
    If you're selling your stored PII to third parties without user consent then yes, it would be.
- stordoff 8y ago
  I would say there is a definite conflict of interest for the sole owner to be the DPO - you are responsible for the entire direction of the company, thus have considerations beyond data protection (rather than an individual who ONLY has to consider the data protection outcomes in the exercise of his duties). Even if you make data protection a paramount concern, and intend to be fully compliant, there is the possibility that you could e.g. make more money or provide a better service by making a different choice, therefore there is a conflict of interest.
s_dev 8y ago
Sole proprietor has to be the DPO in that instance.

ThePhysicist 8y ago

That's not possible as the DPO must not have any conflict of interest (https://gdpr.dpkit.com/gdpr/chapter-iv/section-4/article-38.html https://gdpr.dpkit.com/gdpr/chapter-iv/section-4/article-38....), so he/she cannot be an owner or executive of the company.

quietdean 8y ago
That's a big assumption. In an executive/owner role where, say, you are the CTO, surely data protection (and therefore the risks and penalties involved in controlling this data) are a core concern? Owning or being in an executive position seems to me to be an investment of interest, not a conflict. And even if such a conflict does arise, as it surely will somewhere, the text linked states that the controller and processor shall ensure that such a conflict does not exist. It does not say that "You can't do this because 'conflict of interest'", it just says those two roles will ensure there will be no conflict of interest. If you read all the guidance, you will see that the DPO is the most protected role. It has the least liability. The data controller and processor have their own responsibilities, from a liability pov. Unless you are the business owner/executive, DPO, data controller and data processor...I can't see this being a conflict of interest. Ever.
- ThePhysicist 8y ago
  I don't think it's a big assumption as the law as well as the guidelines clearly state that point (from "Guidelines on Data Protection Officers" [1] by WP29, pages 16 ff.): > The absence of conflict of interests is closely linked to the requirement to act in an independent manner. Although DPOs are allowed to have other functions, they can only be entrusted with other tasks and duties provided that these do not give rise to conflicts of interests. This entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. Due to the specific organisational structure in each organisation, this has to be considered case by case. > As a rule of thumb, conflicting positions within the organisation may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing. In addition, a conflict of interests may also arise for example if an external DPO is asked to represent the controller or processor before the Courts in cases involving data protection issues. In summary, if you have power to decide how or for what purposes the processing of the data is to be carried out you're probably not allowed to serve as DPO. Of course in the end it's the company's decision who to give that role to, but not following the guidelines increases the chance of non-compliance. 1: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612048 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...