4 ms·
You actually can't appoint yourself as DPO since it would be a conflict of interest. But you only need a DPO if your core business is large scale user tracking,
by dbbk 8y ago
You actually can't appoint yourself as DPO since it would be a conflict of interest. But you only need a DPO if your core business is large scale user tracking, which it probably isn't (especially if you're a small startup).
https://www.pensar.co.uk/blog/data-protection-officer https://www.pensar.co.uk/blog/data-protection-officer
> The following companies need to appoint a data protection officer under Article 37:
* Public authorities or bodies, except for courts acting in their judicial capacity.
* Companies who process data requiring ‘regular and systematic monitoring of data subjects on a large scale.’
* Companies who process, on a large scale, any special category of personal data. This includes data which reveals racial or ethnic origin; political opinions; religious or philosophical beliefs and other such information.
* Companies who process, on a large scale, personal data relating to criminal convictions and offences
- marcus_holmes 8y agothere's nothing in the document you linked to, or the guidance that it links to (http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612048 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...) that says the DPO can't have any role in the organisation. There's no "conflict of interest" clause I can see... but I'd welcome any clarification.
- pintxo 8y agoCheck out §38 6 > 1The data protection officer may fulfil other tasks and duties. 2The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. It's difficult to ensure that there is no conflict of interests if the CEO === DPO.
- duxup 8y agoThat seems really vauge. I'd argue anyone working for the company and getting paid could have a conflict of interest.
- pintxo 8y agoDon't you think one could (contractually) minimize (probably not remove) conflicts of interest? Quite obviously one will not be able to completely remove conflicts of interest as long as there is another (monetary) dependency. Which is the reason for a state owned regulatory agency in the first place.
- boomboomsubban 8y agoWhat duties would you have that would cause a conflict of interest that aren't already against the GDPR? It seems that's the only situation where there would be an issue.