By decision of April 28, 2020, the Belgian Data Protection Authority has taken a rather restrictive approach concerning the position of the DPO within a company.
Indeed, for serving a €50,000 fine on a Belgium company, the Authority, considered, among other grounds, that its Data Protection Officer could not be, at the same time, the head of the compliance, risk and audit departments. For the Authority, there was a conflict of interest since the DPO could determine the purposes and means of the processing activities carried out by these departments.
Given that risk assessment, compliance and audit are an inherent part of the DPO role, this sanction requires companies to get a closer view on the position of their DPO.
When an organisation appoints a Data Protection Officer whether on a voluntarily basis or because its processing activities meet the criteria set out in the GDPR (see here, for more details), it should pay attention to the following points at
Under the General Data Protection Regulation (GDPR), when an organisation must or choose to appoint a Data Protection Officer (see here), the latter must, at least, be in charge of the following tasks: • informing and advising the controller or the
The designation of a Data Protection Officer (DPO) is either mandatory or voluntary depending (i) on the kind of organisation, (ii) its activities and/or (iii) the type of processing operations it carries out (e.g. scale, type of data etc.). According to