Like pdpEcho on Facebook
-
Recent Posts
- Exam scripts are partly personal data and other practical findings of the CJEU in Nowak
- A Conversation with Giovanni Buttarelli about The Future of Data Protection: setting the stage for an EU Digital Regulator
- Why did Facebook just receive (one of) the biggest data protection fine(s) on record
- Exam scripts and examiner’s corrections are personal data of the exam candidate (AG Kokott Opinion in Nowak)
- Highlights of the draft LIBE report on the ePrivacy Reg
- Summary of the Opinion of AG Kokott in Puškár (on effective judicial remedies and lawful grounds for processing other than consent)
- Door-to-door gathering of data by religious group goes to the CJEU
- CNIL publishes GDPR compliance toolkit
- CJEU in Manni: data subjects do not have the right to obtain erasure from the Companies Register, but they do have the right to object
- The right to be forgotten goes back to the CJEU (with Google, CNIL, sensitive data, freedom of speech)
Archives
Tags roulette
AG Mengozzi Article 8 Charter article 29 working party big data CJEU cloud computing CNIL data portability data protection Data Protection Directive data protection laws data protection officer data protection reform data protection regulation directive 95/46 directive 95/46/EC EDPS European Commission European Data Protection Supervisor European Parliament Facebook Gabriela Zanfir GDPR Google personal data PNR privacy right to be forgotten Surveillance technology Viviane RedingFollow me on Twitter
My TweetsCategories
RSS
Meta
Advertisements
Tasks of the data protection officer
I was writing yesterday how EU will oblige all the public institutions and the big companies to appoint a data protection officer through the new data protection regulation. Now we’ll have a look on the tasks the data protection officer will have to accomplish.
According to Article 36 of the proposed regulation, the data protection officer will have to:
– inform and advise the controller or the processor of their obligations pursuant to the Regulation and to document this activity and the responses received
– monitor the implementation and application of the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, the training of staff involved in the processing operations, and the related audits
– monitor the implementation and application of the Regulation, in particular as to the requirements related to data protection by design, data protection by default and data security and to the information of data subjects and their requests in exercising their rights under the Regulation
– ensure that the documentation referred to in Article 28 is maintained
– monitor the documentation, notification and communication of personal data breaches
– monitor the performance of the data protection impact assessment by the controller or processor and the application for prior authorisation or prior consultation
– monitor the response to requests from the supervisory authority, and, within the sphere of the data protection officer’s competence, co-operating with the supervisory authority at the latter’s request or on the data protection officer’s own initiative
– act as the contact point for the supervisory authority on issues related to the processing and consult with the supervisory authority, if appropriate, on his/her own initiative.
These tasks are provided for in the regulation but they are considered as a minimum level of specialized activity. The tasks of the data protection officer are subject to two possible enlargements: one coming from the controller or processor, and another one coming directly from the European Commission. In this respect, paragraph 2 of Article 36 provides that “The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for tasks, certification, status, powers and resources of the data protection officer referred to in paragraph 1“.
Share this:
Like this: