Article 37
Designation of the data protection officer
Chapter 4
|
Controller and Processor
|
📖 5 min read
1. The controller and the processor shall designate a data protection officer in any case where:
(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
2. A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment.
3. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size.
4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors.
5. The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
6. The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.
7. The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.
Understanding This Article
Article 37 establishes when organizations must appoint a Data Protection Officer (DPO) - a key accountability and compliance role. DPO appointment is mandatory in specific circumstances but voluntary otherwise.
Paragraph 1 - Three Mandatory Scenarios:
- (a) Public Authorities: All public authorities and bodies must appoint DPO, except courts acting judicially. Includes government agencies, municipalities, public universities, etc.
- (b) Large-Scale Systematic Monitoring: When core activities involve regular and systematic monitoring of data subjects at large scale. Examples:
- Behavioral advertising companies
- Telecom providers tracking customer behavior
- Large-scale CCTV monitoring
- Online platforms tracking user behavior
- (c) Large-Scale Special/Criminal Data: When core activities involve large-scale processing of:
- Special categories (Article 9): health, biometric, genetic, racial, religious, political, etc.
- Criminal data (Article 10): convictions, offenses
Examples: Hospitals, genetic testing services, background check companies
Key Terms:
- Core activities: Key operations to achieve purposes (not support functions like payroll)
- Regular and systematic: Ongoing, organized, methodical
- Monitoring: Tracking, observing, surveilling behavior
- Large scale: Consider: number of data subjects, data volume, duration, geographical extent (WP29: factors like >5,000 persons, entire EU, sensitive data)
Paragraphs 2-3 - Shared DPO:
- Corporate groups can share one DPO if accessible from each location
- Multiple public bodies can share one DPO considering structure and size
Paragraph 4 - Voluntary Appointment:
Organizations not meeting mandatory criteria can voluntarily appoint DPO. Some Member State laws may require it.
Paragraph 5 - Qualifications:
DPO must have:
- Professional qualities (integrity, ethics)
- Expert knowledge of data protection law and practices
- Ability to fulfill Article 39 tasks
Paragraph 6 - Employment Options:
- Internal staff member, OR
- External service provider (consultant, law firm, DPO service)
Paragraph 7 - Publication Requirement:
Must:
- Publish DPO contact details (website, privacy notice)
- Communicate to supervisory authority
Practical Application
Do You Need a DPO? Assessment:
Scenario 1 - Hospital:
- Public or private? If public → DPO mandatory (37(1)(a))
- If private: Large-scale health data processing → DPO mandatory (37(1)(c))
- Result: DPO Required
Scenario 2 - E-Commerce Retailer:
- Public authority? No
- Core activity = large-scale systematic monitoring? Maybe - if extensive behavioral tracking, profiling → DPO likely required (37(1)(b))
- If just processing orders without systematic monitoring → DPO not mandatory but recommended
- Result: Depends on monitoring scale
Scenario 3 - HR Software Company:
- Processes employee data for clients as processor
- Core activity = processing employee data (routine HR data, not special categories at large scale)
- Not systematic monitoring of behavior
- Result: DPO likely not mandatory, but recommended
Scenario 4 - Genetic Testing Service:
- Core activity = genetic data (special category) processing
- Large scale? If thousands of customers → Yes
- Result: DPO Required (37(1)(c))
Scenario 5 - Marketing Agency:
- Runs behavioral advertising campaigns tracking millions of users
- Core activity = systematic monitoring at large scale
- Result: DPO Required (37(1)(b))
DPO Qualifications Checklist:
- Understanding of GDPR and national data protection laws
- Knowledge of processing operations and information systems
- Understanding of data security and technologies
- Industry sector knowledge
- Ability to foster data protection culture
- Communication skills (technical and non-technical audiences)
- Professional integrity and ethics
- Certifications helpful (CIPP/E, CIPM, etc.) but not required
Internal vs. External DPO:
Internal DPO Pros:
- Better understanding of organization
- More available and accessible
- Cultural fit
- Easier communication
Internal DPO Cons:
- Potential conflicts of interest
- May lack specialized expertise
- Single point of failure
External DPO Pros:
- Specialized expertise
- Independence
- Cost-effective for smaller organizations
- Coverage/backup
External DPO Cons:
- Less availability
- Learning curve for organization
- May serve multiple clients
Publication Requirements:
DPO contact details must be:
- On privacy notices/policies
- On website (dedicated DPO page or privacy page)
- Reported to supervisory authority (some have online forms)
- Accessible to employees and data subjects
Include:
- Name or title
- Email address
- Postal address (optional but recommended)
- Phone number (optional but helpful)
Shared DPO Arrangements:
Requirements for shared DPO:
- Must be easily accessible from each location
- Available via local contact points or channels
- Can handle workload for all entities
- No conflicts of interest between entities
- Consider time zones, languages, travel
Common Mistakes:
- Appointing DPO with conflicts of interest (e.g., head of IT, legal counsel)
- Not publishing contact details
- Appointing unqualified person
- Shared DPO not truly accessible
- Not giving DPO necessary resources and authority
- Treating DPO as purely administrative role