If your business processes personal data, its compliance assessment should include whether it must appoint a data protection officer (DPO).
You must assess the person's suitability and notify the public and the Estonian Data Protection Inspectorate of the appointment.
When must a business appoint a DPO?
Every business processes personal data, but not every business needs a DPO.
The source article addresses core activities involving personal data processing that is:
- Large-scale.
- Regular.
- Systematic.
Processing the company's own employee data is not treated as a core activity. A core activity is essential to achieving the business's everyday objectives, and the relevant processing must be integral to it.
The Inspectorate's personal data processing guidance gives healthcare, financial, communications and insurance services as examples that cannot function without personal data.
Public bodies and authorities, and controllers or processors handling special-category or criminal conviction and offence data in the relevant circumstances, also have appointment obligations. These are outside this article's main scope.
What is large-scale processing?
The European Data Protection Board recommends considering:
- The number of people or proportion of the relevant population.
- The volume of data and range of data items.
- The duration or continuity of processing.
- Its geographical scope.
The Inspectorate guidance quoted in the original article focuses on the number of people monitored and gives the following thresholds:
- Special-category or offence data concerning 5,000 or more people.
- High-risk data concerning 10,000 or more people. Examples include:
- Identity theft or fraud risks, particularly digital trust and identity management services.
- Risks to property through banking and card services.
- Risks to confidential communications.
- Real-time location tracking.
- Disclosure of financial circumstances through tax, banking and credit rating data, excluding use of public data.
- Discrimination with legal or similarly significant effects, including recruitment and assessments affecting pay or careers.
- Other personal data concerning 50,000 or more people.
What is regular and systematic processing?
Regular processing takes place continuously or at intervals, rather than occasionally.
Systematic processing is planned and methodical.
The guidance gives two examples for deciding whether a DPO is needed.
Example 1
Small shops obtain analytics from a large IT provider to identify buying preferences and deliver personalised advertising.
Each shop has relatively few regular customers, but the IT company's combined analytics cover more than 50,000 people.
In this example, the shops as controllers need not appoint a DPO, but their processor, the IT provider, must do so.
Example 2
A shop keeps customer records to prepare and retain invoices for accounting purposes but does not analyse buying preferences.
Here, no DPO appointment obligation arises because the customers are not monitored.
Who can fulfil the role?
- An employee, including a dedicated appointee.
- A unit within the organisation.
- An external legal entity under a service contract.
Where a unit or external entity provides the service, a specific individual with contact details should remain the contact for the public and supervisory authority.
How should a DPO be selected?
Assess the workload in light of the particular business.
Decide whether an existing employee with additional training can fulfil it or a new specialist is needed.
Outsourcing to a professional provider is another option.
What are the DPO's duties?
- Act as contact for data subjects on processing and exercising their rights.
- Inform and advise management and staff, and relevant partners, on data protection.
- Monitor implementation of data protection rules, allocation of responsibilities, staff awareness and training, and audits.
- Advise on and monitor data protection impact assessments.
- Cooperate with the Data Protection Inspectorate as the employer's contact.
Other tasks may be assigned if they do not obstruct these principal duties.
What must a DPO know?
The Inspectorate has listed recommended competencies for properly fulfilling the role.
Knowledge
- Company values, goals, vision, mission and strategy.
- Internal and business processes.
- Workplace rules and policies.
- Relevant EU and national data protection law.
- Legislation specific to the sector.
- Relevant ICT and information security technologies and their effects on company processes.
- Data analytics and profiling, including pseudonymisation and anonymisation.
- Risk analysis and management frameworks.
- Data protection impact assessment methods.
- Relevant legislation, case law and supervisory guidance.
- The national and, where relevant, other EU supervisory authorities and their contact channels.
Skills
- Value the work and understand its importance.
- Communicate and present confidently.
- Engage management and employees.
- Prepare logically structured and well-written material.
- Explain data protection obligations and responsibility.
- Develop and implement a data protection strategy.
- Prepare practical internal guidance.
- Conduct impact assessments, identify risks and plan mitigation.
- Apply data protection by default and by design.
- Manage and coordinate data protection processes and projects.
- Identify and document processing operations and personal data breaches.
- Distinguish breaches requiring notification to the authority and affected individuals.
Who must be notified and how?
Appointments must be notified to the Inspectorate. The company registration portal provides a convenient method. A separate written notification is unnecessary if the appointment is recorded there.
The portal also makes the information public, fulfilling the public notification requirement.
A person authorised to represent the company can submit the DPO's first and last name and personal identification code or date of birth.
See the Inspectorate's guidance: How to submit DPO details in the company portal.
What are personal data?
Personal data are any information relating to an identified or identifiable natural person.
A person may be identified directly or indirectly through a name, identification number, location, online identifier, or physical, physiological, genetic, mental, economic, cultural or social characteristics.
Any data that can be linked even indirectly to a particular individual may therefore be personal data.
Where can you find the rules?
The EU framework is Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), concerning protection of individuals and the free movement of personal data.
It applies directly throughout Member States, without requiring national transposition. National law addresses matters the regulation leaves open or permits Member States to specify.
The GDPR introduced the data protection officer role. Estonian legislation uses the term “andmekaitsespetsialist”.
Conclusion
- Assess whether your business needs a DPO.
- If it does, select a suitable person and arrange any necessary training.
- Specify and record their responsibilities within the company.
Magilex can assist with these steps and provides data protection advice and DPO services.