
The General Data Protection Regulation (GDPR) has revolutionized organizational data privacy practices with the introduction of the Data Protection Officer (DPO) role. Recognized as a crucial element for privacy management, the GDPR mandates the involvement of the DPO in all aspects of personal data protection. This key position underscores the pivotal role of the DPO in guiding and shaping an organization's data privacy strategies.

Under the GDPR, it is incumbent upon organizations to provide the DPO with the necessary resources and access to data and operations. This support is essential for the DPO to effectively oversee and influence the organization’s data protection policies and procedures.

In this discussion, we delve into the DPO's position within the GDPR framework, examining their responsibilities, the importance of their role in ensuring compliance, and the fundamental need for their operational independence.

## The DPO has to be involved in all issues related to personal data

One of the foundational aspects of the Data Protection Officer's (DPO) role is their mandatory involvement in all matters pertaining to personal data within an organization. This requirement ensures that the expertise and guidance of the DPO are integral to the organization's data handling processes. 

The DPO's involvement spans the entire spectrum of data processing activities. From the initial stages of data collection to the final phases of data deletion or archiving. This ensures that all aspects of data handling are scrutinized and aligned with GDPR requirements. At the outset of data collection, the DPO advises on the legality, transparency, and fairness of the data collection methods. They ensure that the principles of data minimization and purpose limitation are adhered to, preventing the unnecessary accumulation of data and clarifying the purposes for which the data is collected.


## The DPO receives necessary ressource 

The GDPR mandates that organizations must equip their DPO with the necessary resources, including access to personal data and processing operations. This requirement goes beyond mere logistical supportas it also encompasses various forms of assistance that enable the DPO to perform their role comprehensively.

Access to data and processing operations is fundamental for the DPO to gain a thorough understanding of how data is handled within the organization. This access allows the DPO to provide informed advice, conduct accurate compliance monitoring, and effectively manage data protection risks.

Equally important is the provision of tools and personnel. The DPO may require specific software to monitor compliance or personnel support for extensive data protection initiatives. Ensuring that the DPO has these resources at their disposal is vital for the efficient execution of their duties.

Another crucial resource is the opportunity for the DPO to maintain and update their expert knowledge. This includes ongoing training, attending relevant data protection seminars, and staying abreast of the latest developments in data protection laws and practices. 

The allocation of resources to the DPO has a direct impact on their effectiveness and, by extension, on the organization's data protection posture. Without adequate support, a DPO's ability to ensure GDPR compliance and safeguard personal data can be significantly hindered. On the other hand, well-resourced DPOs can proactively address data protection challenges, guide the organization effectively through the complexities of GDPR, and foster a culture of data privacy and security.


## No Instructions: Upholding the DPO's Independence

A cornerstone of the Data Protection Officer's (DPO) role within the GDPR framework is their operational independence. Organizations must ensure that the DPO does not receive any instructions regarding the execution of their tasks. This independence is crucial for allowing the DPO to perform their duties without any conflict of interest or undue influence.

The provision that the DPO should not receive instructions about their tasks underlines the need for unbiased decision-making in data protection matters. This autonomy allows the DPO to objectively assess the organization’s data processing activities and provide impartial advice and recommendations. It ensures that their judgment is not swayed by organizational biases or pressures.

The GDPR explicitly protects the DPO from being dismissed or penalized for performing their tasks. This safeguard is critical in allowing the DPO to enforce data protection regulations without fear of repercussions, particularly in situations where they may need to challenge the organization's practices or bring attention to areas of non-compliance.

Another key aspect of the DPO’s independence is their direct reporting line to the highest management level within the organization, be it the controller or the processor. This reporting structure emphasizes the significance of the DPO’s role and ensures that their insights and recommendations are given due consideration. It places the DPO in a strategic position to influence decision-making and reinforces their authority within the organization.


## Handeling data subject requests


A significant aspect of the Data Protection Officer’s (DPO) role under the GDPR is to be the point of contact for data subjects concerning the processing of their personal data and the exercise of their rights. This responsibility underscores the DPO’s role in bridging the gap between the organization and the individuals whose data it processes.

The GDPR grants individuals various rights regarding their personal data, such as the right to access, rectification, erasure, and data portability. The DPO plays a crucial role in facilitating the exercise of these rights. They are responsible for ensuring that data subjects can easily contact them and receive timely and appropriate responses to their queries or concerns.

The DPO handles inquiries from data subjects about data processing practices and responds to requests for exercising their rights under the GDPR. This involves coordinating with relevant departments within the organization to gather the necessary information or to take action on the requests.

In dealing with data subject requests, the DPO ensures that the organization's responses comply with GDPR requirements. This includes adhering to response timeframes, ensuring the clarity and accessibility of information provided, and maintaining the confidentiality and security of personal data during the process.

Some data subject requests may be complex, involving nuanced interpretations of data protection laws. The DPO provides expertise in these situations, advising on the legal obligations and best practices for handling such requests.


## DPO's work is subject to confidentiality 




## DPO might do other tasks, as long as no conflict of interests 





## Details of article 38 

> Article 38 Position of the data protection officer
> 1.   The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
> 2.   The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.
> 3.   The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.
> 4.   Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.
> 5.   The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law.
> 6.   The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.





Position of the data protection officer (DPO) in the GDPR


The GDPR brought significant changes to the way personal data is handled and protected in organizations across the European Union and all around the world. In this regulatory framework, the Data Protection Officer (DPO) plays a crucial role ensuring compliance work. But the DPO is not the controller, and carries no liability for his work. He acts independently to inform and advise the controller, monitoring compliance, conducting training and awareness programs, and providing guidance on Data Protection Impact Assessments (DPIAs). The DPO's responsibilities are comprehensive and multifaceted. Understanding these tasks in detail is essential for appreciating the critical role DPOs play in navigating the complex landscape of data protection today.


## Core Tasks of the Data Protection Officer

The Data Protection Officer has a set of five core tasks that needs to be conducted : informing and advising, monitoring compliance, training and awareness, and advising on Data Protection Impact Assessments (DPIAs).

The DPO's primary role involves educating and guiding the organization and its employees about their obligations under the GDPR and other data protection laws. This responsibility extends beyond merely disseminating information; it requires a deep understanding of legal requirements and the ability to apply data protection laws to various organizational operations. The DPO provides tailored guidance to ensure compliance with the GDPR, taking into account the unique data processing activities and sectoral requirements of each organization. They proactively anticipate potential data protection issues and offer advice to manage compliance effectively.

Monitoring compliance forms another critical aspect of the DPO’s role. This task is multifaceted, encompassing the understanding of the legal framework and its practical implementation. The DPO conducts regular compliance audits, identifying areas for improvement, and evaluates the effectiveness of data protection policies and procedures, recommending necessary enhancements. Risk assessment also forms a key part of this role, involving the evaluation of risks associated with data processing activities and the development of strategies to mitigate these risks.

A significant responsibility of the DPO is fostering a culture of data protection within the organization. This involves developing and implementing training programs tailored to different departments and levels within the organization. The DPO also focuses on raising general awareness about data protection issues across the organization and ensures ongoing education to keep staff's knowledge current and relevant in the face of evolving data protection regulations and technologies.

The DPO also plays an instrumental role in the DPIA process. DPIAs, mandated by the GDPR for certain data processing operations, assess the potential risks to individuals' rights and freedoms. The DPO advises when DPIAs are required and oversees their implementation, ensuring they are conducted correctly and effectively. Additionally, they interpret the results of DPIAs and advise on necessary actions to mitigate any identified risks.


## Practical example of the DPO's day to day tasks

Let's take a practical exemple from a DPO in a healthcare organization. His day to day job might be to develop comprehensive GDPR training modules for staff, specifically tailored to scenarios in healthcare data handling. This could include creating a quick-reference guide for employees on data protection dos and don'ts. In an e-commerce company, the DPO would conduct regular data processing audits, ensuring that customer data is handled in compliance with GDPR, reviewing data storage practices, consent forms, and data sharing policies. In an educational institution, organizing workshops and interactive sessions to educate the staff about data protection, focusing on student data privacy, can be a crucial initiative. In a tech company, leading a DPIA for a new data analytics project, assessing the risks associated with customer data processing, and advising on mitigation measures could be a key responsibility.

One major challenge for DPOs is keeping up with legal changes in data protection. Attending conferences, webinars, and participating in professional networks is important to stay informed. Balancing transparency with confidentiality is another challenge; maintaining regular communication and fostering an open dialogue about data protection can help in this regard. Resource limitation, especially in smaller organizations, can be addressed by leveraging online resources, tools, and external consultancy for specific tasks. Engaging effectively with stakeholders is also crucial. Building a rapport with different departments and ensuring their cooperation through regular meetings, updates, and involving them in data protection discussions can enhance collaboration.


### The Impact of the DPO's Tasks on GDPR Compliance

The DPO's role in informing and advising the organization is fundamental to ensuring that all levels of the organization understand and comply with GDPR requirements. By providing tailored guidance and proactive advice, the DPO helps prevent potential data breaches and ensures that data processing activities are aligned with legal standards.

Monitoring compliance is another vital aspect of the DPO's role. Regular audits and assessments conducted by the DPO not only ensure ongoing compliance with the GDPR but also help identify areas where improvements are needed. This continuous oversight is essential for maintaining a high standard of data protection.

Training and awareness initiatives led by the DPO play a significant role in embedding a culture of data protection within the organization. These initiatives ensure that staff at all levels are aware of their responsibilities regarding data handling, thus reducing the risk of data breaches and enhancing the overall security posture of the organization.

Finally, the DPO's involvement in DPIAs is crucial for assessing and mitigating risks associated with data processing activities. Through DPIAs, the DPO helps the organization identify potential impacts on data privacy and advises on how to address these issues effectively, further reinforcing GDPR compliance.

## Collaboration and Reporting: The DPO’s Interaction with Management and Authorities

Effective liaison with top management is crucial for the Data Protection Officer. This involves not only reporting on the organization's data protection status and compliance but also providing strategic advice on data protection matters that could impact the organization's decision-making and policies. The DPO's insights can guide the management in understanding the implications of data processing activities and in making informed decisions that align with GDPR requirements.

Interacting with data protection authorities is another key aspect of the DPO's role. The DPO acts as the primary contact point for these authorities, facilitating inspections, audits, and inquiries. This requires the DPO to be well-versed in the organization's data processing activities and to be able to represent and defend the organization's data protection practices.

The independence and authority of the DPO are essential for the effective execution of these tasks. The DPO must have the freedom to perform their duties without undue influence from the organization and the authority to access all necessary information and resources. This independence ensures that the DPO can provide unbiased advice and make recommendations that are in the best interest of data protection compliance.


## Conclusion

The Data Protection Officer (DPO) plays an indispensable role in upholding data protection standards within an organization. Their tasks, ranging from informing and advising on GDPR compliance, monitoring organizational adherence to data protection laws, conducting training and awareness programs, to overseeing Data Protection Impact Assessments (DPIAs), are essential if organizations want to avoid fines.

The DPO's responsibilities are not just procedural; they are integral to embedding a culture of data privacy and protection throughout the organization. By ensuring that GDPR principles are consistently applied and understood, the DPO not only helps safeguard personal data but also enhances the organization’s credibility and trustworthiness in handling such sensitive information.


## Details of article 39

>Article 39 -Tasks of the data protection officer
> 1.   The data protection officer shall have at least the following tasks:
>(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
> (b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
> (c ) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
> (d) to cooperate with the supervisory authority;
> (e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
> 2.   The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.



The Data Protection Officer (DPO) has a specific set of tasks given by the GDPR : nforming and advising, monitoring compliance, training and awareness, and advising on Data Protection Impact Assessments (DPIAs).

Tasks of the data protection officer


It's very important to understand the difference between a Data Protection Officer and all other titles such as Data Privacy Officer, compliance officer, GDPR compliance officer, and for one reason : **only the Data Protection Officer (DPO) is regulated by the GDPR**. In practical terms this means, the DPO has specific tasks he needs to conduct, specific position and specific protection in regard to his liability. 

And that's not the case with all the other titles.

In an organization, someone might be responsible for GDPR compliance without being a DPO, and provided the organization doesn't have to designate a DPO, that's perfectly fine. The Data Protection Officer, however, is appointed through a procedure outlined in the GDPR, which involves distinct responsibilities such as monitoring adherence to the regulation, providing advice on data protection impact assessments, and overseeing their execution.

So in order to determine if your organization needs to appoint a DPO, or if it would be beneficial, let's look at the cases where a DPO is mandatory.

## Is a GDPR DPO Mandatory?

Organizations are required to ensure compliance with the GDPR, and for sure, this necessitates having at least one person responsible for this task (a "lead" or "mission officer" for the GDPR). 

Yet, the appointment of a GDPR DPO is mandatory only in three scenarios (Art. 37):

- If the organization is a public authority or body;
- If the organization conducts large-scale, systematic monitoring of individuals;
- If the organization's core activities involve large-scale processing of sensitive GDPR data (Art. 9 and 10), such as health data.

Outside of these cases, appointing a DPO remains optional. 


## Is It Advisable to Appoint a DPO?

It is absolutely essential to have someone within the organization who is trained, and whose mission is to ensures the obligations imposed by the GDPR are being met. 

The DPO can partially play this role, or it can also be a person who has undergone GDPR training to ensure that the organization complies with data protection regulations.

In cases where the desgination of a DPO is mandatory the situation is simple : the organization will have to appoint a DPO. However do not expect the DPO to handle the GDPR compliance of the organization, that's not his role at all! Yes, this adds to the confusion of the reality of the role of the DPO, but there's a fundamental segmentation of responsibilities : the DPO is not the controller, and he is independant from him. Therefore it's not his role to ensure the compliance of the organization, that's the controller role! Do not confuse that. Let's look at article 38.7:

> Art. 38.3 The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalized by the controller or the processor for performing his tasks. 

The role of the controller is defined in article 4 : 

> ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data

Therefore, the controller has to handle its own GDPR compliance, independently from the DPO, as he will be the one liable for it. 

An easy way to understand the position of the DPO is to see him as an employee of the national control authority, but paid by the controller. The DPO is independent from the controller, gives feedback about the level of compliance, does not organizes the overall GDPR compliance of the organization, but helps reviewing the work and provides independant opinion in that regard. 

Beyond the 3 cases where the organization has to appoint a DPO, it's designation through the procedure outlined in the GDPR is to the choice of the controller. Can it be beneficial ? Sure. In particular in very large organizations (fortune 500, CAC40...) where a legal team is in charge of compliance, and the DPO will offer indenpendant assessement of the work and quality control.

## Two important requirements for the DPO

If the organization decides to appoint a DPO, two important requirements will need to be met (Art. 37.5), specifically: 

- Knowledge of data protection law and practices
- Ability to fulfill their responsibilities

Fortunately [a full DPO training is already included in Legiscope](https://www.legiscope.com) so there are no additional costs for organizations that choose our software ; our training has been delivered to a significant number of DPO of CAC40 companies and is very highly rated. 

## How is the GDPR DPO Appointed?

If an organization wishes to appoint a DPO in accordance with GDPR requirements, it must designate this individual directly to the national supervisory authority - in France, for example, [the CNIL](https://www.cnil.fr), who has an online procedure.

Alternatively, if an organization simply wants someone to handle these matters without formal DPO designation, no procedure is required beyond ensuring that their responsibilities are included in the job description of the employee or in the service contract with the chosen provider.

## Can the DPO be an External Party, or Must They Be Internal?

The DPO can be either an internal employee or an external service provider. Article 37.6 of the GDPR specifically allows for this:

> 6. The data protection officer may be a staff member of the data controller or processor, or fulfill their tasks on the basis of a service contract.





Explore the unique role of a GDPR-regulated Data Protection Officer (DPO) and how it differs from titles like Data Privacy Officer. Learn about the DPO's exclusive responsibilities, appointment process, and their pivotal role in ensuring GDPR compliance.

DPO or compliance officer ?


The General Data Protection Regulation (GDPR), has reshaped the landscape of data privacy. At its core, the regulation aims to empower individuals regarding their personal data while placing stringent obligations on organizations that process this data. Central to these obligations is **the designation of a Data Protection Officer (DPO)** whose mission is key to ensuring the organisation meets the legal requirements.

Correctly [designating a DPO (or a compliance manager)](https://www.legiscope.com/blog/dpo-or-compliance-officer) is an important decision that can significantly impact an organization's compliance. The DPO must possess a blend of legal expertise, knowledge of data processing operations, and an understanding of the organization’s structure and technology.

We will explore in depth the process of designating a DPO and what impact it can have for organizations.

## A DPO is mandatory in three cases

A Data Protection Officer is mandatory in only three cases, defined by article 37. First, **for public authorities or bodies**, encompassing government and state organizations, and any other entities governed by public law. Second, **organizations that engage in large-scale systematic monitoring of individuals**, such as through online behavior tracking. And third, any **organization that processes sensitive data on a large scale**, including categories like racial or ethnic origin, political opinions, religious beliefs, biometric data for identification, and health information, as specified in Article 9 of the GDPR.

Besides these mandatory scenarios, appointing a DPO can be advisable for several types of organizations. Large corporations and enterprises, particularly those handling significant amounts of personal data, whether of customers, employees, or other stakeholders, can benefit from the designation. The role is equally crucial for healthcare providers and insurers due to the sensitive nature of health data they manage. Educational institutions like schools, universities, and online education platforms, which often process vast amounts of student data, are also advised to appoint a DPO. Similarly, tech companies and data-driven businesses, whose operations heavily rely on data processing and analytics, as well as financial institutions and banks that deal with sensitive and voluminous financial data, should consider appointing a DPO.

Small and medium-sized enterprises (SMEs) may not always fall under the mandatory requirement to appoint a DPO, but they could find it beneficial, especially if they operate in a data-intensive sector or handle sensitive data as defined in Article 9 of the GDPR.

## The Designation Process 

To understand if organizations need to appoint a DPO, the first step is to assess the data processing activities conducted and understand if the organization is in one of the casees where designation is mandatory. This involves analyzing the scale, scope, and nature of data being processed. If the processing is likely to result in a risk to the rights and freedoms of individuals, particularly if it involves special categories of data, the appointment of a DPO becomes essential. 

Once the need for a DPO is established (or not), the next step is to define the role and responsibilities. This includes outlining the DPO's tasks, such as monitoring compliance, advising on data protection impact assessments, providing training, and being the point of contact for supervisory authorities and data subjects.

Selecting the right candidate for the DPO role is important. The GDPR specifies that the DPO should have **expert knowledge of data protection law and practices**. This could be someone from within the organization or an external appointee. The key is to ensure that the DPO has the necessary expertise, resources, and independence to perform their duties effectively.

After selecting the candidate, the next step is to formalize the appointment. This involves drafting a formal job description, specifying the DPO's duties, reporting lines, and the scope of their authority. It's important to ensure that the DPO is involved in all issues which relate to the protection of personal data.

Organizations are required to notify their supervisory authority of the DPO’s appointment, so this procedure has to be done, for example in France the procedure is [usually done online on the CNIL's website](https://www.cnil.fr).

Finally, the DPO needs to be properly embedded within the organization. This means ensuring they have access to senior management, are involved in early discussions about data processing activities, and have the necessary resources and independence to perform their role effectively. The DPO will [need legal training in GDPR compliance](https://www.legiscope.com) to be able to complete his mission, which is included already in Legiscope.


## Choosing Between an Internal or External DPO


Once an organization recognizes the need for a Data Protection Officer (DPO), a pivotal decision arises: should the DPO be an internal or an external appointee? This decision carries its own set of advantages and disadvantages.

**Appointing an Internal Employee as a DPO** brings several benefits. An internal DPO has an in-depth knowledge of the organization's data processing activities, culture, and internal dynamics. Being part of the organization, they can easily communicate and coordinate with different departments, which facilitates collaboration. Additionally, for smaller organizations, this option is often more cost-effective than hiring an external DPO. However, challenges include potential conflicts of interest, especially if they hold other roles within the organization. Their perspective might be limited, missing the external viewpoint that can be valuable in identifying and mitigating risks. Moreover, smaller organizations might not have an employee with the necessary expertise to take on the DPO role.

On the other hand, **Hiring an External DPO** offers expertise and experience in data protection law, bringing a wealth of experience from working with various organizations. An external DPO provides an objective perspective on data protection issues and offers flexibility, beneficial for organizations with fluctuating data protection needs. However, this option typically incurs higher costs and presents challenges in terms of familiarity with the organization and integration into its processes and culture.

Regardless of the choice, an internal DPO must be positioned to operate independently, without fear of conflict. For external DPOs, contractual terms must ensure they have sufficient access to the organization’s data processing operations and autonomy to perform their duties effectively. In both scenarios, the DPO must have the necessary authority, resources, and expertise to oversee the organization's data protection policies, conduct training, and serve as the point of contact for supervisory authorities and individuals whose data is processed.

Ultimately, the decision between an internal and external DPO should be guided by the organization's specific needs, size, and data processing activities. The goal is to ensure that the DPO can effectively help the organization comply with GDPR requirements, mitigate risks, and foster a culture of data protection.

## Qualifications and Qualities of an Effective DPO

A DPO must possess a strong understanding of data protection laws, including the GDPR and other related regulations, which is fundamental for interpreting and applying these laws to the organization's specific context. They should also be familiar with IT processes, data security, and data processing operations. While they might not be a technical expert, understanding the technological aspects of data protection is essential. Additionally, risk management skills are crucial for identifying and assessing data protection risks and implementing strategies to mitigate these risks. Excellent communication skills are also essential for a DPO, as they need to effectively articulate data protection issues and requirements to stakeholders at all levels of the organization.

The DPO should be adept at problem-solving, identifying issues, and finding practical solutions in the context of data protection. Diplomacy and negotiation skills are also crucial for managing relationships with regulators, data subjects, and within the organization. Given the nature of their work, DPOs must adhere to high ethical standards, ensuring unbiased and fair treatment of all data processing activities. The field of data protection is ever-evolving, and the DPO needs to be adaptable and proactive in response to these changes.

Data protection laws and technologies are constantly evolving. Therefore, ongoing education and training are important for a DPO to remain effective. Regular updates on legal developments, technological advancements, and best practices in data protection are essential components of the DPO’s professional development. This not only ensures compliance with current regulations but also prepares the organization to adapt to future changes in the data protection landscape.

Organizations should invest in their DPO's continuous learning, providing opportunities for attending workshops, conferences, and training courses. This commitment to ongoing education reflects an organization's dedication to robust data protection and GDPR compliance.



## Challenges in Designating a DPO

The process of finding the right DPO involves several challenges. First, there's the need to find a candidate with the right blend of knowledge in data protection laws, technical understanding, and familiarity with the organization's sector. For smaller organizations, balancing budget constraints with the need for a qualified DPO poses a significant challenge. Misinterpreting the scope of the DPO's role is another common issue, leading to either an underutilized or an overwhelmed DPO. Additionally, cultural resistance within the organization can occur, particularly if the introduction of the DPO role implies significant changes in processes or operations.

It's important to clearly define the DPO's role, ensuring it is separate from other business functions that could lead to conflicts of interest, such as IT management or human resources. The DPO should have the authority to make independent decisions and recommendations without undue influence from other organizational units.

The DPO should be positioned high enough in the organization to have necessary visibility and authority. Direct access to senior management is crucial, as is providing the DPO with adequate resources, including access to other departments, a budget for ongoing training, and staff if necessary. Support from leadership is vital for establishing the DPO's authority and independence.

To overcome cultural and organizational barriers, it's important to conduct organization-wide awareness programs about the importance of data protection and the role of the DPO. An inclusive approach that involves various departments in the process of data protection and interactions with the DPO can foster a culture of compliance and transparency. Implementing a system for the DPO to regularly report on compliance status and challenges ensures continuous engagement with senior management.

## Conclusion

The process of designating a Data Protection Officer is significant and plays an important role in an organization's GDPR compliance journey. 
The right DPO can not only ensure compliance with complex data protection regulations but can also steer the organization towards a culture of data privacy and protection, which will benefit the company's overall growth, as it limits IT security incidents and globally create trusts in IT systems and processes the company operates.


## Detail of article 37

> 1.   The controller and the processor shall designate a data protection officer in any case where:
> (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
> (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
> (c ) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
> 2. A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment.
> 3. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size.
> 4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors.
> 5. The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
> 6. The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.
> 7. The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.













Designation of the data protection officer (DPO)


It is important to ensure GDPR compliance when collecting personal data, as numerous sanctions have been imposed in this regard (see 14 GDPR Sanctions You Must Know). However, it is quite easy to implement minimal rules and avoid the risk of a fine.

In most cases, collecting data through a questionnaire, form, or web survey will trigger the application of the GDPR due to the use of the user's IP address (which is considered a personal data under the GDPR).

Therefore, there are certain important obligations to implement to ensure compliance (I). We will then see some practical examples (II).

## I. - Key Obligations to Comply With

There are a number of important obligations to comply with: adding the processing activity to the registry, minimizing collected data, and displaying GDPR information notices.

### Step 1: Add the Processing Activity to the Registry

As soon as an organization sets up an activity that processes personal data (under the GDPR = any data that allows the identification of individuals, directly or indirectly), the organization must reference this activity in a registry.

Note, __the data processed is not referenced, but the activity itself (e.g., conducting customer satisfaction surveys)__. The reason for this is that it then allows for knowing where the personal data processed by the organization are and subsequently verifying their compliance (e.g., their security, the periods during which the data are processed, etc).

Typically, a [GDPR compliance management software](https://www.legiscope.com) is used for this - and for the example of [Legiscope](https://www.legiscope.com), the software already offers a series of pre-written and GDPR-compliant standard data collection and processing activities; so one can simply import this type of processing into the registry:

<img src="/img/questionnaire.png" />

Once the activity is imported, it will be automatically added to the registry and the description of the processing activity will be compliant with the [requirements of Article 30 for the creation of the registry](https://www.donneespersonnelles.fr/registre-rgpd).

Indeed, the organization must detail:

* a) the name and contact details of the data controller and, where applicable, the joint controller, the representative of the data controller, and the data protection officer; 
* b) the purposes of the processing;
* a description of the categories of data subjects and the categories of personal data;
* the categories of recipients;
* transfers of personal data;
* the envisaged time limits for the erasure of the different categories of data;
* a general description of the technical and organizational security measures

It is possible to write this documentation manually, but the task is laborious for each treatment [and here](https://www.legiscope.com), the drafting has been pre-performed entirely:

<img src="/img/questionnaire-detail.png" />

Once the activity is added to the registry, it is then necessary to minimize the collected data.

### Step 2: Minimize Collected Data

The GDPR requires the collection of the minimum amount of data from the data subjects (Art. 5):

> adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimization)

Therefore, it is necessary to reflect on the questions asked and ensure that they are adequate in relation to the objectives of the processing.

For example, **for a company operating a home cleaning service**:

* the quality of the cleaning: rating from 1 to 10
* the punctuality of the person: rating from 1 to 10
* the politeness of the person: rating from 1 to 10
* the name of the client or their identifier

These data are indeed objectively necessary for evaluating the service. Note that the data here are well minimized by using a rating from 1 to 10 and carefully avoiding a free text field which would open the possibility for clients to enter all sorts of data (comments unrelated to the work performed).

This is an important element of implementation.


### Step 3: Display GDPR Information Notices

GDPR information notices are also important to display to the user, as this is part of the transparency obligations that organizations have when collecting personal data - [the french CNIL has very detailed prescriptions in this regard](https://www.cnil.fr/fr/conformite-rgpd-information-des-personnes-et-transparence).

To simplify things, it is necessary to clearly inform the user about what is done with their data, the reason for collecting it, and a series of other information such as the duration for which the data will be retained.

Legal notices can be generated automatically using GDPR compliance management software or drafted manually.



### Step 4: Is Consent Necessary?

It is not necessarily required to obtain the consent of individuals whose data is processed if the questionnaire is part of a service provided by the organization.

Indeed, [what the GDPR requires is to have a legal basis](https://www.donneespersonnelles.fr/article_6-rgpd). Consent is one legal basis, but it is not the only one!

Article 6 of the GDPR provides 6 legal bases that authorize the collection of personal data:

* The consent of the individuals
* The contract, or pre-contractual measures
* A legal obligation
* The protection of vital interests of a person
* Public interest / public authority
* The legitimate interests of the data controller

In this respect, it is perfectly conceivable for the evaluation of a service, to rely on the "contractual" legal basis. That being said, beyond a service provided, consent will be the most appropriate legal basis for any general questionnaire (see here [how to collect valid consent under the GDPR](https://www.donneespersonnelles.fr/consentement-rgpd-valable))


## II. - Practical Example

To conclude, here is a practical example of a GDPR-compliant service evaluation questionnaire:

<img src="/img/exemple-questionnaire-rgpd.png" />






How to design a questionnaire that is compliant with the GDPR and ensures data collection in accordance with the law

How to Create a GDPR Compliant Questionnaire (Surveys, Satisfaction Inquiries, etc.)


GDPR information notices are among the mandatory mentions that are important to comply with. Indeed, they will demonstrate whether an organization is in compliance or not with the European regulation.

We will see the list of information to be provided before looking at a practical example.

## I - The List of Information to Provide to be Compliant with the GDPR

The information to be provided to individuals whose personal data is being collected are as follows:

- The identity and contact details of the data controller and, where applicable, the data controller's representative.
- Where applicable, the contact details of the data protection officer;
- The purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
- Where the processing is based on Article 6(1)(f), the legitimate interests pursued by the data controller or by a third party;
- The recipients or categories of recipients of the personal data, if any;
- Where applicable, the fact that the data controller intends to transfer personal data to a third country or international organization, and the existence or absence of an adequacy decision by the Commission, or, in the case of transfers referred to in Article 46 or 47, or Article 49(1) second paragraph, the reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

Additionally, the following supplementary information:

- The duration for which the personal data will be stored, or if that is not possible, the criteria used to determine that duration;
- The existence of the right to request from the data controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject, or to object to processing as well as the right to data portability;
- Where processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- The right to lodge a complaint with a supervisory authority;
- Information as to whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the personal data, and the possible consequences of failure to provide such data;
- The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Note that the data controller is not required to provide these information if a person has already been informed once.

## II - A Practical Example of GDPR Notices

Here is a practical example of an information notice:

> Registration allows you to download the guide and receive communications on GDPR compliance as well as our product and service offers; the legal basis is Article 6.1.a of the European regulation on the protection of personal data (consent); the recipients of data are the data controller, its internal services in charge of the mailing list management, the subcontractor operating the web server management (Dupond Durand), as well as any legally authorized person to access the data (judicial services, if applicable). The duration of data processing is limited to the time you are registered for our communication services, it being understood that you can withdraw your consent and unsubscribe at any time by clicking on the unsubscribe link at the bottom of each email. The server on which the mailing list is hosted is hosted by Durand Durand, which implies that your data may be transferred outside the EU under Article 46.2.d of the GDPR – Durand Durand having provided the adequate protection clauses on the model established and approved by the European Commission. You can find more information about these clauses here: https://durand.durand. You have the right to request the data controller access to personal data, rectification or erasure of such data, or a limitation of the processing concerning the data subject, or the right to object to the processing and the right to data portability. The data controller is SARL Dupont Dupont. You also have the right to lodge a complaint with a supervisory authority. Providing your email is necessary to receive the aforementioned communications and is entirely optional.





Here is the list of GDPR information notices that you must mandatorily provide before collecting personal data

GDPR Information notices, a few things you need to know


Article 28 of the GDPR is arguably one of the most important provisions in practical terms, as it imposes a series of practical obligations on data controllers (DC) in managing the processors (PR) who work with personal data.

The first mistake to avoid is to properly understand when Article 28 will apply, in simple terms: as soon as an organization gives a processor access to personal data it processes.

<u>Here are some practical examples:</u>

1. An organization uses HR software or a CRM hosted in SaaS mode (web platform) (the platform publisher will then be the PR).
2. An organization requests IT assistance from a company - with remote access to employees' computers (the IT company is then the PR).
3. A SaaS software publisher uses subcontractors - for example, for sending SMS messages - the PR will then be in relation with a sub-processor - Article 28 will also apply to the PR who must ensure that their sub-processor complies with the conditions imposed by the GDPR.

Here, the GDPR aims to regulate the entire personal data processing chain to ensure that the obligations imposed on the data controller follow the data at all times and provide adequate protection.

## I. - The Main Obligations Imposed by Article 28 (Summary)

If we analyze the details of Article 28 (see below), here are the main obligations it imposes:

* The data controller must exclusively use processors that provide sufficient guarantees.
* The processor cannot subcontract without the data controller's authorization.
* There must be a written contract between the data controller and the processor.
* The processor must delete all data at the end of the service.
* The processor can only act on the data on the instruction of the data controller.

Here is an [example of a standard contract between DC and PR that will give you a clear idea of what is required in legal terms](https://www.donneespersonnelles.fr/contrat-sous-traitance-rgpd); you can freely reuse this contract, which is offered to you (value €2,000)!

## II. - How to Comply with Article 28

To bring an organization into compliance, it is necessary to go through three steps that will allow for the inventory and evaluation of the compliance of the processors.


### A. - Understanding the Concepts of Controller and Processor

Firstly, ensure a good **understanding of the concepts of processors and controllers**, without which it will be difficult to qualify the relationships between each organization. Some subcontractors in the classical sense are not subcontractors in the GDPR sense.

If you use [Legiscope](https://www.legiscope.com), you already have access to comprehensive training modules on this topic (30 minutes) that allow you to master the relationships between DC and PR:

<div style="text-align:center"><a href="https://www.legiscope.com"><img src="/img/article-28.png" style="width:80%; margin-bottom:40px;"  /></a></div>

Alternatively, you can also read our article on [the concept of a GDPR processor](https://www.donneespersonnelles.fr/sous-traitant-rgpd) which goes into more detail on these points.

### B. - Inventorying All Processors

Next, it is necessary to conduct an inventory of all processors involved in data processing operations. For this, it is appropriate to list all the companies or organizations that will have access in one way or another to the personal data of the company.

This will then allow us to carry out a precise evaluation of the processor's compliance with each criterion imposed by the GDPR:

<div style="text-align:center"><a href="https://www.legiscope.com"><img src="/img/evaluation-article-28.png" style="width:80%; margin-bottom:40px;"  /></a></div>


### C. - Evaluating the Processors 

From there, three elements will appear: processors that are not compliant at all and from whom it will be necessary to separate; those who have undertaken compliance work that is still in progress - it is possible to keep them if the processing is not very sensitive. And finally, processors who have a good/very good level of compliance - and on whom the organization can rely.



## III - Article 28 in detail 

Article 28 Processor

1.   Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

2.   The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

3.   Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:

(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c ) takes all measures required pursuant to Article 32;

(d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;

(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;

(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;

(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;

(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

4.   Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.

5.   Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.

6.   Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43.

7.   The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2).

8.   A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.

9.   The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.

10.   Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.

Article 28 of the GDPR is a critical juncture for compliance, governing the relationship between data controllers and processors

Article 28 of the GDPR: Obligations Imposed on Processors


Commercial prospecting is undoubtedly one of the risk areas of the GDPR, where it is important to be rigorous to ensure compliance with the law. A company has just learned this the hard way, as the CNIL has recently issued a fine of €500,000 for non-compliance with the GDPR rules. It is worth noting that the company in question made about €500,000 in profits (in 2018), so the fine imposed by the CNIL will _a priori_ absorb the entire profits of the company for the year 2019.


<img src="img/prospection-commerciale-rgpd.png" class="border" style="border: 1px solid #ccc;">

Let's review the facts before discussing the points of non-compliance and the actions the company could have taken to avoid such a sanction. Note that our goal is not to point fingers but to enable other companies to learn from this case.

## The Facts

The case is interesting - although quite typical for anyone familiar with GDPR compliance: a company decides to conduct commercial prospecting by phone to sell its services (here, building insulation). To do this, it uses call centers based in North Africa. These subcontractors call prospects en masse but fail to record their objections to telemarketing. Inevitably, this triggers a complaint from a person who is subject to repeated telemarketing despite their objection (and the sending of a registered letter).

The CNIL then initiates an on-site inspection, which reveals a series of infractions:

- Numerous complaints from people being approached despite their objection
- Excessive comments about the company's clients - insults or remarks about their health status - in free text fields
- Recording of telephone conversations without the knowledge of the called individuals and without prior information

Following the inspection, the CNIL issued a formal notice to the company to comply, but the latter did not deem it necessary to follow the Commission's instructions. This proved to be a poor decision, as a sanction procedure was then initiated and carried through to completion.

There are four breaches here that are interesting to analyze and comment on.


## Error 1: Non-Compliance with Individuals' Opposition

The decision highlights the importance of respecting individuals' rights in risk-related processing. Commercial prospecting in B2C is generally perceived as a nuisance by individuals and, as such, must be strictly regulated from a legal perspective.

Here, we see that the company had not established GDPR compliance processes: a person who opposed commercial solicitation should not have been called again if these processes were in place. In fact, the lack of process in this type of treatment will inevitably generate litigation, because if the company grows, it is only a matter of time before someone takes offense and contacts the CNIL.

The actions the company should have taken were as follows:
- Ensure the existence of an opposition list.
- Conduct tests to verify the effectiveness of the list.
- Create fake profiles in its database that refer to internal personnel responsible for GDPR compliance, to ensure that in case of process failure, the flaw is quickly detected.

## Error 2: Collecting Excessive Data

Free text fields - particularly in CRM software - pose structural problems, as they allow operators who are in contact with the public to enter data without any limit. This generally results in the entry of excessive data, which is a disaster from a GDPR perspective. In fact, the issue is so significant that the CNIL systematically checks for the existence of free text fields during inspections and has developed internal software to detect excessive data.

It is legally possible to implement a free text field in software, but it is necessary to ensure that the subsequent data entered are adequate and relevant to the purposes in order to comply with Article 5 of the regulation. This implies a range of material measures ranging from the awareness of data entry operators to the regular extraction and verification of data.

The compliance actions for the company were as follows:
- Remove free text fields from the CRM software.
- Train a GDPR officer to ensure the regular compliance of entered data.

## Error 3: Transfers of Personal Data Outside the EU

Companies often think they are saving money by outsourcing commercial solicitation services to French-speaking countries outside the European Union - until the costs related to GDPR compliance are discussed.

Outsourcing outside the EU is possible, but it is often very costly to implement due to the complexity of the GDPR (note that the case of major Cloud operators, such as AWS, Google, or Microsoft, are special cases in this regard).

It is indeed necessary to both validate the legal framework of the transfer and also to visit the site to ensure the respect of GDPR obligations by the subcontractor on all implemented tools. For a process as risky as commercial prospecting, one should seriously consider the overall costs of such an operation and the risks of sanctions / damage to the company's brand image before embarking on such an operation.

The compliance actions for the company were as follows:
- Perform a real cost calculation for GDPR compliance of the call center and integrate the hidden costs of GDPR compliance.
- If necessary, repatriate activities within the EU.

## Error 4: Failure to Cooperate with the CNIL

While it was possible to gain the favor of the CNIL before the entry into force of the GDPR by cooperating with it in case of discovering an infraction, the margin for maneuver is now almost nil (see Art. 83).

In case of an inspection, it is therefore essential to ensure that all points raised by the CNIL are managed and addressed by GDPR compliance professionals. With sanctions exceeding 10 million euros for SMEs and 2% of the global turnover for groups, it is not possible to manage a formal notice - which will probably lead to a sanction - without responding to all of the Commission's observations.

Here, the company could probably have reduced its sanction to €250,000 if it had implemented adequate means to respond to each point raised by the Commission. But apparently, this was not the choice it made.

If you are subject to a formal notice, or an inspection, surround yourself with experts who have at least 10 years of experience in these matters!

[Link to the decision](https://www.cnil.fr/fr/futura-internationale-sanction-de-500-000-euros-pour-demarchage-telephonique-illegal)















The CNIL has just imposed a €500,000 fine on a company for conducting commercial prospecting without complying with the GDPR

GDPR and Outbound sales : €500,000 fines for non-compliance


The concept of 'legitimate interests' as a legal basis under the General Data Protection Regulation (GDPR) is often misunderstood and misapplied, leading to unnecessary legal risks. This is evident in cases such as the notable sanction against Facebook (now META), which faced a fine of 390 million euros for [improper application of legitimate interests European Court of Justice Decision] (HTTPS:/ /curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageindex=0&doclang=fr&mode=req&dir=&occ=first&part=1&cid=1652408).

To appropriately invoke legitimate interests under Article 6(1)(f) of the GDPR, it is imperative to conduct a thorough **triple test**. This test ensures the legality of processing activities under the specified legal basis and aims to prevent potential abuses, especially since obtaining explicit consent from data subjects is not required in this context.


## 1. Understanding "Legitimate Interests"

According to Article 6(1)(f) of the GDPR:

"The processing is lawful only if and to the extent that at least one of the following applies:
f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly where the data subject is a child."

These provisions allows data controllers to collect and process personal data without obtaining consent, provided they have a legitimate reason to do so. However, to prevent potential misuse, the GDPR adds additional requirements for invoking legitimate interests. These are encapsulated in the following triple test:

- Objective Test: Does the controller have a legitimate interest in processing the data?
- Necessity Test: Is the processing of data genuinely necessary for the stated purpose?
- Balance Test: Do the interests of the data subject outweigh the legitimate interest of the controller?

The French Data Protection Authority (CNIL) emphasizes that this legal basis is applicable to processing activities by private entities that do not significantly harm the rights and interests of the data subjects [CNIL Guidelines] (https://www.cnil.fr/fr/les-bées-legales/tert-legitime)



## 2. Practical Examples of Legitimate Interests under the GDPR

The GDPR provides specific instances where legitimate interests can be considered a valid legal basis for data processing. These examples, highlighted in Recitals 47, 48, and 49 of the GDPR, include:

- Fraud Prevention: A key area where legitimate interests are often invoked, highlighting the necessity of processing personal data to protect against fraudulent activities.
- Network and Information System Security: As elaborated in Recital 49, ensuring the security of network and information systems is a paramount concern. This involves processing personal data as strictly necessary to safeguard against accidental or unlawful events that compromise the integrity, availability, and confidentiality of stored or transmitted data.
- Commercial Prospecting: The use of personal data for business development and marketing purposes, within certain limits, can be justified under legitimate interests.

The [European Commission further clarifies](https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_fr#:~:text=Votre%20entreprise%2Forganisation%20a%20un,informations%20de%20vos%20systèmes%20informatiques) that legitimate interests may be applicable when processing occurs in the context of a customer relationship, for purposes such as marketing, fraud prevention, or ensuring the security of network and IT systems.

If we analyze Recital 49 of the GDPR, we observe that the processing carried out to ensure the security of information systems, based on legitimate interest, has been extensively mentioned: 'The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring the security of the network and information, that is, the ability of a network or an information system to withstand, at a given level of confidence, accidental events or illegal or malicious actions that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data, as well as the security of the related services offered or made accessible via these networks and systems, by public authorities, Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT), providers of networks and electronic communications services, and providers of technology and security services, constitutes a legitimate interest of the data controller concerned. This could involve, for example, preventing unauthorized access to electronic communication networks and the distribution of malicious code, stopping 'denial of service' attacks, and addressing damage to computer and electronic communication systems.


## 3. No Legitimate Interest for Public Authorities

It is important to remember that the legal basis of legitimate interests cannot be used by public authorities; Recital 47 explains why: "Considering that it is the responsibility of the legislator to provide by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to processing carried out by public authorities in the performance of their tasks."


### 4.1 Identifying the Interests of the Data Controller or a Third Party and Their Legitimacy

Firstly, it is necessary to clearly identify the interests and objectives of the data controller or third party under which the processing is operated. The following questions can be asked:

- Why is the processing being carried out?
- What benefits are expected from the processing?
- Who benefits from the processing?
- What would be the impact if the organization could not implement the processing?

Recital 47 is useful in this analysis: "The existence of a legitimate interest would need careful assessment, including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place." In the context of a business relationship, it is useful to consider the reasonable expectations of individuals regarding the processing of their data. For example, in a B2B context, it is reasonable for a customer of a company to expect to be contacted by email for a commercial proposal related to an ancillary service.

The [french CNIL indicates](https://www.cnil.fr/fr/les-bases-legales/interet-legitime)  that "the interest pursued by an entity can be presumed if the following 3 conditions are met:

- The interest is manifestly lawful in view of the law;
- It is determined clearly and precisely;
- It is real and present for the concerned entity, and not fictitious.


## 4.2 The Condition of Necessity

The organization must then ensure that the **processing is necessary** (see Art. 6: "the processing is necessary for the purposes of legitimate interests").

This condition can be broken down into two points:

On one hand, it is necessary to verify that the processing actually achieves the intended purpose, rather than serving other objectives. This condition often poses problems in cases where an organization claims to collect data for one purpose, while in reality, it uses the data for entirely different purposes. Attention must be paid to this as it represents a real and significant risk of deviation.
On the other hand, it is necessary to ensure that there is no less intrusive means of achieving the same objective than implementing the processing.
Therefore, the following questions can be asked:

- Will this processing actually help the organization achieve the initially stated objective?
- Is the processing proportionate to this objective?
- Is it possible to achieve the same objective without the processing?
- Is it possible to achieve the same objective by processing less data, or by processing the data in a less intrusive manner (also consider the principle of data minimization)?

The fundamental interests and rights of the data subject could, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing.

Generally, "necessary" means that the processing must be a targeted and proportionate means of achieving the stated objective. Again, the legal basis of legitimate interests cannot be relied upon if there is another reasonable and less intrusive means to achieve the same result.



### 4.3 The Balancing Condition

To understand the balancing test, we need to revisit Article 6. Indeed, the legitimate interests of the data controller (DC) may justify this legal basis "unless the interests or fundamental freedoms and rights of the data subject that require protection of personal data prevail."

Thus, a balance is established: the interests of the DC cannot override the interests, freedoms, or fundamental rights of the data subject.

Recital 47 adds further elements to the analysis of this balancing condition:

- "unless the interests or fundamental freedoms and rights of the data subject prevail, **taking into account the reasonable expectations of the data subjects based on their relationship with the controller**"
- "the existence of a legitimate interest should be subject to careful assessment, particularly **to determine whether a data subject can reasonably expect, at the time and in the context of the collection of personal data, that it may be processed for a particular purpose**"
- "The interests and fundamental rights of the data subject may, in particular, prevail over the interest of the data controller when personal data are processed **in circumstances where data subjects do not reasonably expect further processing**"

The reasonable expectations of the data subjects - [in English](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) "reasonable expectations of data subjects based on their relationship with the controller" - are thus essential elements to consider.

The CNIL [states that](https://www.cnil.fr/fr/les-bases-legales/interet-legitime) "the entity must therefore strike a balance, a weighing of the rights and interests at stake, and verify in this context that the interests (commercial, security of goods, fraud prevention, etc.) it pursues do not create an imbalance to the detriment of the rights and interests of the individuals whose data is processed." Then "the entity must first identify all kinds of consequences that its processing may have on the data subjects: on their privacy but also, more broadly, on all the rights and interests covered by the protection of personal data." Finally, "The entity must then take into account, in the weighting between its legitimate interest and the rights and interests of the persons, their 'reasonable expectations'."

A series of questions can be posed to clarify these aspects:

- **General Context of Processing**
    - Are there any Article 9 or 10 data involved?
    - Are these data likely to be considered particularly "private" or sensitive by the individuals?
    - Are data of children, minors, or vulnerable individuals being processed?
    - Are data related to the personal or professional capacity of individuals being processed?

- **Relationship with the Data Subjects**
    - Is there a relationship with the individual?
    - What is the nature of this relationship, and how have the data been used in the past?
    - Were the data collected directly from the individuals?
    - What information were they provided with?
    - How long ago were the data collected? Are there any technological or contextual changes since then that would affect expectations?

## 5. Key Texts

The aforementioned Article 6.

- Recital 47 "The legitimate interests of a data controller, including those of a data controller to whom personal data may be disclosed, or of a third party, may constitute a legal basis for processing, unless the interests or fundamental rights and freedoms of the data subject prevail, taking into account the reasonable expectations of the data subjects based on their relationship with the data controller. Such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the data controller in situations such as where the data subject is a client of the data controller or is in the service of the data controller. In any case, the existence of a legitimate interest should be subject to careful assessment, particularly to determine whether a data subject can reasonably expect, at the time and in the context of the collection of personal data, that it may be processed for a particular purpose. The interests and fundamental rights of the data subject may, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is the responsibility of the legislator to provide by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to processing carried out by public authorities in the performance of their tasks. The processing of personal data strictly necessary for fraud prevention purposes also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as being carried out for a legitimate interest."

- Recital 48 "Controllers that are part of a group of undertakings, or institutions affiliated with a central body, may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of personal data of clients or employees. The general principles for the transfer of personal data, within a group of undertakings, to an enterprise in a third country remain unaffected."

- Recital 49 "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e., the ability of a network or an information system to withstand, at a given level of security, accidental or unlawful events that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data, as well as the security of the related services offered or made accessible via these networks and systems, by public authorities, Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT), providers of networks and electronic communication services, and providers of technology and security services, constitutes a legitimate interest of the data controller concerned. This could involve, for example, preventing unauthorized access to electronic communication networks and the distribution of malicious code, and stopping 'denial of service' attacks and damage to computer and electronic communication systems."



A Comprehensive Guide to Using 'Legitimate Interests' as a Legal Basis under the GDPR, Including Challenges, Conditions, and Practical Examples

How to Conduct the Triple Test to Assess the Legitimate Interests of the Data Controller (GDPR)


Here the complete recorded presentation for the speach "GDPR & AML what can go wrong" :

<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/dcloDlNi554" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>



A general presentation General Data Protection Regulation (GDPR) within the context of AML (KYC) 

GDPR and AML, what can go wrong ?


The General Data Protection Regulation (GDPR) is a regulation in the European Union in the field of data protection. It replaces the Data Protection Directive 95/46/EC, which was introduced in 1995. The GDPR was adopted on April 14, 2018, and came into force on May 25, 2018. The GDPR regulates the handling of personal data by controllers and processors.


The regulation sets out strict rules about how personal data must be collected, used, and protected. It gives individuals the right to know what personal data is being collected about them, the right to have that data erased, and the right to object to its use.

The regulation applies to any company that processes the data of individuals in the EU, regardless of whether the company is based inside or outside the EU.

## 7 principles of GDPR 

The 7 principles of GDPR are:

1. Lawfulness, fairness and transparency
2. Purpose limitation
3. Data minimisation
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
7. Accountability


1. Lawfulness, fairness, and transparency

The law requires that data processing activities be carried out in a lawful, fair, and transparent manner. This means that individuals must be informed of the purposes for which their data will be used, and they must be given a chance to object to its use if they so choose.

2. Purpose limitation

The law restricts the use of personal data to the specific purpose(s) for which it was collected. This principle ensures that data is not used for any other purpose that the individual has not consented to.

3. Data minimization

The law requires that data be collected and processed only to the extent necessary to achieve the specific purpose for which it was collected. This principle helps to protect individuals from having their data used for purposes that they did not consent to, or that are not necessary for the purposes for which it was collected.

4. Accuracy

The law requires that personal data be accurate and up-to-date. This principle helps to ensure that individuals are not unfairly disadvantaged by incorrect or outdated data.

5. Storage limitation

The law requires that personal data be kept for no longer than is necessary for the purpose(s) for which it was collected. This principle helps to protect individuals from having their data stored for longer than is necessary, or from having it used for purposes that it was not collected for.

6. Integrity and confidentiality

The law requires that personal data be protected from unauthorized access, disclosure, or destruction. This principle helps to ensure that individuals’ data is safe and secure, and that their privacy is respected.

7. Accountability

The law requires that data controllers be held accountable for their compliance with the GDPR. This principle helps to ensure that individuals’ rights are respected and that data controllers are transparent in their handling of personal data.


## Fines 

Under the GDPR, fines for non-compliance can be up to 4% of a company’s global annual revenue or €20 million (whichever is greater). In addition, companies can be ordered to stop processing data, and ordered to delete data that has been processed unlawfully.

Some specific examples of cases where companies have been fined for GDPR violations include:

- Google was fined €50 million by the CNIL (the French data protection authority) in January 2019 for a lack of transparency, inadequate information, and lack of valid consent regarding the use of personal data for advertising purposes.

- In July 2019, the British Airways was fined £183 million (around $230 million) by the UK’s Information Commissioner’s Office (ICO) for a data breach that affected 500,000 customers.

- In December 2018, the Marriott International was fined €110 million (around $124 million) by the ICO for a data breach that affected 339 million customers.




The General Data Protection Regulation (GDPR) is one of the most important regulation in the European Union in the field of data protection

What is GDPR ?


The question of how to validly obtain consent under the GDPR generates a lot of discussions, yet it is often a simple problem to deal with. There are however important considerations that need to be assessed! First: **do you really need consent ?** This is an essential first step as consent is one of the six legal basis and it's not necessarily the one required in all cases (sometimes it needs to be avoided as it can be a GDPR violation to use consent when other legal basis are required). This verification is an essential starting point (I). Once we are sure consent is required from a legal perspective then only we can create a process that will capture the consent in regard to the conditions set by the GDPR (II).

<u>**Why a valid consent is essential**</u>

National control authorities do not hesitate to **erase all personal data collected without valid consent**. In multiple cases in 2018, the french CNIL requested the erasure of +14 million - and in another case - over 60 million of prospect's data that companies did not capture with valid consent. The economical damage can be very substantial. On another side, capturing legally valid consent is not a complex task.

## I. - Consent is not generic 

**The First mistake to avoid: organizations don't need consent all the time.** This is the first thing to clearly understand: consent is needed in a few cases only.

The legal obligation GDPR imposes is to have a *legal basis*. There is *six legal basis* that allows organizations to collect and process personal data. Consent is only one of them! So, let's take a look at some real-life examples.


<table class="table table-bordered table-striped">
  <thead >
    <tr>
      <th scope="col">Consent is needed</th>
      <th scope="col">Consent is not needed</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>Subscription to a newsletter</td>
      <td>When the law requires the collection of personal data, for example invoicing - as this is a legal obligation</td>
    </tr>
    <tr>
      <td>Download and receive a guide (ex: whitepaper...)</td>
      <td>In case of a sale, or a contract (e.g. online sales)</td>
    </tr>
    <tr>
      <td>More generally activities in which a person will see his personal data processed and in which the person can request anytime to stop the activity.</td>
      <td>For employment - recruitment, cv</td>
    </tr>
  </tbody>
</table>




### What is the legal basis ?

In reality, to be able to legally collect data relating to persons, the GDPR imposes one condition: the data controller has to have a legal basis. This means we have to have at least one of the following conditions as described in article 6:

- the subject has **given consent** to the processing of his data 
- the processing is **necessary for the performance of a contract** or to take steps before entering into a contract
- a **legal obligation** imposes the collection of personal data
- protection of **vital interests of the data subject** (someone is in a coma and can not give consent)
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- **legitimate interests pursued by the controller** or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data


### How to determine if the legal basis can be consent?

In practice, the need to request consent can be determined by eliminating other legal bases and as follows:

 does the law require you to collect personal data (e.g. in HR matters, like obligations existing related to retirement, in commercial matters for invoicing)? If so, then the legal basis is the legal obligation, and there is no need to ask for consent ;
- is the data collected from the perspective of a contractual relationship - for example, an e-commerce website? In this case, the legal basis is the execution of pre-contractual measures or the execution of a contract. Be careful, however, because only the data necessary for this contract can then legally be collected! For example, the subscription of a person to a newsletter following purchase will not enter the data needed for the contractual relationship, and therefore will be subject to consent ;
- are we in the two other specific cases of public interest / official authority vested in the controller or where vital interests of a data subject need to be protected (ex: a person arriving in a coma in a hospital in need of a transplant)
- Having evacuated most of the legal basis, the last question we can ask ourselves is: **can the person enter and exit the processing of his personal data at will**? If yes, we are in a typical case of consent. Otherwise, the legal basis of the legitimate interests of the data processor might apply.

Consent is frequently used in marketing - for example, to subscribe to a newsletter, where a person can start and stop the processing of his data at will (eg. the unsubscribe link).



## II. - You legally need consent? Here's how to get one!

If you are in a situation where you need consent, congratulations because it's quite an easy task to get one! Let's clarify one element first **a checkbox is not needed for consent**. It can be useful if an organization wants to ensure that the person stopped and thought about what he or she agreed on, and expressed clearly agreement. But it's not necessary. In reality, we need two essential elements. Let's look at the legal definition, given by article 4.

> ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

So to acquire consent, two elements must be there: a positive act by the person, and the person must be informed of what will be done with their data.

### First condition: you need a positive action from the person herself

For consent to be validly collected, a positive act by the person is first required. In clear terms, it means **the person herself needs to do an action to manifest he/she agrees** to the processing of his/hers personal data. 

<u>**Here are examples of valid actions**</u>

- a person clicks on a button
- a person checks a check box
- a person signs a contract
- a person says "yes I agree", or "agreed"

<u>**Here are examples of invalid actions**</u>
- someone else presses a button
- a checkbox is pre-checked
- the person did not add her email herself in a form
- the person stayed silent

In fact, this is a very old legal problem: can silence equals acceptance? In clear terms the question is, can a person be legally obliged to do something in the case she stayed silent? The GDPR answer is absolutely not (it would open to significant abuses otherwise)!

For consent to be valid, **the person must therefore perform a positive act themselves** - such as entering their personal data themselves in a collection form or clicking a button.

<u>**One action is enough**</u>

However, the GDPR does not necessarily require a set of multiple actions, like for example checking a checkbox AND then clicking on a button. A checkbox can be the manifestation of a positive act, **but it's not mandatory** and there are plenty of ways to get the user to make an action other than filling a checkbox. For example, a person who adds his email address himself in a form will perform a positive act, sufficient to meet the requirement of the GDPR.

What is important is that the action comes from the person himself. For instance, it would be unlawful to collect emails on forums and send commercial advertisements (no clear affirmative action from the person to agree to such processing).

### Second condition: the person must be informed

To get a valid consent, the GDPR has added other legal conditions that we can summarize as follows: the person whose data is processed must be clearly informed of what will be done with their data.

This is essential, otherwise, how could he/she consent to anything? From a legal point of view, the GDPR imposes several additional conditions, to ensure consent given is well informed:

- the data subject must express a **manifestation of free will, uncoerced and uninfluenced** (e.g. a person who is forced to give his consent does not consent validly; we typically find this type of situation in matters of labor law in which the employer can impose the processing of personal data - in such cases, consent cannot be used as a legal basis. It is however possible to ask for consent in matters of employment law, but it must be ensured that the choice of the person is truly free). Beware, therefore, of the balance of power that can block the acquisition of consent
- the **consent must be specific**: the data subject must consent to something specific, such as receiving a newsletter. It's not possible to ask to consent to "any processing of personal data" for example.
- the consent must be informed: in general, the data controller has to clearly detail on the collection form what will be done with the personal data
- consent must be **unequivocal**, the data controller must not seek to mislead the person for example as to the reality of the processing carried out on this data, and inform him clearly of what is done with his data

The G29 has written <a href="https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051">very detailed consent guidelines</a> on these matters.


## Processes to implement

One risk for organizations who collect personal data is to fail to collect a valid consent. Avoiding this scenario is, however, relatively simple, provided that specific consent acquisition processes are put in place. 

If you are uncertain about how to build these processes head up to <a href="https://www.legiscope.com">Legiscope</a> as these step-by-step processes are already built and the platform will help you automate a lot of other compliance tasks and save considerable amounts of time.








The GDPR requires obtaining the consent of individuals before processing their personal data in certain cases, here's how to do that

Tutorial: how to get a valid GDPR consent


The GDPR introduced an interesting new concept to ensure the protection of personal data : the notion of *"privacy by design"*. In fact, to be completely exact, the GDPR distinguishes two ideas : the idea of ​*privacy by design* and the idea of *​privacy by default*. These concepts originally came from the Commissioner of the Canadian Agency for the protection of personal data (Dr. Anne Cavoukian) who developed a series of principles in 2010 to take privacy into account straight from the design of processing systems.

The GDPR welcomed this idea but from a rather specific angle. Therefore it's necessary to understand these concepts(1) before clearly looking at their impmentation in the GDPR that really differs (2). Finally we will look implementation in practice (3).

## I. - What is privacy by default and privacy by design ?

The principle is quite simple : <u>privacy by design</u> is the idea that the **protection of privacy must be taken into account at the very moment of designing an IT system**. For Apple for example, it's the idea that the company need to propose an option to encrypt hard drives to it's users. So, in the event of loss or theft, encryption will keep personal data confidential.

This concept differs from <u>privacy by default</u>, which is the idea that - when protection measures are set, they must be activated by default. In the case of Apple, it means that in the settings, the checkbox "encrypt the data on my hard drive" should be checked by default - as soon as the laptop is delivered to the user, in order to avoid any additional effort which might not systematically be carried out.

<u>**The details of the Canadian proposal and the 7 principles**</u>

Let's take a look at the [Canadian proposal](https://www.ipc.on.ca/wp-content/uploads/resources/7foundationalprinciples.pdf) of 2010 and the principles of data protection by design and default originally set : 

1. "Proactive not reactive—preventative not remedial. Anticipate, identify, and prevent invasive events before they happen; this means taking action before the fact, not afterward."
2. "Lead with privacy as the default setting - Ensure personal data is automatically protected in all IT systems or business practices, with no added action required by any individual."
3. "Embed privacy into design - Privacy measures should not be add-ons, but fully integrated components of the system."
4. "Retain full functionality (positive-sum, not zero-sum) - Privacy by Design employs a “win-win” approach to all legitimate system design goals; that is, both privacy and security are important, and no unnecessary trade- offs need to be made to achieve both."
5. "Ensure end-to-end security - Data lifecycle security means all data should be securely retained as needed and destroyed when no longer needed."
6. "Maintain visibility and transparency—keep it open - Ensure stakeholders that business practices and technologies are operating according to objectives and subject to independent verification."
7. "Respect user privacy—keep it user-centric - Keep things user-centric; individual privacy interests must be supported by strong privacy defaults, appropriate notice, and user-friendly options."

In summary, here are the rules to take into account when designing an information system :

1. Anticipate privacy risks 
2. Enable all privacy-protecting options by default
3. Plan for privacy as a central function 
4. Do not limit system functionality in return for privacy protection
5. Ensure end-to-end IT security
6. Maintain the transparency of the processing carried out by the IS
7. Respect the privacy of users and provide this as an additional benefit offered to users

However the GDPR took a completly different direction for implementation of these ideas.

### II. - What are the obligations imposed by Privacy By Design in the GDPR?

Unfortunately, as good as these ideas were, the GDPR took a completly different direction for their implementation - despite the title of art. 25 was kept the same: *Data protection by design and by default*. 

Let's look at the detail of article 25 :

> 1.Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, *the controller shall*, both at the time of the determination of the means for processing and at the time of the processing itself, *implement appropriate technical and organisational measures*, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing *in order to meet the requirements of this Regulation* and protect the rights of data subjects.<br />
> 2.The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

Upon reading article 25.1, we can legitimately wonder what it really brings in terms of legal obligations :

- if we summarize main obligation laid down by art. 25.1 we can establish that _“the controller implements (…) measures (…) in order to meet the requirements of this regulation”_. To sum up: the law requires the data controller to comply with the law. It doesn't add very much.
- Article 25.2 does not really do any better, as it indicates that the data controller ensures to collect the minimum amount of personal data. This might seem like a new rule of law, but it's not. It's a reminder of the principles set by article 5.1, which already imposes the controller to collect the minimum amount of data.

It is common, when faced with such a problem, to analyze the recitals of the text in order to determine what the intention of the legislator was. Recital 78 of the GDPR adds a bit more details to the article 25 :

> The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the requirements of this Regulation are met. In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default. Such measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features. When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles of data protection by design and by default should also be taken into consideration in the context of public tenders.

These provisions in mind, it is now difficult to find real new obligations that don't already exist within the GDPR : 
- principle of minimization (already set by art. 5) 
- principle of minimization over time (again set by art. 5)
- principle of data security (set by art. 5 and mostly art. 32)
- respect for the rights of individuals (art. 12 et seq.) etc.

The conclusion we could reach here is that we are confronted with a legislative bug, as article 25 just imposes obligations that were already set by other provisions. We could argue that these obligations make a specific distinction about the moment of implementation (when the IT systems are desgined). But the scope of the general obligations already apply to that :  *Ubi lex non distinguit, nec nos distinguere debemus*

In realty, there's a specific category of persons that should have been targetted by the principles Privacy By Design: software editors. This is an real missing actor in the GDPR as if they do not process personal data, they have no obligation whatsoever in regard to the design of their systems. In reality, that's what the GDPR tried to aim at. GDPR targets Controllers, Processors, joint controllers, but never specifically software editors, or producers of IT equipements and it's a missing category, to which the principles set out in Article 25 should really be applied to. GDPR choose not to target these intermediaries who provide the tools to operate the data processing. As a result, the obligations set by article 25 are a bit of a miss. It is likely that the next revision of the regulations - probably around 2035-2040 - will address that issue.

In the meantime, we must do our best to try to give meaning to the intention of the legislator.

### III. - Operational actions that can be taken to implement privacy by default and privacy by design

Fortunately, even if the article 25 lacks structure, it's possible to build a clear step by step processes to implement the principles of privacy by design : 

For example let's take the one requirement : transparency. This can be translated into a operational process:

- Clarity – Information delivered to the user shall be in clear and plain language, concise and intelligible 
- Semantics – Communication should have a clear meaning to the audience in question (ex : children)
- Accessibility - Information shall be easily accessible for the data subject (materially, user should not have to do efforts to access the inforamtion about the processing activity)
- Contextual – Information should be provided at the relevant time and in the appropriate form
- Relevance – Information should be relevant and applicable to the specific data subject
- Universal design – Information shall be accessible to all data subjects, include use of machine readable languages to facilitate and automate readability and clarity
- Comprehensible – Data subjects should have a fair understanding of what they can expect with regards to the processing of their personal data, particularly when the data subjects are children or other vulnerable groups
- Multi-channel – Information should be provided in different channels and media, not only the textual, to increase the probability for the information to effectively reach the data subject
- Layered – The information should be layered in a manner that resolves the tension between completeness and understanding, while accounting for data subjects’ reasonable expectations.

Controllers should then do the work of translating each requirement into operational tools, or [use our pre-built templates inside Legiscope](https://www.legiscope.com)



The GDPR introduced a new concept of privacy by design that must be implemented in all IT projects, here's the details about the legal obligation and how to implement

Implementing Privacy By Design (GDPR)


Beware not to confuse the DPO the **"Data Protection Officer"** (GDPR) and the **"Data Privacy Officer"** (not a GDPR concept)! And the reason is that the GDPR has a very specific view of the DPO : **the data Protection officier is NOT in charge of ensuring compliance with the GDPR**. That's the role of the Controller, not the DPO! Let's clarify this important distinction, often misunderstood by businesses who designate a DPO and discover after that the need additionnal staff to ensure compliance.

## I. - The DPO is not responsible for compliance

Within the GDPR, the Data Protection Officer has a very specific function, which is to **act independently from the Controller and ensure the GDPR is correctly implemented**. The DPO belongs in a way to the control departement. He's here to ensure the work is done properly, he's not here to do the work in the first place. A simple way to view the DPO is to see him as an employee of a data protection authority, but paid by the Controller of course.  

<u>**Why the DPO is fundamentaly independant**</u>

To understand why the DPO was created, we have to come back to the EU directive 95/46 (the directive that basically created data protection rules in Europe in 1995, before the GDPR was adopted as a regulation). This directive set the following structure : 

- before carrying out any data processing operation an organization had to inform the supervisory authority 
- with two exceptions to that rule : 
 - for certain types of processing activities that were unlikely to "affect adversely the rights and freedoms of data subjects" (no risks), no information was needed ;
 - or, in the case where the Controller had a "Data Protection Official" (at the time), who *ensured independently* the compliance of the processing activities to the law, no formality was needed either.

And this is a very important paradigm because the role of the DPO in the GDPR, inherits from this. Structurally, his duties are to ensure *independently* that the regulation is applied in the organization, and causes no substantial risks to data subjects. The DPO is here to review the work, not to do the work in the first place! 

This structure was established at a time  when mostly big businesses were conducting data processing activities (in 1995...): banks, insurances, hospitals, etc. And the legislator assumed these businesses had :
- an IT team to handle the processing activities
- a legal teams to handle the compliance 
- and therefore could easily appoint an independent official within the structure that could verify independently that everything was done according to the legislative plan

There are a lot of consequences of this position : 
1. The DPO is always independent from the Controller: he can not be sanctionned by the Controller for doing his work. He can not receive instructions from the Controller either. The DPO has to be properly informed of all processing operations (as well as  have all qualifications necessary to handle compliance work). 
2. The DPO can not be liable for the Controller's non-compliances: it is the Controller who assumes the compliance and all legal risks of his operations. The DPO is there only to verify that the work is done properly and offer a review of where the Controller is in terms of data privacy.


## II. When do organizations really need a DPO?

There are 3 cases in which the appointment of a DPO is mandatory:

1. when the controller is a public authority or a public body, with the exception of courts acting in the exercise of their judicial function
2. when the organization's core activities require regular and systematic tracking of people on a large scale
3. when the activities of the organization consist of large-scale processing of health data, for example (more generally Article 9 or 10 data)

**In all other cases, the appointment of a DPO is optional**. However, it's practically always necessary to have a person in charge of the compliance inside the organization.


### A. - Who can be apointed as DPO?

Anyone who at least has taken a [two days training on GDPR compliance](https://www.legiscope.com). The training of the DPO is an obligation to be able to perform these functions.

### B. - The Tasks of the DPO

The data protection officer shall have at least the following tasks:
1. *Inform and advise* the controller or processor and the employees who carry out the processing on their obligations under this Regulation and other provisions of Union or national law. Member States on data protection;
2. *Monitoring compliance with the GDPR, including with regard to the distribution of responsibilities, awareness and training of staff involved in processing operations, and audits
3. *Provide advice* on data protection impact assessment and verify its execution under Article 35
4. *Cooperate with the supervisory authority*
5. *Act as a contact point* for the supervisory authority on matters relating to the processing, including the prior consultation referred to in Article 36, and carry out consultations, where appropriate, on any other matter.

In general, the DPO also assists in the creation and updating of the register of processing activities.The DPO has to perform his tasks with due regard to the risk associated with processing operations.

### C. - Position of the DPO

The Controller has a certain number of duties regarding the DPO, he has to :

- ensure the DPO is involved in all issues which relate to the protection of personal data ;
- support the DPO in performing his tasks, by providing all necessary resources to carry out his mission as well as all access to personal data and processing operations, and tools to maintain his or her expert knowledge.

The DPO *does not receive any instructions regarding the exercise of those tasks*. He or she shall not be dismissed or penalized by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.

Data subjects may contact the data protection officer about all issues related to the processing of their data and to the exercise of their rights under this Regulation.

The DPO is bound by secrecy or confidentiality concerning the performance of his or her tasks. He may fulfill other tasks and duties however, the controller has to ensure that any such tasks and duties do not result in a conflict of interests.

The DPO - the Data Protection Officer, is the person in charge of GDPR compliance management. Details on his functions and missions

Role and missions of the Data Privacy Officer (GDPR)



The notion of personal data is without question the most important component of the GDPR, because **it defines if GDPR applies or not**. If an organization is processing personal data it is mandatory to ensure compliance with all provisions of the GDPR (99 articles - 100 pages). However, none of these obligations will apply if no personal data is involved. Let's illustrate that by a diagram :

<center><img src="/img/blog/what-is-personal-data-gdpr.png" alt="Personal data" style="width:60%;"/></center>

So understanding what is personal data has real important consequences. Let's dive into the notion.

## I. - The notion of personal data and first examples

The simplest way to understand personal data is : <i>any data that allows to identify directly or indirectly a natual person</i>. It's very a simplified version of the legal definition given by article 4, but it has the benefit of being extremely clear and handle 90% of the situations. Now let's look at a few practical examples.

<u>**Here are some practical examples of personal data :**</u>
- A first name combined with a last name 
- A social security number
- An IP address - as long as there's a natural person behind it 
- A photo of a person
- The recording of a person's voice
- Licence plates
- Someone's CV
- A person's LinkedIn profile

E-commerce orders naturally process personal data : 

<center><img src="/img/blog/personal-data-e-commerce.png" alt="Personal data" style="height: 400px; margin-bottom:40px;" /></center>

<u>**Personal data is not private data**</u>

Personal data is frequently confused with private data - as taken in the sense of "my personal diary" or as data that is intimate to a person. The legal definition is much broader: any data that allows the identification of a person enters the GDPR's scope.

In real life, personal data are always integrated into personal data processing. For example, a company collects emails for its newsletter. Once we've identified that an organization is processing personal data, it's important to be able to record the fact that there is personal data processing, as this is required by law. Let's take a few examples of personal data processing.

## II. - Examples of personal data processing

Here are some classical examples of personal data processing for which organizations will need to ensure compliance:

- HR : recruitment (CV, LinkedIn...), employee payment processes
- Marketing : a newsletter, a blog 
- Sales: CRM
- IT : logs, company's email & messaging, backups
- Operations : company's phones, renting offices...

Let's now look a bit deeper into the legal definition.

## III. - The legal definition of personal data 

So far, we've introduced a simple definition that is great for a first understanding of the concept but that is also imperfect. So let's take look at its exact definition.

The notion of personal data has been defined in [article 4](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN): 

>For the purposes of this Regulation:
>(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Recital 26 also has interesting developments in regard to anonymisation of personal data : 
>The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Recital 30 also has interesting developments : 
>Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.


## 4. So you are processing personal data, now what?

As we said, the main consequence of personal data processing is that GDPR will apply. This also means that each data processing will have to be integrated into a compliance process, as well as recorded into the records of processing activities as required by article 30.

[Legiscope helps controllers to automate these obligations](https://www.legiscope.com) and currently reduces the time needed to fill up the records of processings from multiple weeks of work to a few minutes for most standard processing activities. [Check us out!](https://www.legiscope.com) 







The notion of personal data is one of the most important notions in GDPR compliance. Here's everything you need to know about it

GDPR and AML, what can go wrong ?

How about automating your GDPR compliance?