GDPR – The Role of the Data Protection Officer (DPO) Dai Durbridge

This session Run through the role of the DPO Time to answer some questions

Why all the fuss about GDPR? Update to 1998 Data Protection Act Creates DPO role Refocus on stronger data security and privacy rules Up to €20,000,000 fine 25 May 2018

Do we need a DPO? Yes GDPR requires a DPO to be appointed by public authorities and (currently) this includes state schools and academies

Was there a rumour schools won’t need a DPO? There was indeed…

Do MATS need a DPO for each academy No MAT is a single legal entity so the requirement will be for one DPO per MAT However, consider the team the DPO needs around them

What does the DPO role entail? Articles 37 to 39 Monitor GDPR compliance and implementation and application of data protection policies Inform/advise school and staff about GDPR obligations Advise whether and how to carry out DPIA

What does the DPO role entail? Cont… Be the point of contact for the ICO Train staff Carry out internal data audits

What qualifications does a DPO need? No precise credentials specified by the GDPR, but…. DPO must have expert knowledge of data protection law and practice Training will be needed Recognised accreditations likely in due course

What support should the school provide? Active support of the DPO function by senior management Sufficient time and resources for DPO to fulfil their duties Communicate designation of DPO to all staff Continuous training

What support should the school provide? Cont… Ensure DPO is involved in all data protection DPO reports to SLT/governors/MAT Board DPO operates independently DPO can be contacted by data subjects

Who should be your DPO? No need to employ new person or make it a sole role Consider experience and knowledge of data protection law and practices Can be a DPO for more than one school – but consider: Organisation structure and size Accessibility of the DPO from each establishment

What about potential conflict? GDPR Working Party: “As a rule of thumb, conflicting positions may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing.”  

How does this apply to my school? Not about the title held but the role undertaken First focus on the abilities of the candidate then address whether that person – because of the role they undertake – is conflicted IT lead is best example

Can I outsource the DPO role? Yes Consider due diligence, cost, SLAs

Should I take the role if offered? The million dollar question!

Talk to us Please note The information contained in these notes is based on the position at January 2018. It does, of course, only represent a summary of the subject matter covered and is not intended to be a substitute for detailed advice. If you would like to discuss any of the matters covered in further detail, our team would be happy to do so. © Browne Jacobson LLP 2018. Browne Jacobson LLP is a limited liability partnership. Dai Durbridge | 0330 045 2105| dai.durbridge@brownejacobson.com

GDPR – The Role of the Data Protection Officer (DPO) Dai Durbridge 27 November 2017