Session 3: To DPO or not to DPO? Chris Vincent, International School of Zug and Luzern

International School of Zug and Luzern - Context 2 Campuses, canton Zug 1313 Students - 2018/2019 current enrolment EY1 - 12 750 Families 60+ Nationalities 4 year average stay for students 197 Faculty + 122 Staff = 319 Employees 4 IB Programmes + AP

ISZL Data Privacy Journey (Short trek really) Nov 2017: Attendance to GDPR Workshop at ISB Dec 2017: Leadership Team Conversation with 9ine Consulting Jan 2018: Formation of GDPR Task Force and engagement of 9ine Jan 2018: Initial Training for key ‘mini data processors’ Feb 2018: Presentation to all staff and faculty Feb 2018 - Jun 2018: Data Mapping, policies and procedures April 2018: DPIA Training for key ‘mini data processors’ May 2018: IT Risk Assessment conducted by 9ine Jun 2018: 9ine engaged to provide support 2018/2019 Aug 2018 - now: Data Privacy Task Force meets regularly

ISZL - Data Protection Task Force Membership Director of Educational Technology (Chair/DP Lead) Director of Teaching and Learning HR Manager Operations Manager (Zug Campus) Academic Systems Manager Head of Community Relations Head of Development

Data Protection Task Force = DPO Potential Advantages Sharing the load and expertise Guarding against loss of knowledge if the single assigned person leaves Increases presence and contact points Potential Disadvantages Conflict of interest Adding more on top of already full workloads ‘Not my problem’ syndrome