Christoph Klug GDD © GDD e.V. gdd German Association for Data Protection and Data Security Christoph Klug ATTORNEY AT LAW Phone: / Fax: / Internet: Gesellschaft für Datenschutz und Datensicherung e.V.

Christoph Klug GDD © GDD e.V. gdd qNon-profit organisation qFounded in 1976 (1. German Data Protection Act) qMission for over 25 years: –Help members to comply with privacy provisions –Support data protection officers »Education and training (seminars, conferences, publications) »Guidance (legal, technical, organisational problems) –Lobbying: reasonable, effective and practicable data protection

Christoph Klug GDD © GDD e.V. Membership-Development Stand:

Christoph Klug GDD © GDD e.V. Membership structure Stand:

Christoph Klug GDD © GDD e.V. Data Protection Official qDefinition: –A natural person, appointed by the controller of personal data, who shall independently assure that personal data is processed in a correct and lawful manner. qBusiness title: –Data protection officer (Germany, Netherlands) –Personal data representative (Sweden) –Corporate privacy officer (US)

Christoph Klug GDD © GDD e.V. The DPO-Concept qSelf-regulation (corporate self-monitoring) qMore effective data protection –Corporate compliance institution in addition to –Supervisory authority qAvoidance of unnecessary bureaucracy –Unburden supervisory authorities –Simplify notification –Prior checking by DPO instead of DP-authority

Christoph Klug GDD © GDD e.V. Origins of the DPO qGerman model implemented in EU-Directive (95/46/EG) qArt. 18 (2): Simplification of or exemption from notification where the controller, in compliance with the national law which governs him, appoints a data protection official, responsible in particular for: –ensuring in an independent manner the internal application of the national provisions taken pursuant to this Directive –keeping a register of processing operations carryed out by the controller...

Christoph Klug GDD © GDD e.V. Main Tasks qEnsure a lawful handling of personal data by the controller (company) including –Prior checking when specific risks - Article 20 (2) –Supervision of processors acting on behalf of the controller –Compliance with (internal) corporate privacy provisions such as codes of conduct or contractual obligations –Familiarise staff with data protection provisions qTransparency –Keep public register (any person) –Data subject rights (information, access, correction etc.)

Christoph Klug GDD © GDD e.V. Independent Status qArticle 18 (2) EU-Directive qPosition to exercise his functions in complete independence qIndependent inspection of processing operations –Necessary powers, means, premises, facilities, equipment, resources –Makes own professional judgement qIn case of grievances: report to head of the controller qController remains responsible for legal processing

Christoph Klug GDD © GDD e.V. Qualifications qNo requirements in EU-Directive qOnly vague requirements by German law: –“necessary know-how and reliability“ qGDD-Study: –Adequate knowledge of data protection law –Adequate knowledge of IT functions –Basic knowledge of business-related economics –Specific knowledge of the company`s internal structures and processing operations

Christoph Klug GDD © GDD e.V. Appointment of a DPO qEU-Directive: Appointment in compliance with the national law qGermany: Depending on size companies have to formally appoint DPO in writing. Mandatory appointment for public bodies. qNetherlands: DPO (optional) has to be registered with the DP-Commission (list) qSweden: DPO (optional). Practice: notification to the supervisory authority

Christoph Klug GDD © GDD e.V. Appointment Options qFull-time DPO –Larger companies –Multinational corporations, where the DPO is in charge for the affiliates as well (privacy assistants!) qPart-time DPO –Smaller companies –The DPO may hold another job in the firm qExternal DPO –Not employee but external consultant

Christoph Klug GDD © GDD e.V. The Value of Corporate DPOs qCorporate privacy management by DPO –Competitive advantage (own privacy chief) –Harmonised level of protection in multinational organisations –Self-regulatory approach allows for global enforcement qData protection controls can be improved –Two compliance institutions instead of one qSupervisory authorities can be unburdened –Self-monitoring –Prior checking –Notification

Christoph Klug GDD © GDD e.V. Simplification of Notification qEuropean Commission DP Conference in September –Evaluation of EU-Directive –Not a radical revision –Guidance for a better harmonisation –More uniform and consistent application in member states –Among other things: Simplification of notification qMember states and EU candidates should give companies the opportunity to appoint DPOs, thus avoiding the necessity to notify to the supervisory authority.