제39조 GDPR. 데이터보호담당관의 업무
Article 39 GDPR. Tasks of the data protection officer
1. 데이터보호담당관은 최소한 다음 각 호의 업무를 수행하여야 한다.
1. The data protection officer shall have at least the following tasks:
(a) 컨트롤러 또는 프로세서, 그리고 처리를 수행하는 직원에게 본 규정과 유럽연합 또는 회원국의 개인정보 보호 규정에 따른 의무에 대해 고지 및 권고
(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
(b) 책임 할당, 인식 제고, 처리 작업에 관련된 직원 교육 및 관련 감사 등 본 규정, 기타 유럽연합 또는 회원국의 개인정보 보호 규정, 개인정보 보호와 관련한 컨트롤러 또는 프로세서의 정책이 준수되는지 모니터링
(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
(c) 요청이 있을 경우, 제35조에 따라 개인정보보호 영향평가에 관한 자문 제공 및 평가의 이행을 모니터링
(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
(d) 감독기관과 협력
(d) to cooperate with the supervisory authority;
(e) 제36조에 규정된 사전 자문 등, 처리에 관련한 현안에 대해 감독기관의 연락처의 역할 수행 및 적절한 경우, 기타 사안에 대한 자문 제공
(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
2. 데이터보호담당관은 업무를 수행할 때 처리의 성격과 범위, 상황, 목적을 참작하여 처리 작업과 연계된 위험을 충분히 고려해야 한다.
2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.
3.2. Necessary resources
Article 38(2) of the GDPR requires the organisation to support its DPO by ‘providing resources necessary to carry out [their] tasks and access to personal data and processing operations, and to maintain his or her expert knowledge’. The following items, in particular, are to be considered:
• active support of the DPO’s function by senior management (such as at board level)
• sufficient time for DPOs to fulfil their duties. This is particularly important where an internal DPO is appointed on a part-time basis or where the external DPO carries out data protection in addition to other duties. Otherwise, conflicting priorities could result in the DPO’s duties being neglected. Having sufficient time to devote to DPO tasks is paramount. It is a good practice to establish a percentage of time for the DPO function where it is not performed on a full-time basis. It is also good practice to determine the time needed to carry out the function, the appropriate level of priority for DPO duties, and for the DPO (or the organisation) to draw up a work plan
• adequate support in terms of financial resources, infrastructure (premises, facilities, equipment) and staff where appropriate
• official communication of the designation of the DPO to all staff to ensure that their existence and function are known within the organisation
• necessary access to other services, such as Human Resources, legal, IT, security, etc., so that DPOs can receive essential support, input and information from those other services
• continuous training. DPOs must be given the opportunity to stay up to date with regard to developments within the field of data protection. The aim should be to constantly increase the level of expertise of DPOs and they should be encouraged to participate in training courses on data protection and other forms of professional development, such as participation in privacy fora, workshops, etc.
• given the size and structure of the organisation, it may be necessary to set up a DPO team (a DPO and his/her staff). In such cases, the internal structure of the team and the tasks and responsibilities of each of its members should be clearly drawn up. Similarly, when the function of the DPO is exercised by an external service provider, a team of individuals working for that entity may effectively carry out the tasks of a DPO as a team, under the responsibility of a designated lead contact for the client.