1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
3. The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.
4. Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
(RU) В статье 38 описывается особенность должности DPO (инспектора по защите персональных данных). В частности, делается упор на том, что DPO самостоятельно выполняет свою работу, притом ответственность за ее своевременное и качественное выполнение отчасти лежит на самой компании (контролере или процессоре). Поэтому текст подчеркивает, что компания предоставляет DPO необходимые ресурсы и доступ с одной стороны, а также несет ответственность за независимость DPO, не имея права давать ему/ ей какие-либо инструкции – с другой.
Для того, чтобы обеспечить DPO поддержкой, компании рекомендуется убедиться в следующем:
Сам(-а) же DPO также имеет бремя профессиональной тайны (можно сравнить с проф.тайной врача или адвоката), из-за потенциально чувствительной природы информации, с которой он(-а) работает. Например, DPO не имеет права разглашать информацию о потенциальных нарушениях (за исключением случаев, когда нарушение подтвержденное и требует огласки).
[…]
Login
to read the full text
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 6.1.1.
Here is the relevant paragraph to article 38 GDPR:
6.3.1.1 Information security roles and responsibilities
Implementation guidance
The organization should designate a point of contact for use by the customer regarding the processing of PII. When the organization is a PII controller, designate a point of contact for PII principals regarding the processing of their PII (see 7.3.2).
The organization should appoint one or more persons responsible for developing, implementing, maintaining and monitoring an organization-wide governance and privacy program, to ensure compliance with all applicable laws and regulations regarding the processing of PII.
The responsible person should, where appropriate:
— be independent and report directly to the appropriate management level of the organization in order to ensure effective management of privacy risks;
— be involved in the management of all issues which relate to the processing of PII;
— be expert in data protection legislation, regulation and practice;
— act as a contact point for supervisory authorities;
— inform top-level management and employees of the organization of their obligations with respect to the processing of PII;
— provide advice in respect of privacy impact assessments conducted by the organization.
NOTE Such a person is called a data protection officer in some jurisdictions, which define when such a position is required, along with their position and role. This position can be fulfilled by a staff member or outsourced.
(97) Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is carried out by a controller whose core activities consist of processing operations that require regular and systematic monitoring of the data subjects on a large scale, or where the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data and data relating to criminal convictions and offences, a person with expert knowledge of data protection law and practices should assist the controller or processor to monitor internal compliance with this Regulation. In the private sector, the core activities of a controller relate to its primary activities and do not relate to the processing of personal data as ancillary activities. The necessary level of expert knowledge should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor. Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner.
Article 29 Working Party, Guidelines on Data Protection Officers (DPOs) (2017).
ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 13.2.4.
Here is the relevant paragraph to article 5(1)(f) GDPR:
6.10.2.4 Confidentiality or non-disclosure agreements
Implementation guidance
The organization should ensure that individuals operating under its control with access to PII are subject to a confidentiality obligation. The confidentiality agreement, whether part of a contract or separate, should specify the length of time the obligations should be adhered to.
When the organization is a PII processor, a confidentiality agreement, in whatever form, between the organization, its employees and its agents should ensure that employees and agents comply with the policy and procedures concerning data handling and protection.