Governance

AuthorDavid Zetoony
ProfessionIs a partner in the Boulder, Colorado office of Bryan Cave Leighton Paisner, LLP, an international law firm
Pages81-88
81
GoVeRnAnce
Q.83 ARe ALL coMpAnIes ReQUIReD to HAVe A
DAtA pRotectIon offIceR?
No.
A company is only required to have a Data Protection Ofcer in the
following two situations:
1. The “core activities” of the company consist of the “systematic
monitoring” of people on a “large scale.”173
2. The “core activities” of the company consist of processing “special
categories of data” on a “large scale.” For the purposes of appoint-
ing a Data Protection Ofcer, this includes the following types of
data: racial origin, ethnic origin, political opinions, religious beliefs,
philosophical beliefs, trade union membership, genetic data, bio-
metric data (if used for identifying a person), health data, data relat-
ing to an individual’s sex life, data relating to an individual’s sexual
orientation, or data relating to criminal convictions and offenses.174
If neither of the above situations applies to a company; it is not
required to have a Data Protection Ofcer under the GDPR.
It is worth noting that while the GDPR may not require that a compa-
ny retain a Data Protection Ofcer, some Member States (i.e., Germany)
may impose such a requirement under their domestic data privacy laws.
Q.84 WHAt Does “LARGe scALe” MeAn
WHen DeteRMInInG WHetHeR A DAtA
pRotectIon offIceR Is necessARy?
The term large scale is not dened in the GDPR; however the Article 29
Working Party has issued some guidance in this respect.175 The Working
173. GDPR, Article 37(1)(b). See also WP 243 Annex—Frequently Asked Questions.
174. GDPR, Articles 9, 10, 37(1)(c). See also WP 243 Annex—Frequently Asked Questions.
175. WP 243: Guidelines on Data Protection Ofcers at 21, (Apr. 5, 2017).

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT