The role of the DPO: EDPB report and BE DPA comments

The EDPB has published a report on the findings of its second annual coordinated enforcement action, which focused on the designation and position of Data Protection Officers (DPOs).

A total of 25 data protection authorities in the EEA took part and launched coordinated actions, with encouraging results overall. The report does, however, identify challenges and lists a series of recommendations for organisations, DPOs and data protection authorities. The report is accompanied by two appendices: the statistics collected as part of the action and the national reports of the supervisory authorities that took part in the action.

For its part, the Belgian DPA decided to conduct a survey amongst the DPOs for which it has contact details. The hundreds of responses received from the DPOs in Belgium were used to draft the national report, which is appended to the report published by the EDPB.

The Belgian DPA’s observations include the following:

• the DPO is not systematically involved in issues related to data protection within organisations;
• almost half of the respondents indicated that the resources allocated to the DPO are not sufficient, but this proportion is higher in the public sector than in the private sector. Particular attention should therefore be awarded to the allocation of resources to the DPO in the public sector;
• nearly a fifth of the DPOs questioned said that they were involved in decision-making concerning processings of personal data within their organisation. The Court of Justice has held that a "conflict of interest" is likely to exist when a DPO is entrusted with other duties or tasks, which would result in him or her determining the objectives and methods of the processing of personal data on the part of the controller or its processor.

The national appendix also lists the various documents in support of DPOs that the Belgian DPA has published over the years on its website, in particular on its toolbox, as well as enforcement decisions adopted on the role and appointment of the DPO.

The Belgian DPA also indicates that the DPO page on its website is currently being updated, and that it is organising an event dedicated to the Data Protection Officer.

The full EDPB report is available on the EDPB website.

Thank you!

No fewer than 400 DPOs responded to the survey organised by the Belgian DPA as part of the European coordinated enforcement action. The Belgian DPA would like to warmly thank them for their valuable contributions, which have made it possible to produce a qualitative report on the position of the DPO in organisations in Belgium, but also in Europe in general.