DATA PROTECTION | The EDPB on the role and position of DPOs

On 16 January 2024, the European Data Protection Board (EDPB) adopted a report on the findings of its second coordinated enforcement action, which focused on the designation and position of Data Protection Officers (DPOs). This report, which is the result of an EU-wide coordinated investigation involving 25 Data Protection Authorities (DPAs) in the EEA, identifies the obstacles currently faced by DPOs and lists a series of recommendations for organisations, DPOs and DPAs. In particular, the EDPB’s report highlighted some concerns and challenges that a number of DPOs still face, including lack of designation of DPOs, even where appointment is mandatory; insufficient resources or expert knowledge and training of the DPO; DPOs not being fully or explicitly entrusted with the tasks required under data protection law; conflicts of interest and lack of independence of the DPO; lack of reporting by the DPO to the organisation’s highest management level. In order to address these and other challenges, the EDPB’s report, among other measures, encourages DPAs to raise awareness in organisations of their obligation to appoint a DPO and encourages organisations to ensure that DPOs have sufficient resources.

Newsletter n. 93 – February 2024