Privacy & Information Security Law Blog

On November 25, 2010, the German data protection authorities responsible for the private sector (also known as the “Düsseldorfer Kreis”) issued a resolution on the minimum requirements for the qualifications and independence of company data protection officers (“DPOs”).  This initiative follows inspections carried out within companies that revealed a generally insufficient level of expertise among DPOs given data processing complexities and the requirements set by the Federal Data Protection Act.  The DPAs recognize that a DPO’s workload depends primarily on the size and number of data controllers the DPO supervises, industry-specific factors related to data processing and the level of protection required for the types of personal data being processed.  Changes with respect to these factors frequently increase the burden on DPOs without a compensating increase in resources needed to ensure proper oversight.

The DPA’s resolution sets forth certain minimum requirements for company DPOs, as detailed below.

Expertise Required Under Section 4f(2) of the Federal Data Protection Act

The law requires that individuals must have certain necessary qualifications and be reliable in order to be appointed DPO, but does not elaborate on what this means.  In light of the increased requirements for the DPO position, individuals must have the following knowledge of data protection law as well as technical and organizational knowledge.

Regardless of the industry sector or the size of the data controller, a DPO should have a general command of data protection law.  This includes the following:

• Basic knowledge of the personality rights (Persönlichkeitsrechte) granted by the German constitution to customers and employees of the data controller
• Comprehensive knowledge of the Federal Data Protection Act as applicable to the data controller, including technical and organizational rules
• Knowledge of the relevant technical provisions of the law, in particular of the security requirements outlined in the Federal Data Protection Act

Depending on the data controller’s size, industry sector, IT infrastructure and the sensitivity of the personal data being processed, the DPO should have:

• Comprehensive knowledge of relevant industry sector-specific legal provisions
• Knowledge of information and telecommunications technologies, and of data security issues (e.g. physical security, cryptography, network security and malicious software)
• Basic business expertise in areas such as HR management, accounting, sales, management and marketing
• Knowledge of the company’s technical and organizational structure, including company policies and procedures
• Expertise in the practical aspects of data protection management (e.g. conducting audits, consulting, strategy development, inventories, risk management, analysis of security concepts, works council agreements, CCTV, cooperation with the works council, etc.)

As a rule, a DPO should have the necessary minimum legal, technical and organizational knowledge before being appointed as DPO, having acquired the relevant skills through appropriate training, professional development seminars and exams.

Independence Required Under Section 4f(3) of the Federal Data Protection Act

According to Section 4f(3) of the Federal Data Protection Act, DPOs must be free to the apply their data protection expertise without interference from the company.  In order to ensure the DPO’s independence, certain of company internal organizational measures are necessary:

• DPOs must be directly subordinate to the data controller’s head of management
• DPOs must not be penalized for actions taken to carry out DPO functions, including in cases where the appointment as DPO has been withdrawn
• DPOs are bound to confidentiality about the identity of the data subjects, as well as the circumstances under which they obtained information about a data subject, unless otherwise specifically authorized by the data subject in question

Data Controller Infrastructure Requirements Relevant to DPO Qualifications and Independence

• To carry out the assessment duties required by data protection compliance law, DPOs must have full access and inspection rights within the company.
• DPOs must be involved in all relevant business planning and decision processes.
• DPOs maintain the internal data processing inventories pursuant to law, and must be provided with the information necessary to do so.
• In order to maintain the appropriate qualifications, the company has to enable the DPO to participate in professional educational seminars and events, and cover costs associated with such training.
• Internal company DPOs must be allowed adequate time necessary to complete their tasks and to maintain their qualifications.
• Data controllers must provide appropriate support to the DPO, in particular by providing, personnel, office space, equipment, devices and means (Section 4f(5) Federal Data Protection Act).