How to determine whether we need a data protection officer (DPO)?

In order to answer this question, the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to in this Article as General Data Protection Regulation(s) and / or GDPR) should be examined. Article 37 of the GDPR lists the organizations that are obliged, within the meaning of the Regulation, to appoint DPOs. The cases in which the appointment of a DPO is mandatory will be considered below. Even if an organization is not obliged to appoint a DPO, the appointment of such person can only have a positive effect on the protection of the personal data processed and, accordingly, prevent possible sanctions by the control authorities. I. WHICH ORGANIZATIONS ARE OBLIGATED TO APPOINT DPO? This section lists all the cases in which a company will be obliged to appoint a DPO. The obligation will be present even if the organization falls into only one of the categories described below. 1.1. ORGANIZATIONS WHOSE CORE ACTIVITY REQUIRES REGULAR AND SYSTEMATIC LARGE-SCALE MONITORING

• What does “core activity” mean?

The core activity is the one that helps to achieve the goals of the organization. For example, the main purpose of a company for private security activities is to conclude and perform contracts for security of various sites. To carry out this activity, the organization hires staff. The processing of personal data of the staff for the purposes of the employment relationship between the persons and the company is an ancillary process and not the core activity or the main direction of economic activity. On the other hand, the monitoring of commercial sites is undoubtedly part of the core activity of the company. During its implementation, personal data (biometric and other data) of individuals is inevitably processed, due to which the Company will have an obligation to appoint a DPO.

• What does “regular and systematic monitoring” mean?

According to the accepted interpretation, “regular and systematic” means the non-accidental processing of personal data, which is part of the core activity of the organization. It happens on an ongoing basis or at certain intervals and through its implementation the set economic goals are directly achieved. For example, if an organization has hired a company to take care of the video surveillance of the organization’s sites to protect its property, and the organization requests to review the records from a specific point in time to determine a violation, this monitoring will not be considered as “regular monitoring” for the organization. Thus it will not require the appointment of a DPO. However, the company that is hired to carry out the monitoring, performs this activity on a daily basis and to achieve an economic result. Therefore, there is an obligation for this company to appoint a DPO. Another example of an activity that represents “regular and systematic monitoring of individuals” is the profiling and assessment of individuals by an insurance company for the purpose of performing risk assessment and calculating insurance premiums. This processing is performed at the conclusion of each insurance policy and is part of the core activity of the insurance company. The organization will therefore be obliged to appoint a DPO on this basis.

• What does “large-scale” mean?

The applicable legislation does not provide specific measures of when personal data is processed in “large-scale”. The assessment of this should be made independently by the organization in each case of processing based on the following factors: Cases in which the processing of personal data is considered large-scale are^[1]: And here are some cases in which there isn’t large-scale processing: 1.2. ORGANIZATIONS WHICH PERFORM LARGE-SCALE PROSSESING OF SPECIAL CATEGORIES OF PERSONAL DATA AND PERSONAL DATA RELATED TO CRIMINAL CONVICTIONS AND OFFENCES

• Which categories of personal data are special?

It should be emphasized that the obligation to appoint a DPO arises both when simultaneous large-scale processing of special categories of personal data and personal data related to criminal convictions and offences is being executed, and when large-scale processing of only one of these two categories of personal data is executed. 1.3. PROCESSING OF PERSONAL DATA BY A PUBLIC AUTHORITY OR STRUCTURE The GDPR does not define the term “public authority or structure” and should therefore be defined in accordance with the national law. Within the meaning of § 1, item 17 of the Additional Provisions of the Personal Data Protection Act, a “public body” is a state or local body, as well as a structure whose main activity is related to the spending of public funds. In the Republic of Bulgaria such are:

• State bodies: all structures that exercise public power and have powers explicitly regulated by law or other normative act. No matter in what field their activity is carried out, if it is necessary to perform actions for personal data processing, they must appoint a data protection officer;
• The bodies of the local self-government: the municipal council, the mayor of the municipality and the regional governor. The municipal council is a body of local self-government in the municipality, the mayor is a body of executive power in the municipality, and the district governor exercises governance in the district and in this sense he acts as a local representative of the central government.,
• Other public entities established by virtue of a normative act for performing public functions: a public entity is an entity that is designed to meet needs of public interest, which are not industrial or commercial in nature and which is funded by more than 50 percent of state, territorial or local authorities or other public bodies, or is subject to management control by those authorities; or has a management or supervisory body, in which more than the half of the members are appointed by a state or local government body.^[2]

II. IS YOUR ORGANIZATION A CONTROLLER OR PROCESSOR? The GDPR gives different quality to the organizations in terms of the processing of personal data they execute. Personal data controller means a natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; Processor of personal data means a natural or legal person, public authority, agency or other entity that processes personal data on behalf of a controller of personal data. The criteria for appointing DPO applies equally to both types of organizations. This means that each organization should determine independently, in view of its internal processes and without taking into account its relationships with other organizations, whether there is an obligation to appoint a DPO. III. WHAT ARE THE OBLIGATIONS OF THE DPO? The Data Protection Officer shall have at least the following responsibilities:

• to inform and advise the organization and the employees who process personal data about their obligations under both the GDPR and other applicable provisions in domestic law;
• to monitor compliance with the rules for personal data processing set out in applicable law and in the internal documents of the organization;
• assign responsibilities, raise awareness and train staff involved in processing operations;
• to audit the personal data processing within the organization;
• to give professional opinion and advice in connection with the assessment of the impact of data processing on its protection and to monitor it;
• to cooperate with the CPDP and to act as a contact point between the Commission and the organization it represents on issues related to the processing of personal data;
• DPO may seek prior consultation with the CPDP in connection with the forthcoming processing of personal data, as well as in connection with emerging cases in the activities of the organization.

Considering the above it can be reasonably concluded that the assessment of whether an organization should appoint a DPO, as well as the selection of an expert or organization to perform the functions of personal data protection officer, is extremely important and responsible process for each business. The choice of such a figure in an organization, whether there is an obligation to do so or not, is undoubtedly a good practice and would be welcomed by the supervisory authorities in the face of the Data Protection Commission, as well as by partners and customers of the organization. On one hand, the understanding and correct application of the internal rules and policies created in the organization for personal data processing is ensured, since the employees are well-trained. On the other hand, communication with the Commission for Personal Data Protection and with the individuals whose data is processed is facilitated. All this inevitably reduces the risk of sanctions by control bodies for the organization, as well as further guarantees to the individuals who have relationship with the organization that their personal data is processed legally and at the necessary level of protection.

---

[1] The examples are taken from the Guidelines for Data Protection Officers (“DPOs”) of the Article 29 Data Protection Working Party [2] §43 of the Additional Provisions of the Public Procurement Act