I agree with Mr rasoul

I dare say no, as funding is generally tied to research. Security is often an afterthought.

The question assumes that training of DPOs is only or at least mainly a task for universities. However, there are many other, commercial organisations that provide such training (usually incl. an examination and DPO certificate at the end). In many cases, this seems like a better idea since it makes it easier for people with relevant work experience to become DPOs.

Agree with Ralf's views on this. Universities can look at industry linked programs in Risk and Compliance space and privacy can be covered under that.

Dear Ralf Kneuper

I agree that there is a lot of commercial organisations offering DPO courses, but I thought that it is also an opportunity for universities to develop relevant programs.

Dear colleagues, I would tend to agree with Ralf K. as from real world experience DPOs are in many cases better formed with specialised courses, rather than with a generic Law degree. It is important to stress the fact that a DPO should ideally be a Lawyer. In specific, a DPO should be a Lawyer with specialisation in International Privacy Law, better if he or she holds as well IAPP certification. That would be the real top of the top. The reality, though, is different. In my personal experience, many DPOs are not lawyers and are generally underqualified for the job. Keep in mind that the amount of needed DPO is not staggering, as only a few percentage of companies will need a DPO. In fact, Art. 37 of GDPR says:

1.   The controller and the processor shall designate a data protection officer in any case where:

(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.

This restricts a lot the "legal need" for a DPO: for example the multinational company where I work, employes thousands of employees and is based in multiple locations over 3 continents. And still, we don't have a DPO, because it is not "legally required". Thus the business saves money on NOT hiring a DPO, but merely having a Privacy Manager.

The Privacy manager does NOT report to the "highest management"as required by the GDPR Art. 38 (3), just to mention one difference between a DPO and a "Privacy Manager", which is a job role not mentioned in the GDPR.

In short, my points are two:

1) There is not such a huge demand for DPOs (search yourself on the major job advert websites), thus there is not any concern in "forming them" whether at Uni or elsewhere.

2) The DPO, when needed, should be an International (Privacy) Law expert and work in Team with Information Security (e.g. a CISO). The IT Governance Risk and Compliance functions (usually embodied by Information Assurance/ Information Security) will understand 'compliance' in general and will satisfy DPO requests.

DPO requests are usually attaining "technical" (worked by CyberSecurity/InfoSec) and "organisational" (Governance) measures. For other tasks like PIA/DPIAs, the DPO will have a small team directly under him or will use IT Risk analysts (if present in the organisation).

The DPO is the interface with the external world, its communication should be pondered and legally sound. That is one of the main reasons for a DPO to be a lawyer. Also, in multinational companies, GDPR is just one of the legislations to keep in account: that is why a lawyer needs to be an International Law expert, to be sure to weight all the needs required in different locations (e.g. China, Russia, USA, apart from EU).

I am open to collaboratively discuss any point with which you might not be in agreement.

Kind regards

Giulio di Lernia, CISSP, CISM, CRISC, CIPP/E