Do you think Data Protection Officer should be a lawyer or an infosec expert? Since it is very hard to get 2 in 1 in one person, do you thing that DPO should be a team of at least two people?
GDPR says:
The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
Article 39
Tasks of the data protection officer
1. The data protection officer shall have at least the following tasks:
(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
(d) to cooperate with the supervisory authority;
(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.
1) Compliance is Legal. Hence you need a lawyer.
2) GDPR is a first try to protect people's data and privacy. It is making legacy assumptions which do not work in all cases. I will give counter-examples:
Anonymisation would mean that ommitting names of people helps protect them.
It does not work:
-some people are fully identified by other attributes than their name
Ex1: a cyclist who likes ice-cream, and red buses of NHS (National Health Service)
That's the current PM of UK...
Ex2: car plates "2B" and "Not2B", find the happy couple owning these, who are so all over the place on the Internet that you will find their home address and schedule
The two above are beyond anonymisation. Simple nouns and facts suffice to retrieve them uniquely. Furthermore:
-history has shown that discrimination and death caused by "rogue governments" depends more on a database with sensitive attributes than on knowing people's names. Ex: people deported to concentration camps until 1945, because of who they were (sensitive attribute of "belonging": ethnic, religion, sexual orientation, political thinking, etc), not of their names. There are many more in today's world, unfortunately.
The protective principle here could be "Statistical Disclosure Control" (look it up).
The above shows that you need people with statistical skills, societally conscious.
It also shows that the technology is not yet sufficient to prevent risky data sharing.
In the medical sector I would like to highlight two paths which can be developed from the inspiration of:
-Latanya's Sweeney's work on k-anonymity
Maybe some of the Differential Privacy developments thereafter too
-A scenario where data does not move and algorithms packaged in Docker visit the data sets where they reside (clinics, hospitals). See EU project VISCERAL (now finished).
Dear Mr. Syed Hassan
and Mr. Renaud Di FrancescoThank you for very helpful and inspiring answers! DPO should definitely have a broad understanding of all of the horizontal processes in the organization, and deep knowledge of information security and privacy, as well as laws and regulations.
The educational system is maybe not ready for the amount of DPO positions needed today, and it's measured in hundreds of thousands worldwide. GDPR made a huge impact, not just in the EU, but also in many non-EU counties (Israel, Japan, State of California etc) by adopting new GDPR-compliant laws.
Best Regards,
Rajko
Syed Hassan
You chose the hottest possible topic at the moment for your research, hopefully it's going to have a broad practical impact. Good luck!
Best Regards,
Rajko
Hi Rajko,
I work as responsible of Information Security for a medium-sized enterprise.
I have held ad interim the position of Privacy Manager while the company hired a dedicated person for the Privacy function.
In my experience, a DPO needs to be a Lawyer, as the implications for international Laws related to privacy matters reach far beyond the GDPR.
The Information Security goal is there to help with data protection and propose Security Architectures tailored to the specific organisation it works in.
On the other hand, while Information Security leaders can have a huge benefit in being acquainted with GDPR or other Privacy Laws (COPPA, CCPA, etc.), the specific locally-relevant legal implications extend too far for non-Lawyers.
Also for Lawyers themselves, only those expert in Privacy and International Laws are really fit for dealing with such matter.
I would agree that the best outcome would be achieved having a DPO (Lawyer) supported by a qualified CISO: too often we see CISOs not having needed qualifications while holding the job (a CISSP should be the minimum required).
Therefore, in general, I would suggest the DPO to be a lawyer supported by the CISO and, in some part, also from the CIO, who would be there to draft the roadmap for the IT Services to comply with privacy compliance requirements over time. Those things require planning and are not generally achieved overnight.
The DPO structure could, in large organisations, make use of Privacy Managers, reporting directly to the DPO. They might be the ones working with various Information Security Teams to achieve the goals set by their respective leaders.
An important point to be taken from this is about governance: the DPO and the CISO should never report to any other function than the CEO.
The DPO is clearly marked for that by ART 38 (..The data protection officer shall directly report to the highest management level..).
On the other hand, the CISO function still often reports to the CIO, a really bad (although diffused) governance practice, which is only recently being fixed, by putting the CISO on-par with the CIO. They have conflicting priorities which should be balanced by risk assessments results and not from the fact that the CIO has the power to grab from the InfoSec budget anytime he needs (which means very very very often). The bad practice of having the CISO under the CIO is often likely, by itself alone, to undermine all efforts aimed at achieving any sort of compliance: a proper organisation should have those functions (DPO, CIO, CISO) levelled on the same plain. Those should act as SMEs to the final decisional authority, which is the one having the 'budget allocation power' (usually the CEO).
The CRO (Chief Risk Officer) would also be a critical stakeholder in this process.
It would be ideal if the budget prioritisation would be based on data, rather than on feelings. This happens in very few organisations out there, also because the CRO is a quite rare function in many sectors. I am just reporting it here just for sake of completeness.
I have omitted all other interactions with other Teams (HR, Marketing, Sales, etc.) as I intended to write a short opinion and not an academic article on the subject.
I hope this real-life experience will share my views on how the DPO organisation should be set up and with which functions it should be mainly working with.
Kind Regards,
Giulio di Lernia
============================
CISSP #119159
CISM #1117240
CRISC #1106799
CIPP/E # 000126882I
PRINCE2 Certified
ITILv2 and ITILv3 Certified
ISO/IEC 27001:2013 Lead Auditor
Dear Mr. Giulio di Lernia
Thank you very much for a comprehensive and helpful answer! I myself am an Information Security Manager, and also an Operational Risk Manager in my institution and I am pretty much familiar with your experiences. So I think, definitely, a lawyer and an infosec manager should make a DPO team. Lawyers know the legislation and infosec managers know standards and data protection side of the story. It's like two sides of the same coin, both necessary for a good privacy management.
Dear Mr. Syed Hassan
Thank you very much for good wishes! All the best to you too in the coming year!Best Regards,
Rajko Sekulović
During the early days of May 2018 I observed that a number of my peers from law school quickly became DPOs in firms, some of them also had a background in management. From a practical standpoint this seemed mostly to be a strategy of buying time in order to wait for more clarification on how to implement the new guidelines; if something came up, the "new guy" would be blamed. As time went on we speculated that GDPR would eventually be integrated into the compliance departments.
A trained DPO mustn't necessarily be a sauvy tech, lawyer or security personnel but having background in any of those profession is an added advantage
Fixing my sink doesn't make me a plumber... The point for me is the term "TRAINED" DPO. For me "trained" stays for Lawyer. As in my experience having a Law degree is even not enough to be a DPO. On the other hand, just having a Privacy certification (even a top one, like those from IAPP) doesn't make one realise the many facets in real-life cases related to privacy. A trained DPO for me is a Lawyer with a significant career in Privacy or a Lawyer who underwent an IAPP certification. Just saying that someone is a "trained DPO", without having any meter of measurements for competence, might result in very bad surprises for the "employer". Just my opinion..
- Badges
- Science topic