Data protection officer (DPO)

An internal supervisor, not the person who does the work

The GDPR never defines the data protection officer in a sentence. It describes the role through three articles: Article 37 says when one must be designated, Article 38 sets the position, and Article 39 lists the tasks. In Dutch the role is the functionaris voor gegevensbescherming, usually shortened to FG.

Article 39(1) gives the DPO at least these tasks: to inform and advise the controller or processor and its employees, to monitor compliance with the GDPR and the organisation's own policies, to advise on data protection impact assessments when asked, and to cooperate with and act as contact point for the supervisory authority. Article 38(3) requires that the DPO receives no instructions about those tasks and is not dismissed or penalised for performing them. Article 38(6) allows other tasks, as long as they do not cause a conflict of interests.

That last point is where schools need care. The Normenkader IBP works with an IBP-verantwoordelijke who runs the day-to-day work on information security and privacy. A DPO who also carries out that work would be monitoring decisions he or she took, which is the kind of conflict Article 38(6) is meant to prevent. Article 37(7) requires the controller to publish the DPO's contact details and communicate them to the supervisory authority.