IBP-verantwoordelijke

Three roles that are easy to merge

The Normenkader IBP works with three parties that a small school board may be tempted to fold into one person. The school board itself is the bevoegd gezag and, in Kennisnet's words, carries final responsibility for everything to do with IBP. The IBP-verantwoordelijke does the practical work. Kennisnet notes that in primary education the role is usually involved in practical implementation, and lists a range of job titles that can carry it, from privacy officer and ICT coordinator to functional administrator or quality officer.

The third party is the data protection officer, the functionaris voor gegevensbescherming, whose role the GDPR sets. The data protection officer monitors compliance and advises; Article 38(3) of the GDPR says he or she receives no instructions on those tasks, and Article 38(6) allows other duties only where they do not cause a conflict of interests. A person who both carries out the IBP measures and monitors them is checking his or her own work.

Size shapes the answer. The IBP in beeld survey found boards with more than 10,000 pupils averaging 2.0 and boards with fewer than 1,000 pupils averaging 1.5. Small boards have the least capacity to split roles, and the most to gain from deciding explicitly who does what.