Question 171 - CIPP-E discussion

A data controller appointing a data protection officer who lacks ISO 27001 auditor certification would not result in an infringement of Articles 37 to 39 of the GDPR.According to Article 37 (5) of the GDPR, the data protection officer must be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 391.However, the GDPR does not specify any formal qualifications or certifications that the data protection officer must have, and leaves it to the discretion of the controller or the processor to determine the level of expertise required, depending on the complexity and sensitivity of the data processing activities2. Therefore, the lack of ISO 27001 auditor certification, which is a standard for information security management systems, does not necessarily mean that the data protection officer is not qualified or competent for the role.

The other options are incorrect because they would result in an infringement of Articles 37 to 39 of the GDPR.According to Article 37 (6) of the GDPR, the data protection officer may be a staff member of the controller or the processor, or fulfil the tasks on the basis of a service contract1.However, the data protection officer must be independent and report directly to the highest management level of the controller or the processor3.Therefore, if the data protection officer is provided by the data processor, there may be a conflict of interest or a lack of autonomy, which would violate Article 38 (3) and (6) of the GDPR4.

According to Article 38 (6) of the GDPR, the data protection officer may fulfil other tasks and duties, provided that they do not result in a conflict of interests4.However, managing the marketing budget would likely involve a conflict of interests, as the data protection officer would have to oversee and advise on the data processing activities related to marketing, which may not be compatible with his or her role as a data protection officer5.Therefore, if the data protection officer also manages the marketing budget, this would infringe Article 38 (6) of the GDPR4.

According to Article 38 (3) of the GDPR, the data protection officer must not receive any instructions regarding the exercise of his or her tasks4.The data protection officer must act in an independent manner and perform the tasks assigned by the GDPR, such as informing and advising the controller or the processor and the employees, monitoring compliance, cooperating with the supervisory authority, and acting as the contact point for data subjects and the supervisory authority6.Therefore, if the data protection officer receives instructions from the data controller, this would infringe Article 38 (3) of the GDPR4.Reference:1: Article 37 of the GDPR2:Guidelines on Data Protection Officers ('DPOs')3: Article 38 (2) of the GDPR4: Article 38 of the GDPR5:Data protection officer (DPO) | European Commission6: Article 39 of the GDPR