Summary

The GDPR does not preclude national legislation which enables DPO’s to be dismissed only for just cause, even if not related to the performance of the DPO’s task, insofar as such regulation does not undermine the GDPR’s objectives. A DPO may experience a conflict of interest when other tasks or duties would result in him or her determining the objectives and methods of processing personal data.

Questions

1. Must the second sentence of Article 38(3) of the GDPR be interpreted as precluding national legislation which provides that a controller or a processor may dismiss a DPO who is a member of staff of that controller or processor solely where there is just cause, even if the dismissal is not related to the performance of that officer’s tasks?
2. In which circumstances may the existence of a ‘conflict of interests’, within the meaning of Article 38(6) of the GDPR, be established?

Ruling

1. The second sentence of Article 38(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as not precluding national legislation which provides that a controller or a processor may dismiss a data protection officer who is a member of staff of that controller or processor solely where there is just cause, even if the dismissal is not related to the performance of that officer’s tasks, in so far as such legislation does not undermine the achievement of the objectives of that regulation.
2. Article 38(6) of Regulation 2016/679 must be interpreted as meaning that a ‘conflict of interests’, as provided for in that provision, may exist where a data protection officer is entrusted with other tasks or duties, which would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor, which is a matter for the national court to determine, case by case, on the basis of an assessment of all the relevant circumstances, in particular the organisational structure of the controller or its processor and in the light of all the applicable rules, including any policies of the controller or its processor.