undefined | Better HN

0 pointsCobrastanJorji7y ago0 comments

I don't think he can. The DPO may not be assigned any tasks that would result in a conflict of interest between their role as a DPO and their other responsibilities. I suspect that means that the sole proprietor can't be the DPO. But, you know, not a lawyer, not even European, could be wrong. See article 38, paragraph 6, 2nd sentence.

0 comments

s_dev7y ago

Sole proprietor has to be the DPO in that instance.

BinaryIdiot7y ago

Yup, I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases. But, yeah, I'm not a lawyer too.

Edit: DPO Network says this which I think is a pretty good summary (though it's not part of the explicit legal policy, it's someone's opinion)

> CAN WE ASSIGN ONE OF OUR EMPLOYEES AS OUR DPO?

> Yes. However, you must ensure that other professional duties of this employee must be compatible with his/her new duties as DPO and do not result in a conflict of interests.

https://www.dponetwork.eu/faqs.html

ucaetano7y ago

> I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases

Being the sole owner and manager and being the DPO is clearly a conflict of interest.

netsharc7y ago

If you're Zuck or anyone working for FB, that'd be true. But what if one of my interests in running my company is the protection of my users' data?

1 more reply

BinaryIdiot7y ago

> Being the sole owner and manager and being the DPO is clearly a conflict of interest.

Could you clarify why you think this is so? As an owner, my interests would align with the DPO's interests so it's hard to me to find where the conflict of interest would reside in the case of being the sole employee _and_ DPO.

Now if it's a large company where they make money per GDPR policy workaround then I could see it being required another person than the owner, but it could still certainly be an employee.

2 more replies

lagadu7y ago

If you're selling your stored PII to third parties without user consent then yes, it would be.

stordoff7y ago

I would say there is a definite conflict of interest for the sole owner to be the DPO - you are responsible for the entire direction of the company, thus have considerations beyond data protection (rather than an individual who ONLY has to consider the data protection outcomes in the exercise of his duties). Even if you make data protection a paramount concern, and intend to be fully compliant, there is the possibility that you could e.g. make more money or provide a better service by making a different choice, therefore there is a conflict of interest.

j / k navigate · click thread line to collapse

0 comments

s_dev7y ago

Sole proprietor has to be the DPO in that instance.

BinaryIdiot7y ago

Yup, I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases. But, yeah, I'm not a lawyer too.

Edit: DPO Network says this which I think is a pretty good summary (though it's not part of the explicit legal policy, it's someone's opinion)

> CAN WE ASSIGN ONE OF OUR EMPLOYEES AS OUR DPO?

> Yes. However, you must ensure that other professional duties of this employee must be compatible with his/her new duties as DPO and do not result in a conflict of interests.

https://www.dponetwork.eu/faqs.html

ucaetano7y ago

> I read that and I don't see how it would be in the conflict of interest for probably the vast majority of cases

Being the sole owner and manager and being the DPO is clearly a conflict of interest.

netsharc7y ago

If you're Zuck or anyone working for FB, that'd be true. But what if one of my interests in running my company is the protection of my users' data?

1 more reply

BinaryIdiot7y ago

> Being the sole owner and manager and being the DPO is clearly a conflict of interest.

Now if it's a large company where they make money per GDPR policy workaround then I could see it being required another person than the owner, but it could still certainly be an employee.

2 more replies

lagadu7y ago

If you're selling your stored PII to third parties without user consent then yes, it would be.

stordoff7y ago

j / k navigate · click thread line to collapse