CJEU: DPOs can perform other duties in their role

The Court of Justice of the European Union (CJEU) has ruled that DPOs may have other duties within their role if there is not a conflict of interest. The CJEU also allows national courts to determine what is a conflict of interest situation, taking into consideration all the relevant circumstances, for example, the organisational structure.

Article 38(3) of the GDPR prohibits the dismissal of the Data Protection Officer, and Article 38(6) states that the DPO may fulfil other tasks and duties. The controller or processor must ensure that any such tasks and duties do not result in a conflict of interests.

“The GDPR does not establish that there is a fundamental incompatibility between, on the one hand, the performance of the DPO’s duties and, on the other hand, the performance of other duties within the controller or processor,” the Court states.

The CJEU says that DPOs should “be in a position to perform their duties and tasks in an independent manner” but “cannot be entrusted with tasks or duties which would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor.”

The CJEU decision was given in a case concerning a preliminary ruling by the German Federal Labour Court for x-Fab Dresden and its former DPO. This DPO was dismissed as a result of also being the Chair of the Works Council.

See the judgment of 9 February 

An article in PL&B UK Report May 2022 discussed similar issues: DPO conflicts – navigating the minefield with care