Data protection officer

What it means

Zodpovedná osoba is the Slovak name for the data protection officer under GDPR. The role monitors compliance of personal data processing, advises the controller and acts as the contact point for data subjects and for the Slovak data protection authority.

It has nothing to do with the responsible representative of trade licensing law, however alike the names sound. Nor does the officer carry liability for breaches: the controller does, while the officer checks, warns and documents.

The officer may be an employee or an outside provider under a service contract, so the role can be handled through outsourcing. Either way the officer must be independent: they take no instructions on how to carry out their tasks, may not be penalised for performing them, and report directly to top management rather than to a head of department.

How it works in practice

A public authority must appoint one, as must a company whose core activity is large-scale regular monitoring of people or large-scale processing of special categories of data. An ordinary e-shop or accounting firm normally falls outside the duty.

The contact details are published and notified to the authority. The officer works on the record of processing activities, on impact assessments and on the drill for a personal data breach, which is exactly what the authority asks for first.

Where a company appoints an officer voluntarily, without being obliged to, the same rules apply as to a mandatory one: independence, a published contact, notification to the authority and involvement in every data protection issue. For a smaller firm we therefore tend to recommend putting someone in charge of coordinating compliance in this area without that title.

What to watch out for

The role gets handed to the director, the head of IT or the HR manager. That is a conflict of interest: the same people set the purposes of processing and would also be policing them. At an inspection the authority disregards the appointment, and the company stands where it would with no officer at all, plus a fine.

A company installs a fingerprint attendance system and nobody asks the officer. Biometric data are a special category, and such processing usually requires a data protection impact assessment. At an inspection there is neither the assessment nor the officer’s opinion, the authority may ban the processing, and the money spent on the system is lost.