Is Data Protection Officer obliged to conduct training of staff according to Article 39 of GDPR?

Question

GDPR Article 39(1)(b) states:

1. The data protection officer shall have at least the following tasks:

(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

In my country (Poland), legal experts in their publications claim that this provision requires the DPO to conduct training. When I read this law in English, I have the impression that it is rather about the obligation to monitor training of staff. The GDPR translation into Polish is known to be full of errors, so I would like to know how it is understood in other countries and languages. So, is the DPO obliged to conduct training or not?

Answer 1

As a native English speaker I would read this as requiring the DPO to monitor all the things listed (i.e. you are correct). Furthermore it would be ridiculous for the DPO to be personally responsible for doing all of these things. If you were supposed to perform "assignment of responsibilities" yourself that would pretty much make you the Chief Operations Officer. If you are only required to monitor job assignments for compliance then by the same logic you are only required to monitor training.

Having said that, there is an established principle in the safety industry that compliance should have an independent reporting line up to the top management, and I think its the same for financial regulations too. You cannot be an effective DPO if you are just watching from the sidelines. So I would expect a DPO to have:

• Line responsibility for audits and routine compliance work such as privacy impact assessments, with a dedicated team of people if necessary. This ensures that there is an independent reporting line from everyday work up to the DPO. Do not accept a situation where data protection work is carried out by the project and then handed to you to file once it is complete, because it never will be. Project managers have a lot of competing priorities and they are extremely good at avoiding anything that sits between them and project completion. You MUST have your own people in the project to see what is happening and the power to stop a project if it is not compliant. If they won't give you that, turn down the job.

• Budget responsibility for training (with the work actually done by specialist contractors or the company in-house training department)

• Notification of job assignments where data protection is part of the responsibility.

Answer 2

In Romania, within our national law, the DPO has to do the training regarding data protection. This trainings should be performed within other trainings, where you tell the them some examples to understand the importance of data protection.

Answer 3

According to a principle of segregation of duties, that is implied in every controlling activity in corporate environment, it is undesirable to combine monitoring (as the Article states prescribes a direct duty) and operational execution functions (training as a process of implementation) in one position, i.e. DPO. Especially, taking into account DPO's high level of responsibility. In other words, with such an segregation DPO would control her o his own results - so this is contradicts to normal corporate controlling. That's why I would not consider training as a core and especially as a mandatory task for DPO. Rather sometimes as an additional one. And what is direct task for DPO is to validate requirements for training and how effectively to control its results.

Answer 4

The DPO has the responsibility for GDPR Compliance (not liability, nor even accountability in the sense that the Company is accountable, unless the DPO "basically screwed up"). No DPO is expected to be Superman/ Woman, training people on his/ her own; knowing Legal affairs; IT; Corporate Operation; ... The DPO is expected to ensure having the necessary "resources" and using them to guarantee Compliance.