The obvious choice is often the tricky one
Anyone who has to appoint a DPO looks inward first. The head of IT knows the systems, the head of HR knows the employee data, and the managing directors carry the responsibility anyway. That seems practical. But these are often the very people who decide which personal data is processed and why.
Article 38(6) GDPR does allow the DPO to hold other tasks. It also obliges the controller, which means your company, to ensure that those tasks do not lead to a conflict of interest. The duty lies with you, not with the person you appoint.
What the CJEU means by a conflict of interest
The Court of Justice of the European Union (CJEU) settled the question in 2023 in X-FAB Dresden (Case C-453/21, judgment of 9 February 2023). A DPO may not take on tasks that would let them determine the objectives and methods of processing personal data. The reason lies in Article 39(1)(b) GDPR. The DPO monitors compliance with the data protection rules. Anyone who decides would be monitoring themselves.
The court gives no list of prohibited roles. Whether a conflict exists has to be assessed case by case, on all the circumstances, above all the organisational structure and the company's internal rules. That case concerned a works council chair who was also the DPO. On 6 June 2023 the Federal Labour Court then ruled that the duties of a DPO cannot be reconciled with those of a works council chair (9 AZR 383/19).
Which roles are critical as a rule of thumb
The Article 29 Working Party, the former European advisory body on data protection, sets out a rule of thumb in its guidelines on data protection officers (WP 243 rev.01, section 3.5). Senior positions can be prone to conflict, for example executive management, operational management, and the heads of finance, marketing, HR or IT. Roles further down the hierarchy can also qualify if they decide on the purposes and means of processing.
The guidelines are not binding. They do show what matters. Does the person have a say in how and why personal data is processed?
An example makes it concrete. The head of IT selects systems and service providers. The head of HR decides which applicant and employee data is processed. The head of marketing decides on newsletters and tracking. If the same person, as DPO, checked whether those processing activities are lawful, they would be checking their own work. That does not mean someone in such a position is automatically ruled out. What counts is what they actually decide.
What happens if the conflict exists
Fine. Infringements of the controller's obligations under Articles 25 to 39 GDPR fall under Article 83(4)(a). The range is up to EUR 10 million or up to 2 per cent of total worldwide annual turnover, whichever is higher. That is the range, not the usual outcome.
A real case shows how a supervisory authority sets the amount. In 2022 the Berlin data protection authority fined the subsidiary of an e-commerce group EUR 525,000. The DPO was also managing director of two service companies in the group that processed personal data for the company. The person therefore had to monitor processors they ran themselves. The authority had issued a warning in 2021, and the infringement continued. In setting the fine, it took into account the group's turnover in the hundreds of millions and the fact that the DPO stayed in post for almost a year after the warning. It treated the company's cooperation and the end of the infringement during the proceedings as mitigating. When the press release of 20 September 2022 was published, the fine was not yet final.
Revoking the appointment. For the works council chair, the Federal Labour Court held that the conflict of interest justifies revoking the appointment. For an internal DPO, that is not possible at will. Where the appointment is mandatory, removal from office is permitted only under the rules that apply by analogy to § 626 BGB, that is, for good cause. Dismissal is not permitted unless there is good cause, and the protection continues for one year after the office ends (§ 6(4) BDSG, which applies to private companies under § 38(2) BDSG). A wrong appointment can therefore be corrected only under these conditions.
Internal or external: where the conflict arises
Internally, the risk lies in the dual role. Besides any management function, also check side offices, for example on the works council or in the management of other group companies.
Externally, Article 37(6) GDPR allows a service contract. An external DPO stands outside your line hierarchy. That does not make them free of conflicts. The guidelines give an example: a conflict can arise if an external DPO is asked to represent the company in court in data protection disputes. So also look at the other services the same provider delivers for you.
Five steps before you appoint
1. Collect the roles. Write down which positions in your company decide on the purposes and means of processing. These are usually management, IT, HR and marketing, plus any other positions that determine systems or data collection.
2. Check the candidate. Compare the person against this list, including their side functions. These include works council offices, management positions in other group companies and the management of service providers that process personal data for you.
3. Look at the group structure. The Berlin supervisory authority advises checking dual roles in groups for conflicts of interest, particularly where group companies have processor arrangements or joint controllership.
4. Word external contracts precisely. The guidelines recommend wording the job advertisement or service contract precisely enough to avoid a conflict. Specify which tasks the DPO takes on and which they do not. Ask the provider which other services it delivers for you.
5. Write it down. The guidelines call it good practice to identify the incompatible positions, set internal rules for them and state that the DPO has no conflict. The GDPR does not require this. It does help you show that you carried out the check.
The next step is step 1. Whichever model you choose, you need the list of deciding positions before you appoint anyone. Where ETHYX helps: ETHYX provides the external DPO from the Expert plan (EUR 299 a month, two DPO hours included). Ask every provider, including us, which other services it delivers for you. You can compare the costs of the models in the cost comparison. The side-by-side view is in Internal vs. external DPO.