Article 38. Position of the data protection officer

(1) The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

(2) The controller and the processor shall support the data protection officer in performing the tasks referred to in art. 39 by providing him or her with the resources necessary to carry out those tasks, to access personal data and processing operations, and to maintain his or her expert knowledge.

(3) The controller and the processor shall ensure that the data protection officer does not receive any instructions regarding the performance of his or her tasks. The data protection officer shall not be dismissed or penalised by the controller or the processor for performing his or her tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.

(4) Data subjects may contact the data protection officer with regard to all issues related to the processing of their personal data and to the exercise of their rights under this Law.

(5) The data protection officer shall observe secrecy or confidentiality concerning the performance of his or her tasks, in accordance with normative acts.

(6) The data protection officer may also fulfil other tasks and duties. The controller or the processor shall ensure that none of those tasks and duties results in a conflict of interests.