The data protection officer

When designation is mandatory

The controller and the processor designate a data protection officer in three cases art. 37(1):

• the processing is carried out by a public authority or institution, except courts acting in the administration of justice art. 37(1)(a);
• the core activities consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale art. 37(1)(b);
• the core activities consist of processing on a large scale of special categories of data or of data relating to criminal convictions and offences art. 37(1)(c).

The conditions in the Law do not refer to the size of the company: for example, what matters is who processes the data and what the core activities consist of, not the number of employees art. 37(1). In other cases, designation is voluntary, except where normative acts require it art. 37(4).

Who can be the officer

The officer is designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice, and the ability to fulfil the tasks set by the Law art. 37(5). The officer may be an employee or may work under a service contract art. 37(6). A group of enterprises may designate a single officer, provided that he or she is easily accessible from each establishment art. 37(2). The officer’s contact details are published and communicated to the National Centre for Personal Data Protection art. 37(7).

What safeguards the officer has

The controller involves the officer properly and in a timely manner in all issues relating to data protection art. 38(1) and provides the resources needed to carry out the tasks and to maintain expert knowledge art. 38(2).

The officer receives no instructions regarding the performance of his or her tasks, may not be dismissed or penalised for performing them, and reports directly to the highest management level art. 38(3). Data subjects may contact the officer on any issue relating to their data and their rights art. 38(4). The officer is bound by secrecy or confidentiality in the performance of the tasks art. 38(5). The officer may have other tasks, provided they do not result in a conflict of interests art. 38(6).

What the tasks are

The Law sets the officer’s minimum tasks art. 39(1):

• informing and advising the controller and the employees who carry out processing of their obligations art. 39(1)(a);
• monitoring compliance with the Law and with internal data protection policies art. 39(1)(b);
• providing advice, on request, on the data protection impact assessment art. 39(1)(c);
• cooperating with the Centre art. 39(1)(d) and acting as its contact point, including for prior consultation art. 39(1)(e).

In performing the tasks, the officer has due regard to the risk associated with the processing art. 39(2). Responsibility for compliance nevertheless remains with the controller, which must be able to demonstrate that processing complies with the Law art. 24(1).

Why it matters

Infringements of the obligations concerning the data protection officer are punishable by fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher art. 88(1)(a).