On March 15, 2023, the European Data Protection Board launched the second coordinated enforcement action, following the previous one in 2022, on the designation and position of the DPOs within the organization of companies and entities.
It is intended to ascertain, through the dissemination and filling out of questionnaires, whether DPOs carry out their activities without conflicts of interest and with the availability of resources provided by data controllers and processors, to an adequate extent to carry out the tasks assigned by the GDPR to this role.
What is the CEF
CEF stands for Coordinated Enforcement Framework, i.e., an initiative promoted by the EDPB and its member authorities to deepen with coordinated action and method, specific issues of the GDPR: an implementation framework with the goal of ensuring that data protection authorities are able to effectively enforce the regulation in a coordinated manner.
The operations generally take place throughout a year, and each year a topic is identified for investigation.
Goals and outcomes of the CEF
The main goals of the CEF are to promote compliance and increase the authorities’ knowledge of the issues covered. These aims are pursued through joint information gathering, investigations and joint investigations. The overall results are aggregated and then summarized in a report containing recommendations, prepared by the EDPB.
National authorities define the scope of their respective implementation. The implementation of the CEF does not preclude the supervisory national authorities, competent to conduct investigations and ensure the implementation of the GDPR, using their powers under Article 58 of the Regulation, from carrying out specific investigations or imposing specific measures.
Legal bases of the CEF and mechanisms for cooperation and assistance
The legal bases of the CEF are that of Articles 61 and 57 of the GDPR; in fact, Article 61(1) requires national authorities to take measures for effective mutual cooperation and Article 57(1)(g) prescribes the obligation of cooperationbetween authorities to ensure the consistency of application of the GDPR. Although the CEF finds its legal bases in the aforementioned articles of the GDPR, it plays a complementary rather than a substitute, as well a reinforcing, function to the cooperation and consistency mechanisms provided for in the regulation.
The cooperation mechanism of Article 60, also called one-stop-shop comes into play in cases of processing with effects in more than one member state (cross-border processing): in this circumstance, its application is mandatory. The CEF, on the other hand, neither binds national authorities to adhere to it nor presupposes the existence of cross-border processing. Nothing also precludes the CEF from triggering the one-stop-shop mechanism if a data controller/processor, which is the subject of the analysis of the joint action, carries out cross-border processing.
The mutual assistance obligation dictated by Article 61 of the GDPR is triggered by an authority needing assistance to perform its tasks. Again, it does not necessarily require that there is cross-border processing. With Article 61, the authority requests assistance from other authorities for specific issues or cases, with the CEF, on the other hand, multiple authorities act in a coordinated manner to simultaneously examine the same issue.
More similarities exist between the CEF and the joint operations dictated by Article 62 of the GDPR, which are also not limited to cross-border cases, as the CEF can be implemented through joint operations but has a broader framework than the latter.
As noted by the EDPB in the Coordinated Enforcement Framework Document, adopted on October 20, 2020, the cooperation and consistency mechanisms under Chapter VII of the GDPR are predominantly triggered by the handling of complaints received by an authority, so they are reactive actions; in contrast, actions under the CEF are proactive or preventive.
Voluntary participation of DPAs
Although the legal bases of the CEF are identified in the articles of the GDPR that impose obligations on national authorities to cooperate and collaborate with one another, the participation of authorities in the CEF is voluntary; however, the goal is to “maximize the participation of supervisory authorities in the agreed annual coordinated action” (see Document, point 7).
Previous CEFs
The first CEF was conducted in 2022 and was the result of the work of 22 EEA authorities, on the topic of the use of cloud-based services by the public sector. The outcomes of the investigation, which involved a hundred entities in the health, finance, tax, education, central buyers or providers of IT services sectors, fed into the report published by the EDPB in which public entities are advised to pay special attention when negotiating cloud contracts, involving the DPO, and reminded of the obligation to conduct a DPIA.
In Italy, according to the Italian Data Protection Authority’s report “there is a general lack of awareness when it comes to transfers to third countries and requests from public authorities in third countries for access to data stored in the European Economic Area, as well as the possible further data processing carried out by cloud service providers through telemetry (used to monitor operations of the infrastructure).” In addition, some entities have also complained on how cloud providers do not allow the conduct of verification and inspection activities.
CEF 2023 on the position of DPOs
On March 15, 2023, the EDPB launched the CEF, which will take place throughout 2023 and will involve 26 authorities from the European Economic Area, including the EDPS.
The topic of the 2023 CEF (already announced in September 2022) is the verification of the designation and position of Data Protection Officers, with the aim of ascertaining whether they have the necessary resources to carry out their tasks.
CJEU Feb. 9, 2023
The CJEU’s February 9, 2023 decision in X-FAB v. FC (Case C-453/21) dealt with issues similar to those addressed in the CEF 2023. The CJEU decision concerned a request for a preliminary ruling on the interpretation to be given to the two provisions of the GDPR according to which:
- “The Data Protection Officer shall not be dismissed or penalised by the controller or the processor for performing his tasks.” (art. 38(3), GDPR)
- “The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.” (art. 38(6), GDPR).
Independence of the DPO
According to the CJEU, the prohibition imposed on the controller or processor “to dismiss or penalise a DPO means that the DPO must be protected against any decision that terminates his or her duties, causes him or her to suffer a disadvantage or constitutes a punishment” because of the performance of his or her duties. This prohibition applies indiscriminately both to the DPO who is an employee and to one who performs his duties under a contract (FAB v. FC, C-453/21, pp. 21 and 23).
In addition, the independence of DPOs “must necessarily enable them to carry out those tasks in accordance with the objective of the GDPR, which seeks, inter alia, as is apparent from recital 10 thereof, to ensure a high level of protection of natural persons within the European Union and, to that end, to ensure a consistent and homogeneous application of the rules for the protection of the fundamental rights and freedoms of such natural persons with regard to the processing of personal data throughout the European Union” (FAB v. FC, cit., p. 25). The independent nature of the DPO is also reflected in the other provisions of the GDPR that stipulate that the DPO:
- does not receive any instructions regarding the exercise of his/her tasks (art. 38(3), first sentence)
- shall directly report to the highest management level of the controller or the processor (art. 38(3), third sentence)
- shall be bound by secrecy or confidentiality (art. 38(5), GDPR) (FAB v. FC, cit., p. 26).
In contrast, the DPO’s enhanced protection cannot be understood as preventing “any dismissal of him/her in the event that he or she is not, or is no longer, in a position to carry out his or her tasks in an independent manner on account of there being a conflict of interests would undermine the achievement of that objective” since such interpretation “would undermine the realization of the GDPR’s aim to ensure a high level of protection of natural persons within the European Union with regard to the processing of their personal data” (FAB v. FC, cit., pp. 32-34).
Conflict of interests
With respect to the question of what are the circumstances under which a “conflict of interests” can be found to exist under Article 38(6) of the GDPR, the Court points out that:
- That the GDPR does not establish that there is a fundamental incompatibility between, on the one hand, the performance of DPO’s duties and, on the other hand, the performance of other duties within the controller or processor
- It may exist a conflict of interest where a DPO is entrusted with other tasks or duties, which would result in him or her determining the objectives and methods of processing personal data on the part of the controller or its processor, which is a matter to determine, case by case (FAB v. FC, cit., pp. 40-46).
DPOs questionnaire
To carry out the investigations covered by the CEF 2023, the national authorities send out a questionnaire for survey purposes to gather information to assess the need for any formal investigations. Sending the questionnaire to preselected recipients is part of the task of conducting GDPR enforcement investigations, which is assigned to the national supervisory authority by Article 57(1)(h) of the Regulation.
DPOs of companies established in some member states have already received the questionnaire, which appears to be very comprehensive (39 questions).
The following considerations emerged from the form that was accessed:
- most of the questions are mandatory and, some, may generate others
- the detailed identification of the controller or the processor for whom you are the DPO is required, with the specification of whether if they are are a public body or a private company
- the data identifying the respondent, who is also expected to be a person other than the DPO, are optional
- some questions with mandatory response, provide that the respondent can select the option to refuse to answer (highlighted, below, with “*”)
- is asked to specify:
- the legal reason for designating the DPO (Art. 37(1) and (4) of the GDPR) or for not designating it
- whether you are a group DPO, internal to the organization, or acting by contract*
- the number of hours of activities performed as DPO
- the duration of the assignment*
- the department to which the DPO* belongs
- the specific expertise of the DPO*
- the requirements at the time of the designation*
- the years of experience in interpreting data protection requirements and in the specific industry*
- the hours of training on an annual basis*
- whether the tasks assigned are specified, whether they are communicated to staff and whether they are comprehensive with respect to what is required by the GDPR*
- whether the DPO activity is full-time and whether the DPO is assigned other resources*
- whether a replacement is planned*
- if there is an available budget that the DPO can freely dispose of*.
- whether the DPO has other additional duties*.
- the percentage of time the DPO is involved by the organization, e.g., for data breaches*
- whether the DPO has access to necessary information and whether his or her opinion is taken into account and, if not, whether this is documented*
- if the DPO experiences interference in the performance of the mandate*.
- if the DPO reports directly to the higher level management*.
Voluntary or mandatory nature of the participation in the survey
Theoretically, participation in the survey is optional; however, the recipient is asked to acknowledge receipt of the survey and to communicate his or her intention to participate or not to participate in the survey. In addition-as pointed out-for some answers identified as mandatory, one can also choose the option not to answer. Finally, the questionnaire cannot be considered anonymous, given the numerous references it contains.
Ultimately, to be able to consider the completion of the survey questionnaire truly optional it would have to be completely anonymous and devoid of any conceivable consequences for those who decide to fill it out or abstain from it, a conclusion that does not seem to be possible to reach.
Moreover, on the basis of the feedback received, each national authority will “assess, then, any further action at national level” (see Italian Data Protection Authority’s newsletter dated 3/15/2023, web doc. no. 9864636).
DPOs as recipients
Some perplexity was raised by the circumstance of identifying DPOs as potential recipients of questionnaires related to their specific status.
On the one hand, it appeared to risk putting DPOs in the delicate alternative between possibly reporting potentially non-compliant behavior of their controllers or processors and possibly deciding not to answer the entire questionnaire or certain questions.
On the other hand, by considering DPOs as recipients, further investigation having to do with possible violations of the obligation to designation, by controllers and processors who were required to do so, could be prejudiced.
