20
Tue, Feb
58 New Articles

Can You Dismiss Your DPO?

Can You Dismiss Your DPO?

Briefings
Tools
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

The European Court of Justice ("ECJ"), in its judgment of 9 February 2023 in Case C-453/21, considered the interpretation of the dismissability of a Data Protection Officer and the performance by the DPO of other duties that may give rise to a conflict of interest. The ECJ ruled that an appointed DPO cannot hold a position within the organisation that would result in him or her determining the purposes and methods of processing personal data. The decision has significant implications for organisations wishing to entrust their DPO with additional tasks that may conflict with the DPO's duties.

X-Fab, a company based in Germany, appointed a DPO in 2015 who, in addition to his data protection-related duties, was also the chair of the local works council and the deputy chair of the central works council. X-Fab later dismissed the DPO in 2017 at the request of the State Commissioner for Data Protection and Freedom of Information of Thuringia, Germany, due to a conflict of interest between the DPO's duties within the company. Later, the X-Fab companies repeated the dismissal of the DPO on the basis of the second sentence of Art. 38(3) GDPR. The former DPO considered his dismissal unlawful and went to court, and the case ended up before the German Federal Labour Court, which referred its questions to the ECJ.

The ECJ ruled that a DPO can be dismissed under certain conditions, based on national law, without undermining the objectives of the GDPR.

Furthermore, the ECJ held that the DPO may be entrusted with tasks, provided that the DPO does not in any way determine the purposes and methods of the processing carried out by the controller or its processor. The CJEU emphasised that such tasks and the related potential conflict of interest must be assessed on a case-by-case basis, including in the light of the organisational structure of the controller or processor and the applicable internal company policies.

In practice, the CJEU's ruling means that a DPO and the tasks of a DPO must be interpreted - on a case-by-case basis applicable to the organisation concerned - in such a way as to ensure the functional requirements and objectives set out in the GDPR and applicable national legislation, but the DPO can in no way be tasked with determining the purposes and methods of data processing activities, and the DPO can be dismissed on the basis of national legislation, without prejudice to the organisational objectives of GDPR compliance.

By Adam Liber and Tamas Bereczki, Partners, Provaris

 

Hungary Knowledge Partner

Nagy és Trócsányi was founded in 1991, turned into limited professional partnership (in Hungarian: ügyvédi iroda) in 1992, with the aim of offering sophisticated legal services. The firm continues to seek excellence in a comprehensive and modern practice, which spans international commercial and business law. 

The firm’s lawyers provide clients with advice and representation in an active, thoughtful and ethical manner, with a real understanding of clients‘ business needs and the markets in which they operate.

The firm is one of the largest home-grown independent law firms in Hungary. Currently Nagy és Trócsányi has 26 lawyers out of which there are 8 active partners. All partners are equity partners.

Nagy és Trócsányi is a legal entity and registered with the Budapest Bar Association. All lawyers of the Budapest office are either members of, or registered as clerks with, the Budapest Bar Association. Several of the firm’s lawyers are admitted attorneys or registered as legal consultants in New York.

The firm advises a broad range of clients, including numerous multinational corporations. 

Our activity focuses on the following practice areas: M&A, company law, litigation and dispute resolution, real estate law, banking and finance, project financing, insolvency and restructuring, venture capital investment, taxation, competition, utilities, energy, media and telecommunication.

Nagy és Trócsányi is the exclusive member firm in Hungary for Lex Mundi – the world’s leading network of independent law firms with in-depth experience in 100+countries worldwide.

The firm advises a broad range of clients, including numerous multinational corporations. Among our key clients are: OTP Bank, Sberbank, Erste Bank, Scania, KS ORKA, Mannvit, DAF Trucks, Booking.com, Museum of Fine Arts of Budapest, Hungarian Post Pte Ltd, Hiventures, Strabag, CPI Hungary, Givaudan, Marks & Spencer, CBA.

Firm's website.

Our Latest Issue