Appointment of Data Protection Officer – first up for review by the Swedish Data Protection Authority

On the 22nd of October, the Swedish Data Protection Authority released its first review after the General Data Protection Regulation 2016/679 (GDPR) went into force. The Swedish Data Protection Authority have reviewed 400 companies and authorities with the purpose to investigate if they fulfil the obligation to designate a data protection officer (DPO), according to Article 37 under the GDPR.

According to Article 37, actors in both the private and the public sector can have a responsibility to designate a DPO. The most important task of the DPO is to supervise that the organisation is compliant with the GDPR. An organisation can voluntarily designate a DPO even if they, according to Article 37, are not obliged to do so. Once a DPO has been appointed, the rules pertaining to the DPO role will apply regardless of whether the appointment was on a voluntary basis or whether it is in fact mandatory for the organisation in question.

In connection to the review, Synch has summarised a few important tips regarding the designation of a DPO. It is of importance to ensure that:

  • the DPO’s contact information (e.g. postal address, a specific phone number or/and a specific e-mail address) is easily accessible, both internally and externally. Another important factor to consider is the importance of confidentiality of the information that the DPO handles on a daily basis. Therefore, it is recommended to have separate contact information to the DPO to which only the DPO will have access to for the purpose of performing their duties;
  • communication occurs in the language or languages used by the affected data subjects and the supervisory authority;
  • the DPO is generally accessible. This will ensure the data subjects can reach the DPO, either in person in the same building as the employees or through a standby phone or other secure ways of communication;
  • the DPO is qualified for the mission;
  • there is no risk of conflict of interest given the DPO’s other tasks and responsibilities; and
  • if the organisation is established in multiple countries, it will suffice if the corporate group designates a DPO as long as the criteria’s stated above is fulfilled.

If you are uncertain about if your organisation falls under the obligation to designate a DPO, or if you have other questions regarding the implementation of GDPR, you are more than welcome to contact our lawyers specialised in data protection at contact@synchlaw.se.

You can also test if your organisation’s Privacy Policy meets the requirements of GDPR in Synch’s AI-tool, Privacy Policy Check.ai.

If you would like to read the Swedish Data Protection Authority’s review in full, you can find it here. (in Swedish)

News and Insights
Press release

Synch Copenhagen and Integra law firms are merging

16 hours ago

The Danish tech-focused law firms Synch and Integra in Copenhagen are merging with effect as of 1 January 2020. The merger will strengthen the position of the merged law firm in the Nordics.

Blog Posts

Unfair Contract Terms in a Consumer Setting

14/01/2020

This blog post is written by Veronica Uddsten, lawyer at Synch When drafting terms and conditions for a B2C-business, it is easy for businesses to primarily focus on the need of the business and fail to take into consideration the fairness of the provisions included from a consumer perspective. As unfair contract terms may become unenforceable, […]

News

Faster review of data processing agreements

13/01/2020

DPA AI, an enterprise-level AI solution for accelerated review of data processing agreements, is featured on Artificial Lawyer, the leading LegalTech news portal in Europe.  The article, written by Sergii Shcherbak, lawyer and Head of Software Development, describes why and how DPA AI was built. The challenge – large amounts of time that big companies […]

Blog Posts

ANONYMISATION AND PSEUDONYMISATION OF PERSONAL DATA

29/11/2019

This blog post is written by Erik Myrberg, lawyer at Synch Recital 26 of the GDPR clarifies that the principles of data protection should not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject […]

Press release

Synch has acted as legal advisor to Zington AB

22/11/2019

Synch has acted as legal advisor to Claremont AB (under name change to Zington AB) with trademark strategy work in connection with its expansion plans to becoming a global brand.

Blog Posts

ABOUT THE NEW PROPOSITION ON GENERAL ADVICE FOR CONSUMER CREDITS

14/11/2019

The rules on how consumer credits can be granted and marketed are spread out in several different acts and regulations.