Re:Why It’s Hard for Startups to Create Wealth in Europe
by M2Ys4U on Thursday October 03, 2019 @05:09AM
(#21145022)
That's not what the GDPR says. There's no bright line for the number of employees handling data.
A DPO should be assigned if:
>(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
>(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
>(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
(Article 37)
And in any case a data protection officer is different from a representative, as the title of Article 27 indicates ("Representatives of controllers or processors not established in the Union").
A DPO should be assigned if:
>(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
>(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
>(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
(Article 37)
And in any case a data protection officer is different from a representative, as the title of Article 27 indicates ("Representatives of controllers or processors not established in the Union").