Rina Steenkamp - Privacy and technology

My annotated General Data Protection Regulation

Chapter IV Controller and processor

Section 4 Data protection officer

Article 36 Position of the data protection officer

October 2013

Article 36(1)

1. The controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data.

Article 36(2)

2. The controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function. The data protection officer shall directly report to the executive management of the controller or the processor. The controller or processor shall for this purpose designate an executive management member who shall be responsible for the compliance with the provisions of this Regulation.

Article 36(3)

3. The controller or the processor shall support the data protection officer in performing the tasks and shall provide all means, including staff, premises, equipment and any other resources necessary to carry out the duties and tasks referred to in Article 37, and to maintain his or her professional knowledge.

Article 36(4)

4. Data protection officers shall be bound by secrecy concerning the identity of data subjects and concerning circumstances enabling data subjects to be identified, unless they are released from that obligation by the data subject.

[Source: October 2013]

January 2012

Explanatory memorandum

3.4. Detailed explanation of the proposal

Article 36 sets out the position of the data protection officer.

[Source: January 2012 | Context: Proposal from the European Commission]

Article 36(1)

1. The controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data.

Article 36(2) [Amended: October 2013]

2. The controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function. The data protection officer shall directly report to the management of the controller or the processor.

Article 36(3) [Amended: October 2013]

3. The controller or the processor shall support the data protection officer in performing the tasks and shall provide staff, premises, equipment and any other resources necessary to carry out the duties and tasks referred to in Article 37.

[Source: January 2012 | Context: Proposal from the European Commission]