CJEU issues rules on data protection officers and conflicts of interest

The Court of Justice of the European Union (CJEU) issued a ruling on 9 February 2023 holding that a DPO can maintain other tasks and duties, as long as they do not result in a conflict of interest.

The ruling came in response to a case brought from the German Federal Labour Court, Bundesarbeitsgericht, to the CJEU and impacts businesses throughout the EU and their compliance with the GDPR regarding the role of DPOs.

The case concerned an employee who worked for his employer in the capacity of a DPO, alongside performing other tasks and duties such as chair of the works council. The employee was dismissed from his DPO position due to an alleged conflict of interest with his other tasks and duties. The employee brought an action before the German Federal Labour Court seeking a declaration that he should retain his position as DPO. The CJEU issued a preliminary ruling on the matter, stating that:

• A DPO can maintain other tasks and duties in their role, as long as they are "in a position to perform their duties and tasks in an independent manner" which does not result in a conflict of interest. However, a conflict of interest can arise for a DPO where they are to determine the "objectives and methods of processing personal data on the part of the controller of its processor" and
• Article 38(3) which states that DPOs cannot be dismissed or penalised for performing their tasks, does not prevent national laws from establishing additional protections to protect their DPOs from dismissal, provided that the additional protections do not "compromise the principal objectives of the GDPR to maintain high levels of data protection".

The CJEU stated that conflicts of interest for a DPO "is a matter for the national court to determine, case by case, on the basis of an assessment of all the relevant circumstances".