Survey investigating the position of Data Protection Officers launched
The Office of the Data Protection Ombudsman is investigating the appointment and position of Data Protection Officers in Finland. The survey is part of the European Data Protection Board's coordinated action in which data protection authorities will determine whether Data Protection Officers have the position required by the EU General Data Protection Regulation and sufficient resources for performing their duties. The survey was sent to 50 Data Protection Officers working in Finland on 19 May.
The data protection authorities intend to find out how the appointment and position of Data Protection Officers have been implemented in the EEA member states. The action will be implemented in 2023 by 26 data protection supervision authorities. The situation will be investigated with a survey for Data Protection Officers.
The Office of the Data Protection Ombudsman has chosen the organisations for the survey based on, for example, their sector, other operators in their sector, number of personnel and customers, organisations' geographical location, the significance of the personal data being processed and the organisation's influence on Finnish society. Even representation of different administrative branches was taken into account in the choice of agencies. The recipients of the survey were limited to the Data Protection Officers of 50 organisations, predominantly from the public sector.
National supervisory authorities may also carry out other studies to determine the position of Data Protection Officers. The authorities will analyse the results of the action in a coordinated manner and decide on possible further measures on the national level. Further measures can also be taken on the EU level based on the results. The European Data Protection Board will publish a report on the results of the joint action after its conclusion.
The Data Protection Officer's contact details must be communicated to the Office of the Data Protection Ombudsman
Data Protection Officers are internal data protection experts in their organisations, who give advice on compliance with data protection regulations and serve as points of contact for data subjects in matters related to the processing of personal data.
Data Protection Officers play an important role in promoting the rights of the data subject and compliance with data protection legislation. Data Protection Officers bring up any shortcomings they discover and offer advice to the management and to the employees who process personal data.
A Data Protection Officer must be appointed if, for example, the organisation processes sensitive information on a large scale or carries out regular and extensive monitoring, or when the processing is done by a public authority or body, except for courts acting in their judicial capacity.
The Data Protection Ombudsman reminds organisations that the Data Protection Officer's contact details must be communicated to the Office of the Data Protection Ombudsman. The organisation must also notify the Office of the Data Protection Ombudsman if the Data Protection Officer or their contact details change.
Further information:
Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel. +358 29 566 6766
Deputy Data Protection Ombudsman Heljä-Tuulia Pihamaa, helja-tuulia.pihamaa(at)om.fi, tel. +358 29 566 6787
Press release of the launch of the action on the European Data Protection Board's website: Launch of coordinated enforcement on role of data protection officers (15 March 2023)
Notifying the Office of the Data Protection Ombudsman of the Data Protection Officer
The European Data Protection Board (EDPB) is an independent EU body composed of representatives of the EU's national data protection authorities and the European Data Protection Supervisor (EDPS). The EEA countries Iceland, Norway and Liechtenstein are also members of the EDPB. The EDPB is responsible for ensuring the consistent application of the EU General Data Protection Regulation and Law Enforcement Directive.