Contact
The Catalan Data Protection Authority (APDCAT) has published Recommendation 2/2023, to warn the entities in its scope of action that the relevance of the functions to be carried out must be taken into account when setting contract prices of the data protection officer (DPO) services to adjust the recruitment to the regulations. This after verifying tenders in which the price factor was exclusively taken into account and, even, a notoriously low estimated value of the contract was established in relation to the activity to be carried out.
The APDCAT also reminds that the contracting of this type of service, due to its relevance, cannot be limited exclusively to economic criteria (lowest price), but that, in addition, qualitative criteria must be taken into account. In this regard, the General Data Protection Regulation requires that this figure be appointed based on his professional qualities and, in particular, his specialized knowledge of law, his practice in data protection and his ability to carry out the duties entrusted to him .
A DPO in all public administrations
The rule obliges all public administrations to designate a data protection officer to ensure compliance with these principles in organizations, and some private ones in accordance with their activity. This figure must participate appropriately, and in a timely manner, in all matters relating to data protection within the entity.
At least among their functions is to inform and advise of their obligations to the entity responsible or in charge of data processing, and the employees who deal with it; supervise compliance with the provisions of the regulations on the protection of personal data, including the assignment of responsibilities, the awareness and training of personnel participating in the processing operations and the corresponding audits. It must also provide the advice requested on the data protection impact assessment and supervise its application; cooperate with the corresponding control authority, and act as a point of contact with this authority.
Promotion and recognition of the figure of the DPO
The APDCAT works to provide tools and resources to DPOs in Catalonia, a key figure for the correct application of data protection regulations in organizations. Thus, it has recently launched 'DPD en xarxa', the first learning and collaboration network of DPOs in Catalonia, with the aim of promoting training, interaction and cooperation between the people who exercise this function in the organizations Catalans from their area.
It also regularly organizes specialization courses and workshops for this group, with the support of the School of Public Administration of Catalonia.
The Catalan Data Protection Authority has published a new recommendation after detecting tenders for this type of service with a notoriously low price in relation to the tasks to be carried out.