The Appointment of the Inspector General for Data Protection Officer as a sign of corporate social responsibility

Abstract

The reform of the EU’s personal data protection regulations introduces the institution of the Data Protection Officer, assigning it a key role in the new personal data protection system thereto. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, builds the personal data protection model, wherein the main responsibility for adequate assessment of the risk associated with the processing of personal data and for the implementation of internal procedures to assure compliance of the referenced operations with the personal data protection regulations rests with a database administrator. Simultaneously, a database administrator should be capable of proving that he/she has duly met the requirements under the regulations, thus following the crucial rule for the processing of personal data, i.e. data accountability. The EU regulations describe the means and mechanisms to be used by a data processor to a lesser extent than those in force hitherto, focusing more on ensuring the standard of the protection of individual rights through data controllers' ethical and responsible activities.
The key part in the new personal data protection model will be played by the institution of the Data Protection Officer, intended to become a real guarantor of due observance of the personal data protection regulations. In this context, the appointment of the Data Protection Officer by database administrators, not bound to do so by law, should be judged a sign of the organization's corporate social responsibility for the impact of its decisions and activities on society through transparent and ethical conduct. It is therefore essential to emphasize the important function to be performed, the authority to be had, and the necessary preparatory action to be taken by the Data Protection Officer to that effect. The new regulations should be regarded as a chance to professionalize both the individuals, serving as information security officers and, in the near future, the data controllers, as well as the entire occupational group.