出海歐洲 | 數據保護官（DPO）——你的公司需要任命DPO嗎？

數據保護官（DPO）是GDPR框架下設立的一個獨立職位，旨在確保組織機構遵守數據保護法規。DPO並非僅僅是一個頭銜，而是一個具備專業知識和獨立性的關鍵角色。其核心作用是作為數據控制者或數據處理者與數據主體（即個人數據的所有者）以及監管機構之間的聯絡點。DPO的獨立性至關重要，這意味著他們在履行職責時，不應受到公司內部的指示或幹預，並且不能因履行DPO職責而受到懲罰或解雇。GDPR明確要求DPO應根據其專業素質，特別是數據保護法律和實踐的專業知識以及履行《通用數據保護條例》第39條所述任務的能力來指定。

GDPR第37條明確規定了需要強制任命DPO的三種情況：

1. 公共機構或團體： 除了司法機構在履行司法職能時，所有公共機構或團體都必須任命DPO。

2. 核心活動涉及大規模、系統性監控數據主體： 如果數據控制者或數據處理者的核心活動，就其性質、範圍和/或目的而言，需要對數據主體進行大規模、定期和系統性的監控，則必須任命DPO。這裏的“監控”包括所有形式的在線跟蹤和畫像，例如行為廣告。

3. 核心活動涉及大規模處理特殊類別數據或刑事定罪和犯罪數據： 如果數據控制者或數據處理者的核心活動涉及大規模處理《通用數據保護條例》第9條規定的特殊類別數據（如健康數據、種族或民族來源、政治觀點、宗教或哲學信仰、工會會員資格、遺傳數據、生物識別數據等）或第10條規定的與刑事定罪和犯罪相關的個人數據，則必須任命DPO。

為了更好地理解這些規定，我們可以結合一些實際案例：

• DPO強制任命的案例：

  🔸一家大型醫院，處理大量敏感的健康數據，需要任命DPO。

  🔸一家負責監控購物中心和公共場所的安保公司，其核心業務涉及對個人進行大規模、系統性監控，需要任命DPO。

  🔸一家小型獵頭公司，通過對個人進行畫像來匹配職位，如果其活動涉及大規模、系統性監控，也可能需要任命DPO。

• DPO非強制任命的案例：

  🔸一名當地社區醫生，處理其患者的個人數據，但規模不大，通常不需要任命DPO。

  🔸一家小型律師事務所，處理其客戶的個人數據，但並非大規模或系統性監控，通常不需要任命DPO。

需要注意的是，即使不屬於上述強制任命DPO的情況，企業也可以自願任命DPO。此外，歐盟成員國法律或歐盟法律也可能要求在特定情況下任命DPO。

A Data Protection Officer (DPO) is an independent position established under the GDPR framework, designed to ensure that organizations comply with data protection regulations. A DPO is not merely a title but a key role possessing professional knowledge and independence. Their core function is to serve as a contact point between the data controller or processor, data subjects (i.e., owners of personal data), and supervisory authorities. The independence of the DPO is paramount, meaning they should not receive instructions or interference from within the company when performing their duties, and they should not be penalized or dismissed for fulfilling their DPO responsibilities. GDPR explicitly requires that the DPO be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfill the tasks referred to in Article 39 of the General Data Protection Regulation.

Article 37 of the GDPR clearly stipulates three situations where a DPO appointment is mandatory：

1. Public Authorities or Bodies: With the exception of courts acting in their judicial capacity, all public authorities or bodies must appoint a DPO.

2. Core Activities Involve Large-Scale, Regular, and Systematic Monitoring of Data Subjects: If the core activities of the controller or processor, by virtue of their nature, scope, and/or purposes, require regular and systematic monitoring of data subjects on a large scale, then a DPO must be appointed. Here, “monitoring” includes all forms of online tracking and profiling, such as for behavioral advertising.

3. Core Activities Involve Large-Scale Processing of Special Categories of Data or Data Relating to Criminal Convictions and Offenses: If the core activities of the controller or processor involve large-scale processing of special categories of data as defined in Article 9 of the General Data Protection Regulation (e.g., health data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data) or personal data relating to criminal convictions and offenses as referred to in Article 10, then a DPO must be appointed.

To better understand these provisions, let’s consider some practical examples:

• Cases where DPO appointment is mandatory:

  🔸A large hospital that processes extensive sensitive health data needs to appoint a DPO.

  🔸A security company responsible for monitoring shopping centers and public spaces, whose core business involves large-scale, systematic monitoring of individuals, needs to appoint a DPO.

  🔸A small head-hunting company that profiles individuals to match job positions may also need to appoint a DPO if its activities involve large-scale, systematic monitoring.

• Cases where DPO appointment is not mandatory:

  🔸A local community doctor who processes personal data of their patients, but not on a large scale, typically does not need to appoint a DPO.

  🔸A small law firm that processes personal data of its clients, but not on a large scale or for systematic monitoring, typically does not need to appoint a DPO.

It is important to note that even if a company does not fall under the mandatory DPO appointment situations, it may voluntarily appoint a DPO. Furthermore, EU Member State law or EU law may also require the appointment of a DPO in specific circumstances.