Legal regulation of breach of contracts with Data Protection Officer

Since May 25, 2018, after the entry into force of the General Data Protection Regulation (General Data Protection Regulation, GDPR 2016/679), many EU companies are required to accept a new employee for permanent employment. We are talking about an official who will deal with the direction of data protection, or a DPO (Data protection officer).

It is essential to understand that these are critical requirements to comply with the entire regulatory mechanism, since it is this official who is fully responsible for the processing of personal data and the implementation of all other principles of the GDPR, including records of confidentiality, protection, use, data verification (Art. 37 - 39).

Details

Following the open practice of the EU in 2019, it can be argued that lawyers were appointed to perform the functions of the Data Protection Officer, as well as 4th-year law students who have sufficient professional skills and knowledge of data protection regulations to perform the following tasks:

List:

Inform the controller and data processor of their obligations regarding the data protection regulations;
Monitor compliance with the rules and requirements of the regulations;
To be a representative in the supervisory authority for compliance with the regulations;
Be a consultant in any situations affecting the regulations.

The peculiarities of legal registration of such a position are dictated by some requirements for the organization of its functions:

The area is directly subordinate to the highest authorities of the Company;
An area may not receive any instructions for execution from other positions related to data processing, a controller or a data processor, for objective control and organization of labour;
The position may perform different functions if they do not contradict the basic job descriptions and are possible in the work schedule and business process of the Company.

General legislation does not limit the form of appointment of such an employee, but at the same time provides a reasonably flexible system for accepting such a post to perform the necessary functions. It may be an employment contract, an outsourcing contract (outstaffing), or a contract for the provision of services with the remote performance of work.

Addition

In this case, the mandatory requirements for the implementation of such action must be met in contact:

Namely:

An employee cannot work more than 48 hours a day (EU's Working Time Directive (2003/88 / EC);
The employee also retains the right to flexible working hours (Brussels, 07/16/2002. Framework agreement on telework);
The Company must provide a break of at least 20 minutes if the employee is continuously working 6 hours a day, which is still considered working time.

(Decision on the case of Hughes v Corps of Commissionaires Management Ltd), including if the employee provides labour services remotely from the state of the Company (decision on the matter of Russell v Transocean International Resources Ltd 2011)

The Company provides four weeks of paid vacation per year (Directive (2005/47 / EC);
The Company is obliged to keep up-to-date records of the employee's working time, which perform such work, and consider the job done to be appropriate, and any breaks or vacations such as not provided (Crawford v Network Rail Infrastructure Limited Solution);
Mandatory one day off every 7 working days, regardless of the complexity of the work (Maio Marques da Rosa v Varzimsol); provision of holidays during the religious holidays, an additional 48 hours of rest if it is impossible to determine the control time of other employees (Working Time Directive (Directive 2003/88 / EC of November 4 2003)).

However, there are some requirements for the conclusion of a contract with a DPO:

A DPO must be independent of the Company because he or she must be able to balance the interests of the organization with the benefits of people whose data can be processed by the organization. In this regard, the role of the DPO is to some extent comparable to the work council that represents the interests of the workers;
A DPO cannot represent the interests of an organization before the owners of the data, just as it cannot represent the interests of the owners of the data before state authorities;
DPO cannot provide the benefits of state regulatory bodies to the Company, but it is liable for it to communicate changes in legislation for the Company, as well as violations by the Company's employees to state bodies.

Ensuring GDPR Compliance

To ensure the standards of GDPR, business processes, methods of collecting and storing information, as well as methods of regulating the work of employees in the Company to assess the regulations governing an employee's work should be taken into account. Elements that must necessarily be taken into account by the Company and reflected in the Contract:

The exclusivity of the work schedule, which would correspond to the process of the Company (for example, in the case of two offices in different locations with different time zones, you should hire different employees);
The exclusivity of data for verification and data indicators (language, the form of checking, storage methods and technical tools to ensure the activities of the employee must be specified in the Contract);
The exclusivity of the reporting period and the form of such a report (a report and a voting report cannot be filed while the employee is on vacation, on long-term sick leave, or religious holidays);
The exclusivity of employee fixation methods and employee work time (in case of disagreement on the fulfilment of obligations);
The exceptionality of the contract validity with grounds for termination (termination due to disappearances of grounds for concluding an agreement with the second employee to replace the principal during the employee's leave, or long-term illness, pregnancy, or upon expiration of the control obligations of an individual office taken, or clear language requirement);
Exceptional pay for spent labour hours.

In the event of non-compliance with such requirements, the Company will retain obligations to the employees in full if it were to carry out these works correctly regardless of the acceptance of such services by the Company or unilateral termination of the Contract (Negligence Duty vs Nulla negligence principle).

Analyzing the above, we can conclude that the legal regulation of the grounds for breaking the Contract with Data Protection Officer. It is limited not only by law, but also by the Company's care in organizing the work of its employees and drawing up new flexible grounds for protecting its interests, which are not expressly provided for in General Data Protection Regulation, but which correspond to the Company's business process.

At the same time, the Contract itself can become indefinite and inseparable, giving the employee maximum freedom and irresponsibility, leaving the right to terminate the Contract based on only unfair contract terms for the employee himself, in cases of negligent inattention of the Company during its drafting.

KEY BENEFITS OF LEGAL SERVICES OFFERED BY LAW AND TRUST INTERNATIONAL

Преимущества нашей юридической экспертизы-1

Experience and qualifications. The experience of the L&T International team is more than 15 years. It gives the opportunity for working with cases in many business areas like finance, IT, agriculture, trade and foreign economic activity. Thanks to this experience, our specialists always offer the best selection of services.

Comprehensive approach and individual solutions. Law and Trust International always provides a vast range of services for our clients, taking into account the individual characteristics of each particular case. Due to this symbiosis, our specialists always fulfil all the wishes of clients in full and taking into account the requests and preferences of customers.

Monitoring and innovation.Our team keeps tracking the newest and most advanced working methods, as well as the latest legislative, financial and economic information events around the world. It allows lawyers of Law and Trust International to quickly and creatively resolve virtually any issues in the field of legal consulting.

Privacy and responsibility. The security of our customers' data and respond to them are particularly important in the work of Law and Trust International. For all the time of work, we have not had a single leak of commercial, personal or legal information. It allows us to develop, grow and achieve new opportunities.

Reputation and result. A team of lawyers of Law and Trust International always welcomes the success of our clients. Reaching new results, we develop new skills that we successfully use in our work. Thanks to successful cases, our clients and our team, we are creating qualitatively new opportunities to achieve the desired result now.