The role of the European Union's Data Protection Officer (Encarregado)

October 12, 2020

The position of ‘Data Protection Officer’ – established initially under the terms of the EU’s General Data Protection Regulation (GDPR) – has been imported into Brazil’s equivalent General Data Protection Law (LGDP) with the slightly peculiar title of  “Encarregado.”

The European Union’s GDPR data protection legislation came into force on March 25, 2018, while Brazil’s LGDP was published on August 13, 2018, but only came into force on September 18, 2020.

Europe’s Data Protection Supervisor, the European Union’s independent data protection authority,  establishes the responsibilities of the Data Protection Officer (DPO).  Perhaps the key proviso for the position is to ensure that their organization processes the personal data of its staff, customers, suppliers, or any other individuals (or data subjects), under the applicable data protection rules.

The DPO must fulfill their functions independently and not receive instructions on how to perform their duties from any other person or entity.

There should be no conflict of interest between an individual’s duties as a DPO and any other responsibilities they may have that might compromise their obligations as DPO.

The data protection authority makes the following recommendations to minimize situations of conflicting interests.  The DPO should:

  1. not also control data handling activities (for example, serve as the human resources manager);
  2. not be an employee on a short-term contract;
  3. not report to a direct superior who is not a senior manager; and
  4. have the ability to manage their own budget.

Let’s examine the main tasks of the DPO:

Ensure that controllers and data owners are informed of their data protection rights, obligations, and responsibilities and raise awareness of same;
Provide advice and recommendations to the institution regarding the interpretation or application of data protection rules;
Create a register of data processing operations within the institution and notify the EDPS of those that present specific risks (so-called prior controls);
Ensure data protection compliance within their institution and assisting them in being responsible in this regard.
Handle inquiries or complaints at the request of the institution, the controller, another person, or on their initiative;
Cooperate with EDPS (respond to requests for investigations, complaints handling, inspections carried out by EDPS, etc.);
Draw the institution’s attention to any failure to comply with the applicable data protection rules.

RECENT POSTS

LINKEDIN FEED

Newsletter

Register your email and receive our updates

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

FOLLOW US ON SOCIAL MEDIA

Newsletter

Register your email and receive our updates-

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

FOLLOW US ON SOCIAL MEDIA

Licks Attorneys' Government Affairs & International Relations Blog

Doing Business in Brazil: Political and economic landscape

Licks Attorneys' COMPLIANCE Blog

The role of the European Union's Data Protection Officer (Encarregado)

No items found.

The position of ‘Data Protection Officer’ – established initially under the terms of the EU’s General Data Protection Regulation (GDPR) – has been imported into Brazil’s equivalent General Data Protection Law (LGDP) with the slightly peculiar title of  “Encarregado.”

The European Union’s GDPR data protection legislation came into force on March 25, 2018, while Brazil’s LGDP was published on August 13, 2018, but only came into force on September 18, 2020.

Europe’s Data Protection Supervisor, the European Union’s independent data protection authority,  establishes the responsibilities of the Data Protection Officer (DPO).  Perhaps the key proviso for the position is to ensure that their organization processes the personal data of its staff, customers, suppliers, or any other individuals (or data subjects), under the applicable data protection rules.

The DPO must fulfill their functions independently and not receive instructions on how to perform their duties from any other person or entity.

There should be no conflict of interest between an individual’s duties as a DPO and any other responsibilities they may have that might compromise their obligations as DPO.

The data protection authority makes the following recommendations to minimize situations of conflicting interests.  The DPO should:

  1. not also control data handling activities (for example, serve as the human resources manager);
  2. not be an employee on a short-term contract;
  3. not report to a direct superior who is not a senior manager; and
  4. have the ability to manage their own budget.

Let’s examine the main tasks of the DPO:

Ensure that controllers and data owners are informed of their data protection rights, obligations, and responsibilities and raise awareness of same;
Provide advice and recommendations to the institution regarding the interpretation or application of data protection rules;
Create a register of data processing operations within the institution and notify the EDPS of those that present specific risks (so-called prior controls);
Ensure data protection compliance within their institution and assisting them in being responsible in this regard.
Handle inquiries or complaints at the request of the institution, the controller, another person, or on their initiative;
Cooperate with EDPS (respond to requests for investigations, complaints handling, inspections carried out by EDPS, etc.);
Draw the institution’s attention to any failure to comply with the applicable data protection rules.
No items found.