Part 9: Data Protection Impact Assessment and Data Protection Officer

The GDPR expects an effective approach to risk management, and key elements of this are the Data Protection Impact Assessment and the Data Protection Officer role.

Data Protection Impact Assessment

Following Part 8 of this guidance, schools will need to give consideration to the risks to Data Subjects of different Processing activities they undertake (or plan to undertake).

A Data Protection Impact Assessment (DPIA) is performed for this purpose, and the GDPR (Article 35) expects a DPIA where Processing:

1. will use new technologies;
2. is systematic and extensive and involves automated Processing;
3. is on a large scale and of Special Category Personal Data; or
4. is systematic monitoring of a publicly accessible area on a large scale.

A DPIA shall contain at least:

1. a description of the Processing operations and the purposes of the Processing, including the legitimate interests pursued by the Data Controller (if applicable);
2. a review of the necessity of the Processing in relation to the purposes;
3. an assessment of the risks to the rights and freedoms of the affected Data Subjects; and
4. the measures the Data Controller will take to address the risks, including safeguards, security measures and mechanisms to ensure the protection of the Personal Data.

The GDPR goes on to state (Article 36) that, where a DPIA indicates that Processing represents a high risk to Data Subjects in the absence of the measures to be taken to address the risks, the Data Controller shall consult with the ICO prior to Processing (through a process referred to as ‘prior consultation’).

The Position of the DPO

The GDPR (Article 38) requires that the Data Controller or Data Processor shall:

1. involve the DPO in a timely manner in all issues relating to the protection of Personal Data;
2. provide the necessary resources, access to Personal Data and Processing operations, and support in maintaining expert knowledge, for the DPO to carry out their duties; and
3. not issue instructions to the DPO regarding the manner in which their duties are carried out, not dismiss the DPO for carrying them out, and permit the DPO to report to the highest management level of the organisation.

The GDPR continues to state that:

1. 1
2. 2
3. 3
4. Data Subjects should be able to contact the DPO with regard to all issues related to Processing of their Personal Data and their rights;
5. the DPO will be obligated to secrecy or confidentiality concerning their duties; and
6. though the DPO may perform other duties beyond those of the DPO, the Data Controller or Data Processor must ensure they do not conflict (and, as per Recital 97, the DPO must remain independent).

In respect of independence, in practice this generally means that, while a DPO may undertake other tasks, those tasks should not be related to any decisions made by the organisation around the Processing undertaken.

In schools, this may give rise to challenges in appointing an internal DPO that also performs other tasks (i.e. an existing member of staff): the level of expertise required, complexity of duties (as set out below) and seniority of reporting lines mean an experienced professional is required, but the requirement for independence means that professional should not be making decisions around the purposes or means of Processing.

Appointing a DPO

As a DPO may be employed or alternatively contracted by the Data Controller or Data Processor, schools will need to give thought to the best approach.

This will vary from school to school (and MAT to MAT), as each will have different levels of resource, skills and expertise, and budget. However as a guide, the table below provides an indication of how appointing a DPO in a number of different ways might work.

The first group of existing roles are internal, where the role of the DPO is added to the existing duties of the post holder. The second group are external, and perform the DPO role specifically, either on a dedicated or shared (i.e. for multiple organisations) basis.

In each case, the relative suitability of that approach to perform the DPO role is summarised using either a ‘✔’ (for suitable), ‘✘’ (for unsuitable) or ‘Ο’ (for partially or potentially suitable, depending on certain factors) against different criteria:

• Objectivity: the ability of the DPO to look at the Processing, and the risks of and purposes for the Processing, without a conflict of interests. Some existing internal roles will be too close to decisions made around Processing to do this.
• Data Protection Expertise: the extent to which the DPO is sufficiently expert in data protection law and practices. It seems unlikely that the majority of existing internal roles could also be experts in such areas, but it is possible.
• School-specific Expertise: whilst the DPO must be expert in data protection law and practices, the DPO must also be involved in school data protection issues, and in practical terms it is important the DPO is aware of and understands the specific Processing taking place (including the staff, processes etc.). This may be easier for existing internal staff than newly appointed or external staff.
• Technical Expertise: similarly, whilst data protection and school-specific expertise is important, so too is an understanding of the systems in use. A DPO would struggle to provide advice (e.g. in relation to breaches) without a working knowledge of the technology used.
• Ongoing Development: the opportunities afforded to the DPO to continue to develop his or her skills and expertise. Most existing internal roles will offer limited scope for this, due to the post holder sharing their time and not focussing specifically on data protection. It may equally be the case that a DPO appointed specifically by a school has limited exposure to new issues and information, particularly when compared to a DPO working across multiple establishments (or even sectors, as the case may be with an external DPO).
• Time Available: the ability of the DPO to provide the required time, when that time is required. There will likely be times when the DPO will have numerous issues to manage (e.g. queries from Data Subjects, training for staff, monitoring compliance), and should a serious incident (e.g. data breach) occur, the DPO would need to be able to dedicate all of their time to it. This may be difficult to accommodate in many existing internal roles.
• Cost: the actual cost to the school of the DPO. Whilst appointing an existing internal resource to the role of DPO alongside their current duties has numerous disadvantages, it is likely to be less costly than appointing a specific DPO (at either individual school or MAT level) or contracting the services of an external DPO.

Back to SWGfL GDPR Resources - Contents Page