2008/597/EC: Commission Decision of 3 June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data
Date: 2008-06-03
Institutions: European Commission
Subjects: EU institution, data processing, data protection, data transmission, job description, personal data

22.7.2008

EN

Official Journal of the European Union

L 193/7

(Acts adopted under the EC Treaty/Euratom Treaty whose publication is not obligatory)

II

DECISIONS

COMMISSION

COMMISSION DECISION

of 3 June 2008

adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of
Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of
personal data by the Community institutions and bodies and on the free movement of such data

(2008/597/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

HAS DECIDED AS FOLLOWS:

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and
on the free movement of such data (1), and in particular
Article 24(8) and the Annex thereof,

SECTION 1

GENERAL PROVISIONS

Article 1

Definitions

Whereas:

For the purpose of this Decision and without prejudice to the
definitions provided for by the Regulation:

(1)

(2)

(3)

sets out

‘Regulation’,

Regulation (EC) No 45/2001, hereinafter referred to as
and rules
the
applicable to all Community institutions and bodies
and provides for the appointment by each Community
institution and Community body of a Data Protection
Officer.

the principles

Article 24(8) of the Regulation requires that further im­
plementing rules concerning the Data Protection Officer
shall be adopted by each Community institution or body
in accordance with the provisions in the Annex. The
implementing rules
concern the
tasks, duties and powers of the Data Protection Officer.

in particular

shall

the Commission and charges

Commission Decision C(2002) 510 (2) of 18 February
2002 creates the post of Data Protection Officer (DPO)
for
the DPO with
proposing further implementing rules following consul­
tation with the Directorates-General according to their
needs and experiences,

(1) OJ L 8, 12.1.2001, p. 1.
(2) Not yet published in the Official Journal.

— ‘Data Protection Coordinator’ (hereinafter referred to as the
‘DPC’) shall mean the staff member within a Directorate-
General or Service who has been appointed by the
Director-General to coordinate all aspects of the protection
of personal data in the Directorate-General,

— ‘Controller’, as defined in Article 2(d) and referred to in
Article 25(2)(a), shall mean the official responsible for the
organisational unit that has determined the purposes and
the means of the processing of personal data.

Article 2

Scope

This Decision defines the rules and procedures for implemen­
tation of the function of Data Protection Officer (hereinafter
referred to as the ‘DPO’) within the Commission pursuant to
Article 24(8) of
It shall not apply to the
activities of the Commission when defining policies relating to
the protection of individuals with regard to the processing of
personal data.

the Regulation.

L 193/8

EN

Official Journal of the European Union

22.7.2008

SECTION 2

THE DATA PROTECTION OFFICER

Article 3

Appointment and status

The Commission shall appoint the DPO (1) and register
1.
him with the European Data Protection Supervisor (hereinafter
referred to as the ‘EDPS’).

The term of office of

2.
renewable once.

the DPO shall be five years,

3.
The DPO shall act in an independent manner with regard
to the internal application of the provisions of the Regulation
and may not receive any instructions with respect
to the
performance of his duties.

staff of

selected from the

The DPO shall be

4.
the
Commission following the relevant procedures. In addition to
the requirements of Article 24(2) of the Regulation, the DPO
should have a sound knowledge of the Commission services
and their structure and administrative rules and procedures.
He should have a good knowledge of data protection and
information systems, principles and methodologies. He must
have the capacity to demonstrate sound judgement and the
ability to maintain an impartial and objective stance in
accordance with the Staff Regulations.

In accordance with the Regulation,

5.
the DPO may be
dismissed from his post by the Commission, but only with
the consent of the EDPS, if he no longer fulfils the conditions
required for the performance of his duties. The Commission,
upon a proposal from the Secretary-General in agreement with
for Personnel and Administration, shall
the Director-General
establish that
conditions
fulfils
required for the performance of his tasks.

the DPO no longer

the

6. Without prejudice to the relevant provisions of the Regu­
lation, the DPO and his/her staff shall be subject to the rules
and regulations applicable to officials of the European Commu­
nities.

Article 4

Tasks

responsible of

operations to be notified. The DPCs shall also identify the
such processing operations. The
Controller
DPO shall help the Controller
the
processing operations under his responsibility and monitor
in
implementation of
particular through a yearly Data Protection Status Report.

the Regulation in the Commission,

the risk of

to assess

The DPO shall organise and chair the regular meetings of

3.
the network of DPCs.

The DPO shall make the register of processing operations,
4.
provided for in Article 26 of the Regulation, available on the
internal and external websites of the Commission.

5.
The DPO may make recommendations and give advice to
the Commission and the Controllers on matters concerning the
application of data protection provisions and may perform
into
investigations on request, or upon his own initiative,
matters and occurrences directly relating to his tasks, and
report back to the person who commissioned the investigation,
in accordance with the procedure described in Article 13 hereof.
If the requester is an individual, or if the requester acts on
behalf of an individual, the DPO must, to the extent possible,
ensure confidentiality governing the request, unless the data
subject concerned gives his/her unambiguous consent for the
request to be handled otherwise.

the DPO of

Processing of personal data by Staff Committees shall fall
6.
within the remit of
the Commission. For the
purposes of Article 6 below, the DPO shall provide any infor­
the Staff Committee concerned
mation to the President of
instead of the Secretary-General, where any question relating
to processing operations by the Staff Committee concerned
arises.

7. Without prejudice to the independence of the DPO, the
Secretary-General, on behalf of the Commission, can ask him to
represent the institution in all data protection issues; this may
include the DPO’s participation in relevant committees and
bodies at international level.

1. Without prejudice to the tasks as described in Article 24
of the Regulation and in its Annex, the DPO shall contribute to
creating a culture of protection of personal data within the
Commission by raising general awareness of data protection
issues while maintaining a just balance between the principles
of protection of personal data and transparency.

1.
shall:

Article 5

Duties

In addition to the general tasks to be fulfilled, the DPO

The DPO shall maintain an inventory of all processing
2.
operations on personal data of the Commission into which
for their respective DG, all processing
the DPCs introduce,

(1) Each reference to the Data Protection Officer in the following text

shall mean he or she and his or her.

(a) submit each year a Data Protection Status Report for the
Commission to the Secretary-General and the Director-
General for Personnel and Administration for discussion at
the appropriate level, such as at the regular meeting of
Directors-General;
the report shall be made available to
the Commission’s staff;

22.7.2008

EN

Official Journal of the European Union

L 193/9

(b) cooperate in the discharge of his functions with the DPOs
of
in particular by
institutions and bodies,
exchanging experience and best practices.

the other

is under consideration in the Commission’s services,

cations,
and at the latest prior to taking any decision.

For processing operations on personal data under his

2.
responsibility the DPO shall act as controller.

Article 6

Powers

In performing his tasks and duties and without prejudice to the
powers conferred by the Regulation, the DPO:

(a) may request legal opinions from the Legal Service of the

Commission;

(b) may,

in the event of conflict relating to interpretation or
inform the competent
before

implementation of the Regulation,
management
level
referring the matter to the EDPS;

Secretary-General

and

the

2. When the Commission consults and informs the EDPS
under the relevant Articles of the Regulation, and in particular
pursuant to Article 28(1) and 28(2), the DPO shall be informed.
He shall also be informed on direct interactions between the
Controllers of the Commission and the EDPS pursuant to the
relevant Articles of the Regulation.

3.
The DPO shall be informed by the lead service or by the
Legal Service, as appropriate, about opinions and position
papers of the Legal Service directly relating to internal appli­
cation of the provisions of the Regulation, as well as about
opinions concerning the interpretation or implementation of
other legal acts related to the protection of personal data and
the processing thereof more particularly related to Inter-Service
Consultation, and related to access to information.

(c) may bring to the attention of the Secretary-General any

failure of:

— a staff member to comply with the obligations under the

Regulation,

Article 9

Controllers

1. Without prejudice to the provisions of
concerning their obligations, Controllers shall:

the Regulation

— controllers to comply with those Commission Internal
Control Standards more specifically related to the obli­
gations under the Regulation,

(a) prepare without delay notifications to the DPO for all
existing processing operations which have not yet been
notified;

and suggest that an administrative investigation be launched
with a view to possible application of Article 49 of the
Regulation;

(d) may investigate matters and occurrences directly relating to
his tasks, applying the appropriate principles for inquiries
and audits in the Commission and the procedure described
in Article 13 of this Decision;

(e) shall have access at all times to the data forming the subject
matter of processing operations on personal data and to all
offices, data-processing installations and data carriers.

Article 7

Resources

(b) where appropriate, consult the DPO on the conformity of
processing operations, in particular in the event of doubt as
to conformity;

(c) cooperate with the DPC to establish the inventory of
existing processing operations on personal data of
the
Directorate-General.

2.
The Controller may delegate certain parts of his tasks to
other persons acting as a Delegated Controller under his
authority and responsibility.

The Commission shall provide the DPO with the necessary
resources to carry out his duties.

Article 10

Processors

SECTION 3

RULES AND PROCEDURES

Article 8

Information

1.
The DPO shall be informed immediately by the lead
service whenever an issue, which has data-protection impli­

Processors within the Commission, required to process personal
data on behalf of Controllers, shall act only on the Controllers’
instructions documented in a written agreement and process
such personal data in strict compliance with the Regulation,
and any other applicable legislation on data protection. A
the
written agreement between organisational units of
Commission shall be
legally
binding act within the meaning of Article 23(2) of the Regu­
lation.

considered equivalent

to a

L 193/10

EN

Official Journal of the European Union

22.7.2008

Formal contracts shall be concluded with external processors;
such
requirements
mentioned in Article 23(2) of the Regulation.

contracts

contain

specific

shall

the

Article 11

Notifications

Controllers shall use the online notification system of
the
Commission, accessible through the website of the DPO on
the Commission’s Intranet, to submit their notifications to the
DPO.

For simple processing operations on non-sensitive personal
data, the system shall offer a simplified notification.

Article 12

Register

electronic

register of processing operations of

The
the
Commission mentioned in Article 4(4) hereof shall be accessible
the DPO on the Intranet of
through the website of
the
Commission for all
staff of Community institutions and
bodies and on the Europa website for any person having
access
can be
requested by any person not having access to the Internet in
writing to the DPO, who shall reply within 10 working days.

Internet. Extracts of

to the

register

the

Article 13

Investigation procedure

1.
The requests for an investigation mentioned in Article 4(5)
hereof shall be addressed to the DPO in writing. Within 15 days
the DPO shall send an acknowledgement of
upon receipt,
receipt
to the person who commissioned the investigation,
and verify whether the request is to be treated as confidential.
In the event of obvious misuse of
to request an
investigation, the DPO shall not be obliged to report back to
the requester.

the right

2.
The DPO shall request a written statement on the matter
from the Controller who is responsible for the data-processing
operation in question. The Controller shall provide his/her
response to the DPO within 15 working days. The DPO may
wish to receive complementary information from him and/or
other parties within 15 days. If appropriate he/she may request
an opinion on the issue from the Legal Service. The DPO shall
be provided with the opinion within 30 working days.

The DPO shall report back to the person who commis­
3.
sioned the investigation no later than three months following its
receipt. This period may be suspended until
the DPO has
obtained any further information that he or she may have
requested.

Article 14

Data Protection Coordinators

1.
A DPC shall be appointed in each Directorate-General or
Service by the Director-General or the Head of Service. Based on
a written agreement, several Directorates-General, Services or
Offices may, for reasons of coherence or efficiency, decide to
appoint a common DPC or share the services of an already
appointed DPC.

2.
The function of DPC can be combined with other
functions as appropriate. To acquire the necessary competences
for the functions, he must undergo the compulsory training for
DPCs within six months of his appointment.

The term of office of the DPC shall not be limited. He
3.
should be chosen, at the appropriate hierarchical level, on the
basis of his high professional ethics, his knowledge and
experience of the functioning of his Directorate-General and
his motivation for the function. He should have an under­
standing of information systems principles.

4. Without prejudice to the responsibilities of the DPO, the
DPC shall:

(a) establish an inventory of processing operations in the Direc­
torate-General, keep it up to date, and help to define an
appropriate risk level for each of the processing operations;
he shall use the online Inventory Management System for
DPCs put in place for those purposes by the DPO on his
website on the Commission’s Intranet;

(b) assist the Director-General or Head of Service to identify the

respective Controllers;

(c) have the right to obtain from the Controllers necessary and
adequate information. This shall not include the right to
access personal data processed under the responsibility of
the Controller.

5. Without prejudice to the responsibilities of the Controller,
the DPC shall:

(a) assist the Controllers in complying with their legal obli­

gations;

(b) help the Controllers to establish notifications;

4.
No one shall suffer prejudice on account of a matter
brought to the attention of the DPO alleging a breach of the
provisions of the Regulation.

(c)

input the simplified notifications into the online notification
system of the DPO.

22.7.2008

EN

Official Journal of the European Union

L 193/11

The DPC shall participate in the regular meetings of the
6.
DPCs’ network, chaired by the DPO, to ensure coherent imple­
mentation and interpretation of
the Regulation in the
Commission and to discuss subjects of common interest.

In the execution of his tasks the DPC can ask the DPO for

7.
a recommendation, advice or an opinion.

Article 15

Administration and management

1.
The DPO shall be administratively attached to the Secre­
tariat-General and his activities shall be integrated into the
and management process under
activity-based budgeting
Activity 7 of
the Secretariat-General: Relations with Civil
Society, Openness and Information. In this context the DPO
shall participate in preparing the Annual Management Plan
and the Draft Preliminary Budget of the Secretariat-General.

2.
The DPO shall be the reporting officer for the staff of his
Secretariat and the Assistant Data Protection Officer. The
Deputy Secretary-General shall be the countersigning officer.

The DPO shall participate in the management coordi­

3.
nation of the Secretariat-General as appropriate.

SECTION 4

FINAL PROVISIONS

Article 16

Entry into force

This Decision enters into force on 3 June 2008.

Done at Brussels, 3 June 2008.

For the Commission
The President

José Manuel BARROSO