processing were present, an excess of 25,000 employees and/or revenue exceeding $25 billion.<sup>96</sup> IAPP respondents which received higher levels of data subject requests reported experiencing less difficulty managing requests than respondents who received fewer.<sup>97</sup> The IAPP attributes this relationship to the increased investments many organizations make toward automating the process of locating a data subject’s information when facing high quantities of requests, thereby decreasing the amount of time and staff needed to complete the task.<sup>98</sup> Though an organization is only required to hire a Data Protection Officer when either (1) the processing of personal data is a core business activity, (2) the activity involves “sensitive” information, or (3) the processing is performed routinely on a large scale, studies suggest many organizations have heeded the GDPR’s encouragement to appoint a Data Protection Officer even when not required. An overwhelming 92% of MW&E’s 1,263 respondents<sup>99</sup> and a three-fourth of the IAPP’s 370 respondents<sup>100</sup> appointed Data Protection Officers despite both surveys including a wide variety of organizations in which the criteria mandating an appointment were unmet. Most organizations have appointed only one Data Protection Officer, though 18% of organizations have expended resources on appointing multiple.<sup>101</sup> Although a Data Protection Officer’s compensation varies by region and experience, officers were reported to have a global salary range between $71,000 and $354,000 in 2018.<sup>102</sup> MW&E’s 2019 study found that 46% of respondents had hired outside counsel for GDPR compliance.<sup>103</sup> The survey found that 68% of organizations hired outside counsel to conduct data protection impact assessments, a time and labor extensive procedure performed whenever a new processing activity is proposed and required of organizations engaging in high-risk processing.<sup>104</sup> Contacting data protection agencies (56%), overall risk mitigation (54%), establishing a consent mechanism for processing (49%), and response to a data subject’s “right to be forgotten” (49%) followed behind as common reasons for enlisting outside assistance.<sup>105</sup> Approximately 34% of respondents sought outside counsel for assistance with international data transfers. The invalidation of the EU-U.S. Privacy Shield by the Court of Justice of the European Union in 2020, a data transfer mechanism utilized by 60% of IAPP respondents, will undoubtedly result in further legal expenditures in the area in 2020.<sup>106</sup>

|**Percent of Budget Al**<br>|**located on Outside Cou**<br>|**nsel & Consulting Services**<br> <br>|
|---|---|---|
|**Research Entity**|**Outside Counsel**<br>**and/or**<br>**Consulting**<br>**Service**|**2019**<br>**2018**|
|Ponemon Institute|Consultants|11%<br>10%|
|(2019)|Outside Lawyers|9%<br>9%|
|IAPP-EY(2019)|Outside Counsel|10%<br>15%|

> 96 _Id_ .

> 97 _Id._

> 98 _Id._

> 99 McDermott Will & Emery, _supra_ note 68.

> 100 Hughes & Saverice-Rohan, _supra_ note 74.

> 101 _Id._

> 102 Oliver Smith, _The GDPR Racket: Who’s Making Money From This $9BM Business Shakedown_ , Forbes (2018).

> 103 McDermott Will & Emery, _supra_ note 68, at 23.

> 104 _Id._

> 105 McDermott Will & Emery, _supra_ note 68.

> 106 Hughes & Saverice-Rohan, _supra_ note 74; _See also_ Case C-311/18, Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems, 2020 E.C.R. I-0000.

18