Data protection officer – a new subject liable in terms of the general regulation regarding data protection or a new version of an already existing legal figure?

Abstract

This article examines the figure of the data protection officer, which was introduced through Regulation (EU) 2016/679 of the European Parliament and of the Council dated 27 April 2016. This officer is an independent liable subject within the system of legal relationships connected with processing the personal data of natural persons. The main purpose of the article is to give an answer to the question of whether the data protection officer is a new liable subject or not. In the first case this officer would be qualitatively different from similar legal figures. In the second case the introduction of the data protection officer would constitute updating and upgrading of those liable subjects which are regulated in formerly operative regulatory acts. The objective of the article is achieved by carrying out a comparative analysis of the term “data protection officer” and other legal figures, such as data protection official and personal data protection individual. This article studies the granted rights, the imposed legal obligations, the acts regulating the aforesaid liable subjects, as well as the possibilities of interaction with other participants in the processing of personal data of natural persons. Both the actual and the seeming similarities of liable subjects are outlined. Key differences are established between the subjects under comparison and conclusions are drawn as regards the significance of the said differences. As a result of the analysis conducted, arguments are presented in favour of the thesis that the data protection officer is a new independent liable subject, which is qualitatively different from similar legal figures that have been formerly regulated.