Data Protection Officer

[Badaz52]

Hi,

 

I just want to get people's opinions on this. We have just appointed a DPO which turns out to be our SBM. Firstly I am confused about this as clearly that is a conflict of interest and not a small one a huge one. It would be interesting to see who made this appointment and whether the SBM may have taken it upon themselves to assume responsibility.

 

With this in mind as NM I have been asked to provide recommendations and pricing for a some software to comply with a particular part of GDPR. This instruction is coming from the DPO before the governors have been informed, essentially the DPO intends to instruct them what they need to do and tell them what they need to buy as well. Surely this can't be right? Also how can I advise on what software they need when I do not have the expertise or training and cannot verify suitability when it comes to meeting the GDPR regulations?

 

If the DPO is not the NM in schools and clearly a lot of compliance related issues will come back to the IT systems how much involvement should the NM's really be having? should the NM have a say with regards to how they should comply or should they be told what needs to be done once it's decided by senior management?

Edited January 30, 2018 by Badaz52

[Al_NetSupport]

Sounds a bit back to front, SBM likely to have direct “touch” on staff data so really not a wise choice.

 

GDPRinSchools is a good option, amongst a few, but would always advise you get all stakeholders (incl governors) fully informed and up to speed on ICO requirements and THEN look if you need any external tools or support to maintain compliance. Won’t be the case for everyone.

I’d avoid being accountable for all choices / decisions until such time as you feel suitably informed.

[enjay]

DPO is an oversight role not a doing role, so I don't have an issue with the DPO asking NM for recommendations and advice, and indeed with the DPO telling them the NM to do something. That said, if they were to say "you need to upgrade the firewall" before asking questions about the suitability of the current firewall, I would have concerns. A good DPO will do things in discussion with the people in the know before deciding, and then allow the people in the know to deliver it in a suitable way, but there will likely be times when the DPO says "this needs to happen" and other people will then have to make it happen. The DPO role could be used as a power kick by the wrong person.

 

Whether your SBM can be the DPO is another matter, already discussed at length in other threads. Every school is different, but chances are it is a conflict of interest for them.

[MbroTech]

Can I ask who out there have appointed a new DPO (or outsourced the provision), or who has added the role to an existing post (and what that post was)?

[Al_NetSupport]

Can I ask who out there have appointed a new DPO (or outsourced the provision), or who has added the role to an existing post (and what that post was)?

 

Appointed a Trustee to be DPO much in the same way as we would have a Governor acting as Responsible Officer under the old FMSiS. Seems to be an increasingly popular choice and clearly being one step removed from the people/data. Naturally need to be suitably informed and aware of their obligations.

[Badaz52]

Can I ask who out there have appointed a new DPO (or outsourced the provision), or who has added the role to an existing post (and what that post was)?

 

We have appointed our Strategic Business Manager which is a clear conflict of interest but hey what do I know lol

[elsiegee40]

I am seeing schools/MATs recruiting Compliance Managers

 

One person full time to ensure compliance with H&S, GDPR, Equality, Safeguarding, etc

 

For example

https://www.tes.com/jobs/vacancy/compliance-manager-hx2-9tz-1047312

https://www.tes.com/jobs/vacancy/health-and-safety-officer-and-compliance-co-ordinator-st-albans-1036121

[Badaz52]

Do you think that if policies are being re-written to comply with GDPR then it would be wrong of the DPO to ask the NM for their thoughts on the proposed policy changes with regards to data protection?

[enjay]

Do you think that if policies are being re-written to comply with GDPR then it would be wrong of the DPO to ask the NM for their thoughts on the proposed policy changes with regards to data protection?

 

Not at all. There's nothing wrong with the DPO seeking the advice of IT specialists before making recommendations, indeed this should be encouraged. No reason that specialist can't be the school's NM. So long as the ultimate decision comes from the DPO, and it isn't the DPO realising they're out of their depth and shirking their responsibilities.

[Badaz52]

Not at all. There's nothing wrong with the DPO seeking the advice of IT specialists before making recommendations, indeed this should be encouraged. No reason that specialist can't be the school's NM. So long as the ultimate decision comes from the DPO, and it isn't the DPO realising they're out of their depth and shirking their responsibilities.

 

The problem we have is the DPO and SBM are the same person. Essentially the SBM is advising themselves that policies need rewriting with regard to compliance with GDPR and they are asking me the NM to share my thoughts on these changes which I have had no training or possess no expertise in GDPR.

 

I think they are out of their depth if I'm honest and trying to pass on some accountability to me.

[jmak]

Do you think that if policies are being re-written to comply with GDPR then it would be wrong of the DPO to ask the NM for their thoughts on the proposed policy changes with regards to data protection?

 

That's fine - most of the work is operational and legal requirements need to be matched with capabilities. If the DPO didn't ask, you'd likely end up with unworkable solutions being imposed.

 

The problem we have is the DPO and SBM are the same person. Essentially the SBM is advising themselves that policies need rewriting with regard to compliance with GDPR and they are asking me the NM to share my thoughts on these changes which I have had no training or possess no expertise in GDPR.

 

I think they are out of their depth if I'm honest and trying to pass on some accountability to me.

 

That, on the other hand, isn't compliant with the regulations.

 

The analogy is that they wouldn't be able to audit their own finances.

[Badaz52]

That's fine - most of the work is operational and legal requirements need to be matched with capabilities. If the DPO didn't ask, you'd likely end up with unworkable solutions being imposed.

 

 

 

That, on the other hand, isn't compliant with the regulations.

 

The analogy is that they wouldn't be able to audit their own finances.

 

I mentioned this but they are under the impression that it is only personal data they need to worry about which I didn't think was right. I know they don't do HR related tasks but they do staff wages....

[Leeoakley]

This is quite a common thing that seems to be happening in a few schools that I work with.

 

You should be involved with the process as a key member of the support staff, but ultimately no formal responsibility relating to the DPO's role can be pushed to you.

 

Does your SBM need to chat with someone who knows schools and DP/GDPR? It sounds like they don't fully comprehend what they are doing....An external person with credibility in this field might have an impact. I had a call a couple of days ago where the NM being pushed in to the role...BONKERS!!! In a lot of cases the biggest issue is that senior members of the school simply don't understand data. It's not dissimilar to the Zuckerberg interview the other day, the top level of management are making poor decisions and asking the wrong questions because they just don't understand the field.

 

If you get really stuck drop me a message I have a couple of contacts who can get a run down from you and will help you over the phone FOC.

[pbad]

Can I ask who out there have appointed a new DPO (or outsourced the provision), or who has added the role to an existing post (and what that post was)?

 

I just found out that my school has appointed the Office Manager as the DPO. I'm pretty sure this is a conflict on interest.

[artfulmatt]

Can I ask who out there have appointed a new DPO (or outsourced the provision), or who has added the role to an existing post (and what that post was)?

 

We have outsourced using one for schools from local council - I have a long list of questions awaiting him or her hahaha !!