Data privacy enforcement agencies around the world are ramping up judgements and penalties, while cybercriminals are doubling down with new ways to break into networks. With the dust still settling on GDPR, California lawmakers are altering the legislative landscape with the newly enacted California Consumer Privacy Act (CCPA).
Together, these factors could make 2020 the year of the data protection officer (DPO).
Go deeper with GlobalData
This year, organisations will need to scrutinise and re-evaluate how they engage with their DPOs to protect themselves and their customers from a higher level of threat from cybercrime. For the organisations fortunate enough to have and maintain a DPO on staff, several factors must be addressed over the next 12 months. Not all of them will be easy to control.
In-house vs. contract
The number of DPO roles created as a result of the GDPR have far outstripped expectations. A study by the Independent Association of Privacy Professionals (IAPP) in 2017 estimated more than 75,000 DPOs would be needed to meet European demands. But by 2019, the same organisation estimated that nearly half a million organisations had hired a DPO.
This phenomenal increase may be explained by organisations sensing the direction of travel towards stricter privacy regulations and deciding a dedicated headcount is the safest way. However, not all organisations have the budget to retain a full-time DPO, opting instead for third-party services. Others believe a DPO isn’t necessary at all if frameworks and processes are set up to meet compliance requirements.
Using a third-party service has its pros and cons. The pros are lower costs, as fractional (less than part-time) DPOs base fees on multiple clients. There is also the advantage of broad expertise. Third-party DPO companies should have experience across multiple clients and territories, giving customers a broad range of knowledge, and greater flexibility should they wish, for example, to expand into new regions and ensure compliance in new markets.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe downside is the potential loss of control and oversight contingent on using a third-party service. While organisations are increasingly comfortable with outsourcing professional services, the risk associated with privacy compliance failures may motivate some businesses to keep control within their own walls. Certainly, if a third-party supplier is used, a clear understanding is needed for where the burden of responsibility and liability lies in the event of failings. Contracts must be clear and watertight on the subject of the extent of risk transfer.
Jurisdictional variations
One of the most fascinating and challenging aspects about new international regulations is monitoring how they are interpreted by different EU countries. Each national authority has its “favourite” provisions on which to prioritise.
Businesses need to ensure their DPOs — whether in-house or third-party — maintain a robust working knowledge of all the judgements as they are handed down in each territory. Data privacy compliance, in this respect, will remain a moving target for multinational businesses.
A DPO talent shortage will be painful
Demand for DPO services will continue to increase as the US catches up with Europe with its own state-specific legislation and recruits experienced DPOs across the pond with higher salaries and attractive benefits. This is likely to lead to a shortage of data protection professionals in the UK.
The situation will be further complicated by Brexit. Depending on how things play out in the next 12 months it may become necessary for businesses operating in Europe to move their DPO function out of the UK to a specific European jurisdiction. These two factors combined could leave UK businesses facing a DPO drought and also increase demand for third-party DPO consultancies.
Looking at the longer term
As regulations mature, the role of the DPO will evolve. The initial focus on understanding the scope of the law, documenting data flows and risks, and establishing compliance frameworks will naturally transition to a more strategic advisory capacity. DPOs will need to interpret and respond to the outcomes of regulatory judgements for continued compliance.
As this evolution occurs, I believe we will see a higher proportion of smaller organisations opting for consultancy-based DPOs greater affordability and flexibility. However, large multinational businesses will absolutely need to retain in-house DPOs to fully control data privacy obligations.
There’s no single answer to whether businesses should opt for in-house or third-party DPO services. The decision depends on their budgets, risk appetites and the complexity of data protection requirements.
Businesses that start with an in-house DPO might also re-evaluate whether a third-party service is now more appropriate. However, in all cases, the relationship between DPOs and businesses should always be robust, transparent, and have a clear understanding of where responsibilities lie.
Read more: Data privacy predictions for 2020: Six industry experts have their say
