hi welcome to another episode from our GDPR IQ thought leadership series
here we'll be discussing the obligation on financial firms to appoint a Data
Protection Officer the finance industry is accustomed to strict regulations in
oversight but with the implementation of the GDPR for financial service
organizations are required to tighten their policies and procedures around the
usage and storage of personal data GDPR are significantly impacts any
organization that processes EU citizens data even if the business isn't located
in the EU data protection breaches are regularly making headlines and privacy
has taken center stage ramifications for financial services organisations like
banks and investment advisory firms are far reaching up to 4% of annual global
turnover the GDPR states that a data protection officer is a lynchpin and
plays a key role in ensuring compliance with the GDPR they are the first point
of contact for data protection queries working directly with the c-suite and
act as the liaison between the organization and the supervisory
authority such as the Information Commissioner's Office or ICO in the UK
the data protection officer needs to be the internal authority on data guidance
and expert on all things GDPR the DPO must be independent to avoid any
conflict of interest the concept of appointing a Data Protection Officer or
DPO is not new it has been best practice and mandatory in some countries however
the GDPR has made the appointment of a Data Protection Officer mandatory in
some circumstances financial service organizations are likely to be caught
here whether you are a controller or a processor if you're processing large
amounts of personal data or special categories of data or processing data on
a large scale particularly sensitive data
a DPO is not required if personal information is not processed by your
organization or personal data is processed but on a small scale even if a
DPO is not necessary you should keep records of any data breaches and your
decision-making process the gdpr applies to businesses offering goods and
services and to controllers and processors that process personal data of
individuals in the EU regardless of where the organization is established in
the world if your financial firm is not established in the EU you are required
to appoint a representative who is to achieve gdpr compliance the gdpr
requires the DPO to be appointed on the basis of professional qualities and in
particular expert knowledge of data protection law and practices the DPO
should be involved in all data protection issues as early as possible
and their focus should be on monitoring compliance their duties include advising
the organisation and employees with obligations to comply with the gdpr
assisting with monitoring internal compliance raising awareness of data
protection issues training staff conducting internal audits monitoring
and providing advice data protection impact assessments or DP IAS and to act
as a contact point for cooperating with the supervisory authority and data
subjects the Data Protection Officer is not
personally responsible for non-compliance with the gdpr the
liability is with the controller or processor to demonstrate that the
processing activities are in line with the gdpr if an organization decides
against following their DP OHS advice they should record their decision-making
to demonstrate accountability although a financial services firm can promote a
member of staff to the role of DPO it's strongly recommended to appoint a
DPO with expertise on the GDPR thanks for watching the GDPR for
financial services video subscribe to our channel for more on how to tackle
the EU GDPR and feel free to watch more videos from our GDPR IQ series here
don't forget to check out our website or follow us on our social channels thanks
again and looking forward to seeing you