Can the handling of personal data breaches and their notification by the DPO actually constitute a conflict of interest?

ANSWER

As the Polish Data Protection Authority (UODO) states in its latest guidance, Data Protection Officers are professional advisors who support controllers and processors in ensuring compliance with the GDPR. In order to properly perform their tasks, they must remain independent, and the scope of their responsibilities should be free from conflicts of interest.

According to UODO, DPOs should not document personal data breaches on behalf of controllers, particularly where this would involve determining the purposes and means of processing personal data or deciding on remedial measures.

Taking this into account, it may be cautiously assumed that documentation activities devoid of these elements, consisting solely of organizing and properly recording the information and circumstances provided by the controller, would not give rise to a conflict of interest. However, given UODO's current position, this interpretation carries a certain degree of risk.