Data protection officers report from the field

Interview: Data protection officers report from practice

Our partners report in an interview Wolfgang Evers and the Stefan Schumann.

What are the most common problems you are confronted with in your consulting practice?

EversCompanies have no time, little money and no competence for data protection.

SchumannMany people mistakenly believe that a privacy statement on the website is sufficient. In fact, this represents only a small percentage of the necessary concern with privacy. The importance of employee privacy is also often overlooked. Employment contracts are not documented, there are forbidden records of employees and identifiers are not deleted, even though the employees concerned have long since left the company.

Does dealing with data protection have economic advantages for companies in addition to compliance with legal regulations?

EversThere are synergies between data protection and management. The management gets a better overview of the processes and becomes aware of construction sites in the company. Examples are the time recording of employees, their video surveillance and sick leave lists. Everything that leads to behavioral control is in conflict with data protection. We must create awareness of this, especially because some processes have been practiced in this way for decades.

SchumannCompanies that have experienced data breaches have informed the affected customers. This had such a positive effect on them that they made further purchases from these companies. So you can score points with a high awareness of data protection among customers.

What are the main sticking points in implementation from your perspective as a data protection officer?

SchumannThese are the extensive documentation obligations. The situation is made more difficult by the fact that some data protection officers make companies insecure and disseminate false information. This applies to both external and internal officers. Among the external ones there are dubious ones and not all of the internal ones are sufficiently trained.

Which questions are asked particularly frequently in practice?

EversMost customers are ignorant. Therefore, we first give a one-hour orientation on data protection.

SchumannI'm usually asked about the record of processing activities This results in the necessary measures in IT security and organisation. There is also a lack of understanding in the contracts for commissioned data processing. If the external service provider does not take care of data protection, it is of no use to comply with it yourself.