Data Protection Coordinators
Article 7
1. The delegated controller shall appoint a DPC and, where appropriate one or more assistant DPCs in the Directorate-General or Service under his or her responsibility. Two or more delegated controllers may, for reasons of coherence or efficiency, decide to appoint a common DPC or assistant DPC or share the services of an already appointed DPC or assistant DPC. The delegated controllers concerned shall record their agreement to do so in writing. 2. The DPC appointed by a Directorate-General or Service shall also be competent for the Cabinet responsible for that Directorate-General or Service. The DPC appointed for the Secretariat-General shall be competent for the President’s Cabinet as well as for Cabinets for which the Secretariat-General is the only supporting Service. Where a Cabinet is responsible for several Directorates-General or Services, the delegated controllers shall decide which of their respective DPCs are to be competent for that Cabinet. 3. The DPO, the staff of the relevant Directorate-General or Service and the relevant Cabinet shall be informed whenever a new DPC is appointed. Newly appointed DPCs shall complete training to acquire the necessary competences for the role of DPC within six months of appointment. A DPC who has previously held a DPC post in another Directorate-General or Service or has been a staff member of the DPO within two years prior to appointment as DPC shall be exempt from that training requirement. 4. Delegated controllers shall put appropriate arrangements in place in order to ensure that the DPC is involved properly and in a timely manner in all issues which relate to data protection in their Directorate-General or Service and that opinions delivered by the DPC are promptly brought to the attention of the delegated controller at the request of the DPC. 5. DPCs shall be chosen on the basis of their knowledge and experience of the functioning of the respective Directorate-General or Service, motivation for the function, competences relating to data protection, understanding of information systems principles, and communication skills. 6. The function of DPC may be combined with other functions. The delegated controller shall ensure that those functions are compatible with the function of DPC. 7. The DPC function shall be part of the job description of each member of staff appointed as DPC. Reference to their responsibilities and achievements shall be made in the annual appraisal report. 8. The DPC shall act as a contact point between the delegated controller, the operational controller and the processor, and the DPO. 9. DPCs shall have the right to obtain any information in their Directorate-General or Service to the extent that this is necessary for the performance of the tasks of DPC. DPCs shall access personal data, only if it is necessary for the performance of their tasks. 10. The DPC shall keep records and provide anonymised statistics of requests from data subjects to the Directorate-General, Service or Cabinet, specifying the numbers of requests and the number of requests rejected fully or in part. The DPO shall specify the categories of requests of which statistics shall be kept. The DPO may specify which further details are to be provided. The DPC shall keep anonymised statistics of personal data breaches managed by the Directorate-General, Service or Cabinet, specifying the total number of personal data breaches, the number of personal data breaches notified to the EDPS and the number of personal data breaches communicated to data subjects. 11. The DPC shall raise awareness on data protection matters within his or her DG or Service and shall advice and assist the delegated controllers and operational controllers in complying with their obligations, especially as regards: (a) implementation of the general principles of Regulation (EU) 2018/1725; (b) documentation of the processing operations; (c) submission of the records of delegated controllers’ processing operations to the DPO pursuant to Article 10; (d) the preparation of privacy statements. 12. DPCs shall participate in the meetings and, where necessary, in working groups of the DPCs. 13. The DPO shall issue additional guidance on the responsibilities and the functions of the DPC.