Designating the data protection officer in a medical facility Review article

Abstract

This following article presents one of the most important obligations related to the processing of personal data on medical entities set out by the general data protection regulation (GDPR) – designation of the data protection officer (DPO). It starts with specifying in which cases the designation of DPO by medical institutions is mandatory. Then it refers to the matter of the designation process itself by specifying who may be designated to take the role also it describes in detail the tasks that the DPO is obliged to perform on the basis of the provisions of the GDPR. The next part of the article focuses on the criteria for selecting the DPO of a medical facility, referring to the guidelines in this respect National Commission on Informatics and Liberty – the French supervisory authority. The last part of the article describes the status of the data protection officer emerging from the provisions of the GDPR.