Question Response / Comments Can the clerk be the DPO? The There is nothing specific on this the only – Clerk would be the responsible thing GDPR (Articles 37-39) states is that officer too the DPO: Have expert knowledge of DP law Have ability to undertake GDPR tasks May be a staff member DPO may fulfil other tasks and duties but the Data Controller must ensure that these tasks do not result in a conflict of interests If therefore a Clerk was to be the DPO they must have expert knowledge of DP, must have ability to undertake statutory DPO tasks and must not have other duties that may conflict their position. Is there any advice/guidance on It is difficult to give guidance as there are so email services/providers that have many email services/providers. Its not fool European Servers would be helpful proof but I would use an internet search also information on encryption. engine and are [insert name of – type ‘where I did this for provider] servers located’. gmail and did get the relevant information. In terms of encryption the ICO does have some guidance - There is a free product called 7zip that can be used for encryption. This can be downloaded from the internet. Regarding access requests can There are a number of exemptions in – we withhold negative responses or respect to data protection requests. The information of a private nature for ICO does provide guidance - example when feeding back comments around young offenders? In this instance I would think about data protection rights of all. For example if a parent submitted a subject access request for their information and this information contained details relating to other individuals the parent would not be allowed to receive this portion of information. You have to remember your duty of confidence and what protection this brings -
Question Response / Comments Can the clerk be the DPO? The Clerk would be the responsible officer too There is nothing specific on this – the only thing GDPR (Articles 37-39) states is that the DPO: Have expert knowledge of DP law Have ability to undertake GDPR tasks May be a staff member DPO may fulfil other tasks and duties but the Data Controller must ensure that these tasks do not result in a conflict of interests If therefore a Clerk was to be the DPO they must have expert knowledge of DP, must have ability to undertake statutory DPO tasks and must not have other duties that may conflict their position. Is there any advice/guidance on email services/providers that have European Servers would be helpful – also information on encryption. It is difficult to give guidance as there are so many email services/providers. Its not fool proof but I would use an internet search engine and type ‘where are [insert name of provider] servers located’. I did this for gmail and did get the relevant information. In terms of encryption the ICO does have some guidance - There is a free product called 7zip that can be used for encryption. This can be downloaded from the internet. Regarding access requests – can we withhold negative responses or information of a private nature for example when feeding back comments around young offenders? There are a number of exemptions in respect to data protection requests. The ICO does provide guidance - In this instance I would think about data protection rights of all. For example if a parent submitted a subject access request for their information and this information contained details relating to other individuals the parent would not be allowed to receive this portion of information. You have to remember your duty of confidence and what protection this brings -
gdpr_questions-answers.docx