Two responsible persons: the DPO under the GDPR and the responsible person for whistleblowing

A company with eighty employees faces two obligations at once. For reporting anti-social activity it needs a responsible person under Act No. 54/2019 Coll., and for extensive monitoring of customers a responsible person under the GDPR. In Slovak both functions bear the same name, so in practice they are confused or automatically entrusted to a single individual. Czech law distinguishes them by name as well; Slovak law does not. These are two different functions with different rules, which can nonetheless be combined in certain circumstances.

Who needs which function

A responsible person under the GDPR must be designated by a public authority and by any company, whether as controller or processor, whose core activities are regular and systematic monitoring of individuals on a large scale or large-scale processing of special categories of data or data on criminal offences (Article 37(1) of the GDPR). The size of the company is not decisive here; the nature of the processing is.

With whistleblowing it is the other way round. In Slovakia a responsible person must be designated in particular by an employer with at least 50 employees and, irrespective of headcount, by an employer in financial services, transport safety and the environment (Section 10(1) of Act No. 54/2019 Coll.). In the Czech Republic an internal reporting system is put in place by an employer that as at 1 January employs at least 50 employees, unless it is an obliged entity under the anti-money laundering legislation (Section 8(1)(b) of Act No. 171/2023 Sb.). A company may therefore have one function, the other, both, or neither.

How the functions differ

A responsible person under the GDPR advises the controller and employees, monitors compliance with data protection rules, provides advice on impact assessments and acts as the contact point for the authority (Article 39(1)). They must have expert knowledge of data protection law and practice (Article 37(5)). In connection with the performance of their tasks they must receive no instructions and report directly to the highest management level (Article 38(3)).

A responsible person for whistleblowing receives reports, acknowledges their receipt, investigates them within the statutory deadlines and maintains a register of them. The Slovak Act requires professional qualifications for the performance of those tasks (Section 10(1)) and requires the employer to enable them to perform their tasks independently; they are bound only by the instructions of the employer’s statutory body or of the parent company (Section 10(4)). In the Czech Republic the designated person may only be a natural person who is of good character, of full age and has full legal capacity (Section 10(1) of Act No. 171/2023 Sb.), and who follows the obliged entity’s instructions unless these would jeopardise or frustrate the performance of their activity (Section 11(1)(c)). Both functions are protected by law against reprisal for the proper performance of their tasks.

Can one individual perform both

Both regimes contemplate it. The GDPR permits the responsible person to perform other tasks provided these do not result in a conflict of interests (Article 38(6)). The Slovak Whistleblower Protection Act has an almost identical rule:

The responsible person may also perform tasks and duties other than those under paragraphs 5 to 8 and Section 11(1); the employer must ensure that none of those other tasks or duties results in a conflict of interests.

— Section 10(4) of Act No. 54/2019 Coll. (unofficial English translation)

Combining the roles is therefore permissible, but it needs thought. The guidelines on data protection officers (WP243 rev.01, endorsed by the European Data Protection Board) treat as conflicting those positions in which decisions are taken on the purposes and means of processing, typically senior management and the heads of IT, HR or marketing. Nor are those people suitable for investigating reports, which may be directed against them precisely. When combining the functions, it is also worth assessing the following points:

• a report may concern a personal data breach that the responsible person was themselves supposed to help prevent, and it is then advisable to have a substitute procedure ready,
• the processing of data in the reporting system must be monitored by the responsible person under the GDPR like any other processing, and where they also carry it out themselves, they are checking their own work,
• whistleblowing has fixed deadlines, and the performance of both functions must have sufficient capacity and cover.

External performance

Both functions may be entrusted to a person outside the company. A responsible person under the GDPR may perform their tasks on the basis of a service contract (Article 37(6)). In whistleblowing, an external person in Slovakia may receive and acknowledge reports and, at an employer with fewer than 250 employees that is not a public authority, also investigate them (Section 10(2)); in the Czech Republic the obliged entity may entrust the administration of the system to another person (Section 8(2)). Responsibility for compliance with the obligations nonetheless remains with the company in every case.

An attorney brings to external performance the statutory duty of confidentiality and distance from internal company relationships. A boundary flagged by WP243 must, however, be observed: a conflict of interests may arise where an external responsible person represents the controller before a court in data protection matters. Such tasks must be separated from the performance of the function when the contract is concluded.

How we can help

We assess whether you need one function or both, and propose whether to combine them, separate them or outsource them. We take on the function of responsible person under the GDPR through the data protection officer (DPO) as a service; we put a reporting system in place and can carry out the investigation of reports through whistleblowing and the reporting system. How long files on reports should be kept and who may have access to them we described in retaining reports; how a shared responsible person for a group of companies works is examined in one DPO for a group.