Section 2, Article 4 · Council Decision (EU) 2021/1093

Contents

Article 4Designation and status of the DPO#

1.The Secretary-General of the Council shall designate the DPO from the staff of the GSC and register him or her with the European Data Protection Supervisor (‘EDPS’), in accordance with Article 43 of Regulation (EU) 2018/1725.

2.The DPO shall be selected on the basis of his or her professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 45 of Regulation (EU) 2018/1725. The DPO shall also have a sound knowledge of the GSC, its structure and its administrative rules and procedures. For the purposes of performing his or her tasks, the DPO shall be relieved of any other task within the GSC.

3.The DPO is designated for a term of five years and shall be eligible for reappointment.

4.The DPO and his or her staff are directly attached to the Secretary-General of the Council and report directly to him or her.

5.In performing his or her tasks, the DPO shall act in an independent manner and shall not receive any instruction from the Secretary-General of the Council, from the delegated controllers or the operational controllers or from anyone else regarding the internal application of the provisions of Regulation (EU) 2018/1725 or his or her cooperation with the EDPS.

6.The Council and the GSC shall support the DPO in performing the tasks referred to in Article 45 of Regulation (EU) 2018/1725 by providing the resources necessary to carry out those tasks and provide access to personal data and processing operations, and to maintain his or her expert knowledge.

7.The DPO shall not be dismissed or penalised for performing his or her tasks. The DPO may only be dismissed in accordance with Article 44(8) of Regulation (EU) 2018/1725. For the purpose of obtaining the consent of the EDPS to such a dismissal pursuant to that Article, the EDPS shall be consulted in writing. A copy of that consent shall be sent to the DPO.

8.The GSC, in particular the delegated controllers and the operational controllers, shall ensure that the DPO is involved properly and in a timely manner in all issues which relate to the protection of personal data.