It seems that data protection officers (DPDs or DPOs, according to their acronym in English) will have to validate their capabilities very soon. The Spanish Data Protection Agency (AEPD) plans to test around 30,000 data protection officers in Spain. Their role is key, they are responsible for ensuring that companies comply with European Union data protection laws, and the authorities have considered it time to check whether this task is carried out correctly and by the right people.
The AEPD has stated that the test aims to improve the quality of DPDs and ensure that they meet the necessary requirements to carry out their role effectively. DPDs have a critical role in protecting citizens' personal data, and it is important that they have a high level of knowledge and skill to carry out the job. It is the minimum required. I would like to think that this decision is an exercise of responsibility by the data protection authorities and that it does not seek any kind of zeal. The figure is a requirement for certain companies following the entry into force of the European General Data Protection Regulation (GDPR) and, therefore, it is normal for the number of DPDs to grow year after year. What is strange is that there has been no systematic verification of their competence until now.
The test, which will be taken online, will consist of a series of questions related to data protection legislation and the evaluation of practical cases, and will be carried out in two phases: one for DPDs who are already registered with the AEPD and another for those who are not.
At the root of it all is the fact that the EU has increased penalties for data protection violations, which makes it even more important for DPOs to have a proper understanding of the law and how to apply it. It goes without saying, but among other things, we already know that non-compliance with data protection rules can result in significant fines for companies and organizations, and can damage their reputation and customer relationships.
Data protection professionals must be trained and competent, therefore, from the outset, we must be in favor of testing DPOs in Spain and ensuring that they have the knowledge and skills necessary to fulfill their responsibilities. If there is anything that hurts the sector, it is that supposed experts devalue the importance of correct management of personal information by companies and professionals. Bad practices cannot be a reality that we have to assume and accept without further ado.
