Post-GDPR survey of data protection officers in research and non-research institutions in Croatia

Abstract

Introduction General Data Protection Regulation (GDPR) focuses on important elements of data ethics, including protecting people’s privacy, accountability and transparency. According to the GDPR, certain public institutions are obliged to appoint a Data Protection Officer (DPO). However, there is little publicly available data from national EU surveys on DPOs. This study aimed to examine the scope of work, type of work, and education of DPOs in institutions in Croatia. Materials and methods During 2020-2021, this cross-sectional study surveyed DPOs appointed in Croatia. The survey had 35 items. The questions referred to their appointment, work methods, number and type of cases handled by DPOs, the sources of information they use, their experience and education, level of work independence, contacts with ethics committees, problems experienced, knowledge, suggestions for improvement of their work, changes caused by the GDPR, and sociodemographic information. Results Out of 5671 invited DPOs, 732 (13%) participated in the study. The majority (91%) indicated that they could perform their job independently; they did not have prior experience in data protection before being appointed as DPOs (54%) and that they need additional education in data protection (82%). Conclusions Most DPOs indicated that they had none or minimal prior experience in data protection when they were appointed as DPO, that they would benefit from further education on data protection, and exhibited insufficient knowledge on basic concepts of personal data protection. Requirements for DPO appointments should be clarified; mandatory education and certification of DPOs could be introduced and DPOs encouraged to engage in continuous education.

Data Protection in Croatia: An Indicator of Ethics Processes in Research Institutions

“…Without clear appointment parameters, institutions were able to appoint anyone as DPO, just to fulfil a legal obligation. We found that the majority (92%) of surveyed DPOs in our study (Mladinić et al 2021) were already employed by their institutions when they were appointed as a DPO. Indeed, such an appointment strategy was the easiest solution for institutions.…”

“…Furthermore, our study (Mladinić et al 2021) showed that only around thirty percent of DPOs claimed to have an ethics committee in their institution where they worked. From those which indicated having an ethics committee in their institution, only a few DPOs received some official request or were contacted by their institutional ethics committee and the majority was not involved in that committee's work in any way.…”

“…To explore the relationship between DPOs and Ethics Boards and to explore the current position of DPOs in institutions across Croatia, together with AZOP we prepared a research study based on a cross-sectional online survey which was then completed by more than 700 DPOs across the Republic of Croatia (Mladinić et al 2021).…”

“…In our research (Mladinić et al 2021), only a small number of DPOs indicated a research or an educational institution as their employer. Even in that small sample, it was clear that they received just a few research-related questions which were in line with previously published data (Puljak et al 2020;Dinu 2018).…”

Workload and procedures used by European data protection authorities related to personal data protection: a cross-sectional study

“…Very few research studies can be found on the topic of data protection in the EU. Recently, we published a survey among data protection officers (DPOs), examining the scope of work, type of work, and education of DPOs in institutions in Croatia [ 3 ]. However, when searching for studies on DPAs, we were unable to find any research reports that analyzed how different DPAs handle issues and complaints regarding data protection and their workload before and after the introduction of GDPR.…”