Hacker News Reader

That's interesting, thanks for sharing -- but that linked article is from 2016, so not sure it can refer to the GDPR DPO.

What DPO is that case about? Is it under the DPD (which GDPR supersedes)? If so, what does the DPD say about conflicts of interest and DPOs?

If the law that this case was prosecuted under has as loose a definition as the GDPR, then you're right that this implies German regulators could well enact the GDPR under that interpretation too.

View on HN

Presumably the legal basis would've been the Bundesdatenschutzgesetz, which is Germany's implementation of the DPD. The DPD itself is not very specific, only saying "such a data protection official, whether or not an employee of the controller, must be in a position to exercise his functions in complete independence;". The language in the Bundesdatenschutzgesetz itself[1] is quite similar to the DPO language in the GDPR.

[1]: https://www.gesetze-im-internet.de/bdsg_1990/__4f.html

Reply on news.ycombinator.com