Many companies are trying to do more with less these days. In some cases, they leverage existing resources to play multiple roles in their company. When managing your Privacy Program, you need to be extra careful that your DPO role is not in conflict with the resource being utilized. Case in point is the recent, 3/14/2025, decision of the Data Protection Authority (DPA) in Norway regarding this issue with a local business, Telenor.
Summary of Findings from the Norwegian Data Protection Authority’s Decision on Telenor ASA
The Norwegian Data Protection Authority (Datatilsynet) conducted an inspection of Telenor ASA’s compliance with GDPR requirements for Data Protection Officers (DPOs) and organizational measures. Here are the key findings and implications regarding internal counsel serving as DPO:
Key Findings and Violations
- Article 37 (DPO Designation):
- Telenor ASA failed to document its assessment of whether it was obligated to appoint a DPO
- The company’s record of processing activities was incomplete and inconsistent
- The DPO’s contact information was not properly published (Article 37(7))
- Article 38 (DPO Position):
- The DPO lacked direct reporting line to highest management level (Article 38(3))
- Resources allocated to the DPO were insufficient (Article 38(2))
- Independence and conflict of interest concerns were not properly addressed
- Article 24 (Organizational Measures):
- Inadequate policies and organizational measures to ensure GDPR compliance
- Unclear division of controllership responsibilities
- Lack of documented procedures for DPO involvement
Internal Counsel as DPO – Requirements and Challenges
The decision addresses whether an internal counsel can serve as DPO. While not prohibited, several significant requirements must be in place:
1. Clear Distinction Between Roles
- The job description must clearly distinguish DPO duties from legal counsel duties
- The roles must be formally separated with distinct responsibilities and reporting lines
- Using a separate email address for DPO matters is necessary to differentiate functions clearly
2. Independence Safeguards
- The DPO must be able to provide independent advice that may conflict with business interests
- The supervisor-trainee-lawyer relationship can potentially compromise independence
- Potential conflicts of interest (including share ownership) must be specifically assessed and documented
3. Resource Allocation
- Sufficient time must be allocated for DPO duties – the 50% FTE allocation was found to be insufficient
- The DPO should not face competing priorities between legal counsel work and DPO responsibilities
- The DPO should have access to necessary resources without having to request them from direct superiors
4. Reporting Structure
- A direct reporting line to the “highest management level” must be established and documented
- This reporting line should allow the DPO to bypass intermediate management levels when necessary
- The reporting structure must be formalized in policies, not merely described in presentations
Conclusion
While internal counsel can serve as DPO, Datatilsynet found significant challenges in combining these roles. The decision highlights that:
- It’s not automatically prohibited for in-house legal counsel to serve as DPO, but robust safeguards must be in place to ensure independence and prevent conflicts of interest.
- The combination requires clear organizational separation, adequate resource allocation, direct access to top management, and formal policies documenting these arrangements.
- The company must assess and document potential conflicts of interest, including how the professional dependency relationship related to legal career development might affect DPO independence.
- The Norwegian authority expressed serious doubts about whether an Associate Lawyer position can be effectively combined with the DPO role, given the inherent tensions between these functions.
You can read the whole story here: https://www.datatilsynet.no/en/news/aktuelle-nyheter-2025/sanctions-imposed-on-telenor-asa-for-lack-in-the-organisation-of-the-data-protection-officer-and-lack-of-internal-control/
ACSM has been helping businesses protect their assets and improve their security and privacy posture since 2006. Our skilled team can help your business understand its cyber weaknesses and potential threats as well as improve your security, privacy, and compliance postures. Our services include penetration testing, maturity assessments, cyber security, and privacy implementation assistance, CISO-as-a-Service, and DPO-as-a-Service, to mention a few.
To learn more about how ACSM can help support your cyber defense needs, please use our contact page https://www.americancsm.com/contact-us/ and schedule a free consultation call today.
