Structural limitations of independence from DSB: Is there a need for reform?<\/p>"},"content":{"rendered":"
In the exercise of their activities, data protection officers are protected by law against instruction, discrimination and conflicts of interest. Both the wording in Article 38 GDPR, case-law and the EDPB 2023 Coordinated Enforcement Framework (CEF) measure leave no doubt about this. The weakness lies not in the legal text, but in its enforceability against structural pressures.<\/p>
In this article, we analyse where the normative guarantees end, where organisational practice fails and what this means for the ongoing debate about the abolition of \u00a7 38 BDSG.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
Since the 4th On 1 December 2025, the Minister-Presidents\u2019 Conference adopted a resolution providing for the repeal of Section 38(1) of the Federal Data Protection Act (BDSG), which in Germany imposes a national obligation to appoint data protection officers, by the end of 2026.<\/p>
As early as January 2024, the EDPB published the results of its 2023 CEF measure on the designation and positioning of DPOs: A survey of more than 17,000 organisations in 26 Member States showed that both independence and resource allocation are systematically absent and conflicts of interest occur regularly.<\/p>
Is less regulation the answer to structural implementation deficits? The current political logic seems to be attacking right here, which is subjecting this contribution to critical scrutiny.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
Article 38 GDPR contains protective frameworks, the scope of which is often underestimated in practice:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
Freedom of instruction (Art. 38(3), first sentence)<\/strong><\/p> DSBs do not receive instructions when performing their tasks. According to the EDPB (WP 243 rev.01), this includes any form of informal influence on risk presentations, reporting content, audit methods and the communication of compliance reports to management bodies.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Prohibition of discrimination (Article 38(3), second sentence)<\/strong><\/p> DSBs may not be dismissed or disadvantaged because of the performance of their tasks.<\/p> The term \u2018disadvantage\u2019 must be interpreted broadly and covered by the CJEU (C-534\/20 ?). Leistritz, 22.06.2022) any decision with a sanctioning effect resulting from the exercise of legal obligations.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Direct reporting line (Article 38(3), second sentence)<\/strong><\/p> DSB report directly to the highest management level. This is not an organizational preference, but a normative requirement that excludes disciplinary embedding in operational hierarchies.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Prohibition of conflicts of interest (Art. 38(6))<\/strong><\/p> Further tasks of DSB may not give rise to a conflict of interest.<\/p> The CJEU clarified in C-453\/21 (X-FAB Dresden, 09.02.2023) that there is already a conflict of interest as soon as DPOs exercise decision-making power over purposes or means of data processing in another function.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t The CJEU declared the German protection against special termination pursuant to Paragraph 6(4) of the BDSG to be in conformity with EU law and at the same time confirmed that the prohibition of discrimination laid down in the second sentence of Article 38(3) of the GDPR is directly applicable and applies irrespective of the national right of termination.<\/p> Disciplinary measures, career disadvantages or structural disabilities in the performance of tasks in response to the exercise of legal obligations fall within this scope of protection.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t The court stressed that the \"functional independence\"<\/em> DSB as a protection objective of the GDPR requires a broad interpretation. A conflict of interest therefore exists if DSB exercised influence over the purposes and means of the processing in another function and<\/em> independent monitoring is practically impossible under these conditions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Both judgments of the CJEU in 2022 and 2023 have significantly sharpened the legal protection framework.<\/p> The BAG has joined these decisions and integrated them into German labour law (BAG, 25.08.2022, 2 AZR 225\/20 and 9 AZR 383\/19).<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t The EDPB action under the 2023 CEF provided for the first time an inventory of DPO practice in Europe. Whether and to what extent this inventory is also empirically robust, should not be explained further at this point.<\/p> However, it identifies the following main shortcomings: lack of independence, no or insufficient direct reporting line, conflicts of interest and resource deficits.<\/p> Recurring structural patterns can also be derived from the practice of national supervisory authorities.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Disciplinary insinuation under operational management<\/strong><\/p> DPOs are subordinated to executives who themselves bear operational data protection responsibility.<\/p> This already structurally violates the legal requirement of the second sentence of Article 38(3) GDPR, regardless of whether instructions are actually given in individual cases.<\/p> Paal\/Pauly said: The de facto dependence of a worker on his superior cannot be completely dissolved by formal assurances of freedom of instruction.\u2019<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Filtering of risk reports<\/strong><\/p> DSB's risk reports are modified or withheld before being passed on to management bodies. The governing body receives an incomplete picture of data protection compliance, which means a violation of the first sentence of Article 38(3) of the GDPR in conjunction with the advisory mandate pursuant to Article 39(1)(a) of the GDPR.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Obstruction of the monitoring task<\/strong><\/p> DSBs are prevented from initiating analyses or assessments, commissioning external auditors or independently taking stock of data protection compliance.<\/p> This is a direct violation of Article 39(1)(b) GDPR. The monitoring task is not a recommendation, but a legal obligation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Time asymmetry in internal investigations<\/strong><\/p> If DPOs report restrictions or disabilities internally and investigations are initiated, there is no explicitly standardized interim protection until completion.<\/p> If the investigation takes too long, DSB will leave the company before the result is available. The internal investigation result ?, even if it confirms a rule violation ? then no longer has a protective effect.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Conflicts of interest through operational delegation<\/strong><\/p> The systematic transfer of operational data protection tasks to DPOs makes them controllers and controllers in a personal union and thus a constellation that expressly prohibits Article 38(6) of the GDPR and the case-law of the Court of Justice of the European Union.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t The patterns shown lead to a conclusion that directly contradicts the political reform project: The normative basis of the safeguards is the formal order.<\/strong><\/p> Anyone who is not formally designated as a DPO does not have the full legal prohibition of discrimination, the special termination protection and the right to inclusion under Article 38(1) GDPR.<\/p> The abolition of \u00a7 38 BDSG not only creates an organisational obligation from ? it erodes the institutional basis on which all protection guarantees are built.<\/p> The EDPB draws the opposite conclusion on the German reform project from its own reports on the CEF: He recommends more enforcement, more structural protection, more control and here not less regulation.<\/p> In its own evaluation of the BDSG, the Federal Ministry of the Interior concludes that DSBs play an important contact role for supervisory authorities and opposes a reduction in the obligation to appoint.<\/p> The crucial question is therefore not whether companies need DSB. Rather, it reads: How are DPOs protected when they fulfil their tasks and duties?<\/p><\/blockquote>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Structural independence from DSB does not arise from laws and jurisprudence alone.<\/p> It arises from conscious organizational decisions that separate DSB from its operational dependency. External DPOs are the consistent answer under the conditions described \u2013 no disciplinary or career-related motivation for (self-)censorship, no labour law dependence on the person responsible.<\/p> 2fink Consulting checks for your company:<\/p> Is the DSB really structurally independent or only formal?<\/p><\/li> Does the disciplinary classification meet the legal requirements?<\/p><\/li> Are there conflicts of interest due to operational delegation?<\/p><\/li> Is the management reporting line really direct?<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t Art. 38 GDPR guarantees freedom of instruction, prohibition of discrimination, direct reporting line and protection of interests ? the CJEU further strengthened these guarantees in 2022 and 2023<\/p><\/li> The EDPB CEF 2023 demonstrates for a significant proportion of participating companies that legal protection frameworks are structurally ineffective<\/p><\/li> Five recurring patterns undermine the independence of DSB ? from disciplinary attribution to temporal asymmetry in internal investigations<\/p><\/li> The legal protection framework of Article 38 GDPR is linked to the formal designation ? an abolition of \u00a7 38 BDSG weakens not only the organisational obligation, but the entire protection framework<\/p><\/li> external DPOs structurally eliminate labour law dependency and are the consistent response to identified weaknesses<\/p><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\tWhat the case-law has specified<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
CJEU C-534\/20 ? Leistritz (22\/06\/2022): Prohibition of discrimination applies directly<\/h2>
CJEU C-453\/21 ? X-FAB Dresden (09.02.2023): Conflict of interest is to be understood broadly<\/h2>
Where practice fails<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
What this means for the debate on \u00a7 38 BDSG<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
What 2fink Consulting derives from this<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
The most important findings at a glance<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
Frequently Asked Questions (FAQ)<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t