Data protection; information, consultation and monitoring in public bodies

All Bavarian authorities and other Bavarian public bodies (e.g., municipalities, district offices, governments, district hospitals) that process personal data must appoint a data protection officer. The appointment of a joint data protection officer by several public bodies is possible; this officer does not have to be an employee of the responsible bodies and can also be represented and supported by other persons. The contact details of the DPO must be published in an easily accessible manner, the name of the DPO does not have to be included in the publication.

The data protection officer has the following statutory duties:

• Informing and advising
  . The data protection officer shall inform and advise the controller and the employees carrying out processing operations regarding their obligations under data protection law, and shall be involved in all matters relating to the protection of personal data
• monitoring
  . The Data Protection Officer shall monitor the data controller's compliance with data protection legislation and policies
• Advising on data protection impact assessment
  . The Data Protection Officer shall, upon request, advise the Controller in connection with a data protection impact assessment and monitor its implementation
• Cooperate with the supervisory authority
  . The data protection officer cooperates with the data protection supervisory authority and is its point of contact for data protection-related issues
• Supporting data subjects
  . Data subjects may consult the Data Protection Officer on any matter related to the processing of their data and the exercise of their rights under the General Data Protection Regulation
• opinion before the use of automated procedures
  . Prior to any use or substantial modification of an automated procedure processing personal data, the DPO shall be given the opportunity to give his or her opinion
• opinion on planned video surveillance
  . Public bodies shall inform the data protection officer in good time before the use of video surveillance and give him the opportunity to comment

Transfer of further tasks

The following tasks of the controller under the GDPR are eligible for delegation to the DPO:

• Implementation of the notification of data breaches to the supervisory authority
• Coordination in the implementation of data subjects' rights under Art. 12 et seq. of the GDPR.