Sanctions for not appointing a DPO

It is worth the money of hiring a DPO?

The Italian Data Protection Authority imposed a €75.000 fine to the Ministry of Economic Development for -among other things- not having appointed DPO after the GDPR entered into force

This is the first time the IT DPA penalises a public authority for not having designated a #DPO. The IT DPA in 2017 had started campaigns to ensure the public administrations were able to comply with the new GDPR requirements. Yet, once the #gdpr entered into force in May 2018 the Ministry had not appointed the DPO, and it designated DPO and communicated it to the DPA in October 2019.

The IT DPA is not the only authority that has imposed fines for the lack of appointment of DPO.

Also the Agencia Española de Protección de Datos – AEPD imposed sanctions to
– Arroyomolinos city: reprimand for infringing art. 37(1)(a) public authority, except for courts in judicial capacity (2020)
– Conseguridad (€50.000) Glovo App (€25.000) for infringing art. 37(1)(b) regular and systematic monitoring of DS on a large scale (2020)

Allegedly infringing but not fined:
– website ‘W’: Autorité de protection des données – Gegevensbeschermingsautoriteit Decision on the merits 25/2020 of May 14th 2020 (para 135)