Published: 2025-09-29

Independence of the Data Protection Officer in Ecclesiastical Entities

Kinga Karsten
Prawo Kanoniczne
Section: Articles and dissertations
https://doi.org/10.21697/pk.2025.68.3.01

Abstract

The independence of the Data Protection Officer (DPO) is an element of the personal data protection system under the General Data Protection Regulation (GDPR) and the 2018 Decree. In ecclesiastical entities, maintaining this aspect of the DPO’s role faces challenges arising from the hierarchical structure of the Catholic Church. The study aimed to determine the Data Protection Officer’s ability to maintain independence in these entities and to identify the factors that determine it. A comparative analysis of the provisions of Article 38 of the GDPR and Article 37 of the 2018 Decree, supplemented by practical experience, made it possible to identify seven key components of DPO independence and to examine their application in ecclesiastical settings: participation in all matters concerning data protection, support in performing tasks, direct reporting to the highest level of management, protection against dismissal and sanctions, prohibition of issuing instructions, obligation to maintain confidentiality and avoidance of conflicts of interest. The study found that the independence of the Data Protection Officer in church entities is achievable provided certain organizational and legal requirements are met.

Keywords:

data protection, data protection officer, ecclesiastical entities, GDPR, independence, 2018 Decree, canon law, conflict of interest, personal data protection

Download files

Citation rules

Karsten, K. (2025). Independence of the Data Protection Officer in Ecclesiastical Entities. Prawo Kanoniczne, 68(3), 5–21. https://doi.org/10.21697/pk.2025.68.3.01

Cited by / Share

This website uses cookies for proper operation, in order to use the portal fully you must accept cookies.