Independence of the Data Protection Officer in Ecclesiastical Entities - Karsten, Kinga (Prawo Kanoniczne, 2025)
The independence of the Data Protection Officer (DPO) is an element of the personal data protection system under the General Data Protection Regulation (GDPR) and the 2018 Decree. In ecclesiastical entities, maintaining this aspect of the DPO’s role faces challenges arising from the hierarchical structure of the Catholic Church. The study aimed to determine the Data Protection Officer’s ability to maintain independence in these entities and to identify the factors that determine it. A comparative analysis of the provisions of Article 38 of the GDPR and Article 37 of the 2018 Decree, supplemented by practical experience, made it possible to identify seven key components of DPO independence and to examine their application in ecclesiastical settings: participation in all matters concerning data protection, support in performing tasks, direct reporting to the highest level of management, protection against dismissal and sanctions, prohibition of issuing instructions, obligation to maintain confidentiality and avoidance of conflicts of interest. The study found that the independence of the Data Protection Officer in church entities is achievable provided certain organizational and legal requirements are met.