'Data, EU’s Digital Rules and DPOs'

  • Panel
  • Café
  • Wednesday 20.05 — 11:50 - 13:05
  • Academic 2
  • Business 2
  • Policy 2
Ten years after the adoption of the GDPR, the role of DPOs is increasingly shaped by a growing and complex EU digital regulatory landscape. While the GDPR defines the role and tasks of the DPO, recently adopted EU digital laws introduce provisions that directly impact in data protection and, in practice, expand the range of functions that DPOs are expected to perform. This panel aims to analyse how EU regulation -in particular the AI Act, the Data Act, the DSA, and the DMA – affects DPOs’ role and how these changes are experienced in practice. Focusing on organisational practice rather than legal theory, the panel explores the resulting tensions around role expansion, independence, and accountability, and discusses the conditions required for DPOs to effectively fulfil their evolving role while safeguarding their core mandate and ensure users’ rights.

Questions to be answered

  1. How does the expanding EU digital regulatory landscape reshape the role of DPOs in practice and how do they feel in that new situation?
  2. Beyond the GDPR, which EU digital regulations most directly impact the day-to-day work of DPOs?
  3. To what extent are DPOs expected to assume additional or hybrid responsibilities as digital regulatory obligations increasingly overlap?
  4. What organisational conditions and safeguards are required to enable DPOs to perform these evolving roles effectively while preserving their independence?

Moderator

Olga Rierola

Catalan Data Protection Authority (APDCAT) - Spain

Ms Olga Rierola is the Responsible for Cooperation and Training Programmes in the Catalan Data Protection Authority (APDCAT). Moreover, she helps managing the Catalan DPOs Network, recent driven by the APDCAT. Lawyer by training, she has a long term-experience in the field of data protection. For over 15 years, she has been dealing with privacy an data protection issues in the Catalan DPA, assuming different roles: first, regarding the exercise of privacy rights (working at the “Rights and Complaints department”); and second, once the GDPR came into force, she’s worked as an Audit Coordinator and Data Breach Manager. She also takes part in data protection related workshops.

Speaker

Marit Hansen

State Data Protection Commissioner of Land Schleswig-Holstein - Germany

Dr. h.c. Marit Hansen has been the State Data Protection Commissioner of Land Schleswig-Holstein and Chief of Unabhängiges Landeszentrum für Datenschutz (ULD) since 2015. Before being appointed Data Protection Commissioner, she had been Deputy Commissioner for seven years. After graduating with a diploma degree in computer science in 1995, Marit has been working on privacy and security aspects. Her focus is on “data protection by design” and “data protection by default” from both the technical and the legal perspectives. She often gives talks and has been lecturing at various universities and academies. Marit is member of ENISA's Ad-Hoc Working Group on Data Protection Engineering. Her contribution to education and research on privacy-enhancing technologies has awarded her an honorary doctorate from Karlstad University, Sweden.

Speaker

Emese Savoia Keleti

European External Action Service - Europe

Emese Savoia-Keleti is the Data Protection Officer of the European External Action Service. She has over 15 years’ experience in data protection dealing with privacy and processing personal data in EU institutions and bodies. She worked for the European Commission as Data Protection Coordinator of Directorate General for Humanitarian Aid and Civil Protection. After the establishment of the EEAS Ms Savoia-Keleti took part in launching the Data Protection Office. Arrived to Brussels from Germany working in the private sector, having accomplished her doctorate degree in Budapest complementing it with another master in European Studies along with certificates from Georgetown and Charles University in Prague. She was a Fulbright scholar in New York, speaks 5 languages and regularly gives presentations and workshops in the domain of data protection, including data governance, privacy compliance and cyber security in the digital age.

Speaker

Esther García Encinas

CaixaBank - Spain

Esther García Encinas is Head of the Privacy and AI Office at CaixaBank, Spain’s leading financial institution, within the Data Protection Officer Department. She has led the implementation and continuous evolution of the GDPR at CaixaBank since its adoption, having also participated in the pre legislative discussions preceding the Regulation. Esther oversees group wide privacy governance and AI governance programmes, including the implementation of the EU AI Act, with a strong focus on AI risk management to fundamental rights. Esther is a regular lecturer on data protection and AI governance, contributes to professional training programmes, and has participated in several publications, including the recently published “Model for Fundamental Rights Impact Assessments: guidance and use cases” by the Catalan Data Protection Authority.

Speaker

Daniele Nardi

EDPS - Europe

Legal Service Officer, European Data Protection Supervisor. Daniele Nardi is from Rome, Italy. After graduating in law at 'La Sapienza' University, he attended an MA at the College of Europe (Natolin) in European Advanced Multidisciplinary Studies. After working briefly at the law firm Paul Hastings LLP, he joined the Legal Service of the European Commission in 2008, where he dealt first with agriculture and fisheries and then for the last six years, the protection of personal data. He has represented the Commission before the Court of Justice in more than 100 cases and was involved in preparing legislative proposals and negotiations. Since July 2021, he is the Legal Service officer at the European Data Protection Supervisor, where he coordinates litigation and inter-institutional and other horizontal matters.