Thanks to GDPR, the data protection officer is a new key role at publishers

To prepare for the coming General Data Protection Regulation, publishers have a new important role: data protection officers.

The Information Commissioner’s Office advised companies to hire DPOs last year, but unlike in Germany, where DPOs are now common at publishers, the U.K. has been far slower to embrace the role. News UK, which owns The Times and The Sun newspapers, was among the first to appoint a data protection officer. Haymarket has appointed one, and magazine publisher Future is planning to appoint one. Others have working groups comprised of staff across different parts of the business working on compliance. Ad tech companies and agencies are also bringing on data protection czars.

The DPO role comes with challenges. The ICO insists the DPO isn’t to be held accountable if decisions they make aren’t good for business.

“It’s the new important role at publishers, but it’s a strange role that’s virtually un-sackable,” said Paul Lomax, an independent publishing consultant and recently the chief technology officer at magazine group Dennis. “You can’t give them guidance on or take issue with how they approach it [GDPR compliance]. Basically you can’t fire them.”

Some publishers are simply choosing to expand current roles, such as privacy officers and heads of data. But with GDPR, the DPO cannot have any conflict of interest with other responsibilities across the business. So if it wasn’t a dedicated role before, it will have to be now, according to Lomax. In some cases, that may lead to some hasty job title changes, rather than investing in an unknown new hire.

Given GDPR is uncharted territory, real expertise and experience is thin on the ground. And with any role shortage, particularly in an area that requires senior, specialist skill sets, salaries are high. Industry sources have said DPO roles tend to be in the six-figure range.

In short, hiring a DPO is fraught with challenges. Whether or not a company must appoint one comes down to size and the extent to which they use data. Companies that have to renegotiate thousands of contracts with tech suppliers in order to ensure they’re compliant will likely already have a DPO or have plans to hire one. But for smaller businesses, outsourcing to external DPOs will be a more popular option.

Companies like Skimlinks, which provides affiliate link services to publishers, will likely outsource to a DPO in the spring, after the company has done the heavy lifting on its data mapping and other internal processes. The DPO will then just be tasked with auditing and validating all that’s happened, meaning the business can control and retain the expertise on how to comply with the law and then approaches an external DPO to rubber stamp its compliance as an unbiased partner. “That way it’s [GDPR knowledge] not all locked up in the mind of a DPO,” said Skimlinks co-founder Joe Stepniewski.

More in Media

‘I’m never going to be able to retire:’ Gen Xers cast doubts on life after work

According to Randstad’s recent WorkMonitor report, which surveyed 27,000 workers, only 50% of workers thought they would retire before 65.

What platforms, brands and agencies hope to get out of the Possible conference in year 2

Year two of Possible is once again being held in Miami Beach, and it will take place from April 15-17 with 3,000 attendees expected to listen to another 200 or so speakers, including Snap’s Colleen DeCourcy, Uber Ads’ Megan Ramm and UM Worldwide’s Matthew Smith.

Brave browser brings new AI reading features to its privacy-focused chatbot

The Brave browser has added more ways for its AI assistant “Leo” to help users read PDFs, analyze Google Drive files and transcribe YouTube videos.