{"id":2108,"date":"2026-09-22T06:01:39","date_gmt":"2026-09-22T06:01:39","guid":{"rendered":"https:\/\/dmp.hu\/?p=2108"},"modified":"2026-09-22T06:01:39","modified_gmt":"2026-09-22T06:01:39","slug":"conflict-of-interest-issues-concerning-the-data-protection-officer-and-the-ai-officer","status":"publish","type":"post","link":"https:\/\/dmp.hu\/en\/data-protection\/conflict-of-interest-issues-concerning-the-data-protection-officer-and-the-ai-officer\/","title":{"rendered":"Conflict of Interest Issues Concerning the Data Protection Officer and the AI Officer"},"content":{"rendered":"

I. Introductory Thoughts<\/b><\/p>\n

Since the <\/span>Regulation (EU) 2016\/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC<\/span><\/i> (hereinafter: <\/span>GDPR or Regulation<\/b>) and <\/span>Regulation (EU) 2024\/1689 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300\/2008, (EU) No 167\/2013, (EU) No 168\/2013, (EU) 2018\/858, (EU) 2018\/1139 and (EU) 2019\/2144, and Directives 2014\/90\/EU, (EU) 2016\/797 and (EU) 2020\/1828<\/span><\/i> (hereinafter: <\/span>AI Act<\/b>) came into force, it became obvious to all data controllers and data subjects that significant overlaps have emerged between these two areas. Specifically mentionable the question of the overlap between the role of the Data Protection Officer<\/a> (hereinafter: <\/span>Data Protection Officer or DPO<\/b>) and that of the AI Officer (hereinafter: <\/span>AI Officer<\/b>). It has become increasingly common for Data Protection Officers to simultaneously assume the role of AI Officer. At first sight, this may appear both justified and efficient, since the requirements imposed by the GDPR (<\/span>professional competence and expert knowledge of data protection law and practice<\/b>) could also be considered relevant to an AI Officer, given the close relationship between the two areas of law.<\/span><\/p>\n

I. 1. What Is the Problem?<\/b><\/p>\n

There is, however, an important question. While the GDPR establishes and regulates the position of the DPO, but neither the AI Act nor any other legislation specifically establishes the position or legal status of an AI Officer. The AI Officer can therefore be seen mainly as an organisational role created for practical reasons, for example to help an organisation comply with Article 4 of the AI Act on AI literacy. Article 4 states that <\/span>providers and deployers of AI systems must take measures to ensure, to their best extent, that their staff have a sufficient level of AI literacy. <\/span><\/i>In practice, one possible solution for providers and deployers is therefore to create the position of an AI Officer.<\/span> It is important to emphasise that <\/span>the position of an AI Officer is not a legal requirement. It is an organisational and practical solution.<\/b><\/p>\n

Article 38 (6) of the GDPR states that <\/span>\u201cthe data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.\u201d<\/span><\/i> However, the GDPR does not give a detailed definition of when such a conflict of interest exists.<\/span><\/p>\n

The purpose of this article is therefore to answer two questions: Is there a legal conflict of interest between the positions of DPO and AI Officer? And can a DPO also perform the duties of an AI Officer?<\/span><\/p>\n

II. The Logic of Conflict of Interest Rules<\/b><\/p>\n

To answer these questions, it is important to understand the purpose and function of conflict of interest rules. Tam\u00e1s T\u00f6r\u00f6k points out that it is difficult to give one general legal definition of a conflict of interest because different areas of law approach this concept from different perspectives. In our opinion, however, the main purpose is the same in all areas of law: conflict of interest rules are intended to <\/span>protect independence<\/b>.<\/span><\/p>\n

Article 38 (3) of the GDPR states that \u201e<\/span>the controller and the processor must ensure that the DPO does not receive instructions regarding the exercise of those tasks\u201d.<\/span><\/i> In other words, the DPO must be independent when performing its duties. Because of this, conflict of interest is an important part of the legal position of the DPO and acts as a safeguard for this independence. \u201e<\/span>He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks.\u201d<\/span><\/i> \u2013 also says the GDPR. The idea behind this rule is that the DPO should not have to fear negative consequences because of a professional opinion. The DPO’s opinions should be based on professional considerations.<\/span><\/p>\n

But why must the DPO be independent? Recital 97 of the GDPR states that <\/span>\u201eDPOs should be able to perform their duties and tasks independently, regardless of whether they are employees of the controller.\u201d <\/span><\/i>Article 39 of the GDPR lists the tasks of the DPO. One of the most important tasks is to provide professional advice and information.<\/span> These tasks can only work properly if the DPO is able to give advice independently and without being influenced by the organisation. So the DPOs must only depend ont he law. <\/b>\u00a0<\/span><\/i>For example, if a DPO gives data protection advice in a biased way, the purpose of the GDPR could be weakened. Important principles such as credibility, informed decision-making and transparency could also be affected.<\/span> Independent professional advice is therefore an important part of the DPO’s role.<\/span><\/p>\n

Finally, it is worth mentioning the 2016 WP 243 rev.01 Guidelines of the Article 29 Working Party. The Working Party identified situations where a conflict of interest exists for the DPO: <\/span>\u201ethis entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data.\u201d<\/span><\/i> A typical example would be a senior manager, such as a managing director, director or head of department.<\/span><\/p>\n

III. The Tasks of the AI Officer<\/b><\/p>\n

As we mentioned above, no specific law defines the legal status of the AI Officer. Because of that, there is no official list of tasks and responsibilities that must be performed by an AI Officer. In practice, however, there are many activities that may be given to such a professional. The following list – without the intention of fullness \u2013 is shows some of these.<\/span><\/p>\n