Data protection officer services in public procurement: what a contracting authority must provide for

The General Data Protection Regulation (GDPR) lets an organisation have its own employee as data protection officer or buy the service: the officer may fulfil the tasks on the basis of a service contract (Article 37(6) GDPR). A contracting authority buys such a service under the Lithuanian Law on Public Procurement (VPĮ). The VPĮ sets out how to buy. The GDPR sets out what to buy: not a set of documents, but the officer’s function with the safeguards and tasks the GDPR lays down (Articles 38 and 39 GDPR).

If the contracting authority is a public authority or body as defined in the Law on the Legal Protection of Personal Data (ADTAĮ) (Article 2(2) ADTAĮ), it must designate an officer (Article 37(1)(a) GDPR; courts acting in their judicial capacity are excepted). Whether you need one is covered in our article do we need a data protection officer. Here: what to put in the procurement documents so that the service you buy meets the GDPR, and what is at risk if it does not.

First: is it a low-value procurement?

The value threshold for low-value procurement is set in Article 4(3) VPĮ. A low-value procurement is governed only by the VPĮ provisions listed in Article 25(2) VPĮ and by the low-value procurement rules approved by the Public Procurement Office (Article 25(2) VPĮ). So the parts of Articles 27, 37, 47, 55, 84 and 87 VPĮ cited below do not apply to it directly; the rules then come from those low-value procurement rules. For a contracting authority whose contracts for goods, services and works concluded in the current financial year total no more than thirty thousand euros excluding VAT, the VPĮ requirements do not apply to these purchases, except Articles 17 and 96 VPĮ (Article 25(5) VPĮ). The requirements of Articles 37–39 GDPR for the officer apply whatever the procurement procedure, so the specification content described below is needed in any case.

Why the GDPR shapes the technical specification

The characteristics of the services bought are described in the technical specification. They must be linked to the subject-matter and proportionate to the value and objectives of the services (Article 37(1) VPĮ). When the purchase is a data protection officer, the GDPR already fixes much of these characteristics:

• knowledge: the officer is designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices (Article 37(5) GDPR);
• tasks: at least to inform and advise, to monitor compliance (including staff training and audits), where requested, to advise on the data protection impact assessment and monitor its performance, to cooperate with the supervisory authority and to act as its contact point (Article 39(1) GDPR);
• involvement: the officer is involved, properly and in a timely manner, in all issues relating to the protection of personal data (Article 38(1) GDPR);
• resources: the organisation provides the necessary resources, access to personal data and processing operations, and the means to maintain expert knowledge (Article 38(2) GDPR);
• independence: the officer receives no instructions on the exercise of the tasks, may not be dismissed or penalised for performing them, and reports to the highest management level (Article 38(3) GDPR);
• confidentiality: the officer is bound by secrecy (Article 38(5) GDPR);
• contact details: the organisation publishes the officer’s contact details and communicates them to the State Data Protection Inspectorate (VDAI) (Article 37(7) GDPR).

The specification may be written by describing the desired result or functional requirements, but they must be precise enough for suppliers to prepare suitable tenders (Article 37(4)(1) VPĮ). So “provide data protection officer services” is not enough. The specification needs to list the Article 39 GDPR tasks, how the officer will be involved and how staff and individuals will reach the officer. The Article 29 Working Party Guidelines on Data Protection Officers (WP 243 rev.01) stress accessibility: the officer must communicate in the language used by the supervisory authority and the data subjects. The Guidelines also call it good practice to determine in advance the time the function needs. At the same time, the specification must ensure competition and must not discriminate against suppliers (Article 37(3) VPĮ).

Which CPV code to choose

Public procurement uses the Common Procurement Vocabulary (CPV) established by Regulation (EC) No 2195/2002 (Article 3(1) VPĮ). The vocabulary has no code for data protection officer services: its data protection codes are for software, for example 48732000-8 “Data security software package” in the English version (“Duomenų apsaugos programinės įrangos paketai” in the Lithuanian one). The vocabulary contains, for example, 79140000-7 “Legal advisory and information services”, 79111000-5 “Legal advisory services” and 72322000-8 “Data management services”. Our advice: choose the code that best matches the subject-matter. If the purchase is the officer’s function, a code that shows only IT work or document drafting does not reveal what the procurement is about.

Qualification requirements: proportionate

The contracting authority must establish whether the supplier is competent, reliable and able to perform the contract. Qualification requirements must not artificially restrict competition, and must be proportionate, linked to the subject-matter, precise and clear (Article 47(1) VPĮ). When checking technical and professional ability, it may require the human resources and experience needed to perform the contract to the quality requirements set (Article 47(6) VPĮ). Qualification requirements are set under the methodology approved by the Public Procurement Office (Article 47(7) VPĮ).

In a procurement for an officer, this means requiring what Article 37(5) GDPR requires: knowledge of data protection law and practice. WP 243 says the level of expertise must be commensurate with the sensitivity, complexity and amount of data processed, and that the officer of a public authority should have a sound knowledge of its administrative rules and procedures. A requirement unrelated to these qualities risks being disproportionate.

Evaluating tenders and the contract

The most economically advantageous tender may be selected by taking into account quality criteria as well, including the organisation, qualifications and experience of the staff assigned to perform the contract, where this significantly affects the quality of performance (Article 55(1)(1)(b) VPĮ). When tenders are evaluated on the ratio of the amount payable or cost to quality, the contracting authority may set a fixed amount payable or fixed costs in advance in the procurement documents. Suppliers then compete on quality criteria alone (Article 55(3) VPĮ). The criteria must not give the contracting authority unrestricted freedom of choice, and it must be possible to verify whether tenders meet them (Article 55(5) VPĮ).

The contract is concluded on the standard procurement contract terms approved by the Public Procurement Office, unless they are not applicable to the subject-matter, or cannot be adapted to it and the contracting authority justifies not applying them (Article 87(1) VPĮ). The contract must set out the rights and obligations of the parties, the time limits for performance, the cases of termination and the person responsible for performance of the contract (Article 87(2) VPĮ). An officer’s contract should also include the Article 38(3) GDPR safeguards. WP 243 explains that an external officer is protected by the same rules: the service contract may not be unfairly terminated because of the officer’s activities. The Guidelines also recommend a clear allocation of tasks within the team and a single lead contact for each client, written into the contract.

What can go wrong

A document package is bought instead of an officer. If the contract covers only drafting documents, nobody performs the Article 39 GDPR tasks and the officer is not involved in decisions. What a document package covers and what it does not replace is explained in our article what a GDPR document package contains. A breach of the controller’s obligations under Articles 25 to 39 GDPR can lead to a fine (Article 83(4)(a) GDPR). For a public authority or body it can reach half a percent of its current-year budget and other total annual income received in the previous year, but no more than thirty thousand euros (Article 33(1) ADTAĮ). If a public authority or body carries out commercial economic activity, the general GDPR amounts apply (Article 33(3) ADTAĮ): up to ten million euros or, for an undertaking, up to 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4) GDPR). Fines for public bodies are covered in more detail in our article GDPR fines for state and municipal institutions.

Conflict of interests. The officer may fulfil other tasks, but they must not result in a conflict of interests (Article 38(6) GDPR). WP 243 notes that a conflict may arise if an external officer represents the organisation before the courts in cases involving data protection. A supplier’s conflict of interests that could adversely affect performance of the contract allows the contracting authority to treat it as lacking professional ability (Article 47(6) VPĮ). How an officer differs from an internal coordinator is covered in our article data protection coordinator vs data protection officer.

A procurement dispute. A supplier that believes the contracting authority did not comply with the VPĮ, for example by setting disproportionate requirements, and thereby infringed its legitimate interests, may apply to the regional court to have decisions annulled or to claim damages (Article 101(1) VPĮ). Before the contract is concluded, it must first file a claim with the contracting authority; in a low-value procurement, in writing (Article 101(3) VPĮ).

When to call a lawyer

• when you are drafting the technical specification and do not know how to turn the Article 38–39 GDPR conditions into verifiable requirements;
• when you are setting qualification requirements and evaluation criteria;
• when a supplier offers an officer who would also represent you in disputes or provide other services;
• when a supplier has filed a claim about the procurement conditions;
• when VDAI asks how your officer performs the tasks.