One of the duties of the Data Protection Officer is that of an independent supervisor. In practice, I see many differences in views on what good oversight by the FG means. One FG has almost more the role of Privacy Officer, the other is just parachuting independent advice into the organization.
In itself, this is not surprising: there is little guidance on FG oversight. The AP does provide some brief information on its site (1), but that is mainly about the position of the FG and his duties and role. Not how to properly supervise as an FG. The European Data Protection Board also leaves something to be desired here.
The Ministry of the Interior's report "Less burden, more effect" (2) provides a useful definition. Supervision is described there as the process of gathering information about whether an act or matter meets the requirements set for it, then forming an opinion about it, and possibly intervening as a result.
Supervision thus consists of three processes:
gather information
assessing the information obtained
intervene when necessary
Re 1
When gathering information, it is important to gather it yourself. Go out into the workplace, have the conversation yourself. Let colleagues tell and demonstrate.
Re 2
When you have enough information, you start assessing it. How does the practice compare to the criteria used. First, check that you have all the information needed to make a judgment.
Re 3
The FG himself will not intervene, but his intervention consists of feedback with points for improvement to the controller.
These processes can only run smoothly if the FG can independently gather information and form his or her own judgment on it. This independence does not mean that the FG is not accountable for this. A good supervisor is transparent: explains why he is supervising, makes the choices in supervision transparent and explains his considerations.
This requires of the FG a balancing act. On the one hand, involvement to thoroughly understand the organization's activities and processes. On the other hand, sufficient distance is necessary to remain objective and critical.
Create a common image
Do management and FG have the same images of what they care about when it comes to protecting personal data. This involves questions such as what are the expectations of the organization and what of the FG, what is the ambition level of the organization, is it clear who is responsible for what and where a common responsibility lies.
Prioritize in a supervision plan
That common picture is the starting point for choices the FG will make for supervision. Effective and efficient use of resources necessitates prioritization in supervision based on risk and cost/benefit. What will be the objects of supervision? What is the objective in doing so?
Again, the FG must be transparent about his choices and trade-offs in the supervision plan.
Play on the ball not the man
Supervision occasionally means pointing out things that perhaps no one is waiting for. Make sure your criticism is about the content and not directed at the person. Formulate your findings in a positive way: in points for improvement. Remember that colleagues may be unconsciously incompetent. Explain why the points for improvement, which sometimes involve extra work, are necessary.
Check that your findings land in the organization
Beautiful advice with excellent findings, is worth nothing if it does not land in the organization. If management/board do not recognize it, they will most likely not act on it either. Then all your work is for nothing. Therefore, ask for feedback, process it without compromising your independent judgment.
Try to learn something from the sport of judo
As a FG, you will need to judo from time to time. That seems contrary to tip #3 don't play the man, but what I mean by it is that the principles from the sport of judo can help. The essence of judo is "winning by conceding." Give in at some points, move along and then take back control. Judo also means bowing out occasionally to get results later. Moving along in the process without compromising on substance often helps you get your results.
