Article 37. Designation of the Data Protection Officer.

1. The controller and the processor shall designate a data protection officer in any case where.

A, processing is carried out by a public authority or body, except for courts acting in their judicial capacity.

B, the core activities of the controller or the processor consist of processing operations which,

by virtue of their nature, their scope and or their purposes, require regular and systematic

monitoring of data subjects on a large scale, or C, the core activities of the controller or the processor consist of processing

on a large scale of special categories of data pursuant to Article 9 and personal data relating

to criminal convictions and offenses referred to in Article 10. 2. A group of undertakings may

appoint a single data protection officer provided that a data protection

officer is easily accessible from each establishment.

3. Where the controller or the processor is a public authority or body, a single data protection

officer may be designated for several such authorities or bodies, taking account of their

organizational structure and size.

4. In cases other than those referred to in paragraph 1, the controller or processor

or associations and other bodies representing categories of controllers or processors may or,

were required by union or member state law shall, designated data protection officer.

The data protection officer may act for such associations and other bodies representing controllers or processors.

5. The data protection officer shall be designated on the basis of professional qualities

and, in particular, expert knowledge of data protection law and practices, and the ability to

fulfill the tasks referred to an Article 39.

6. The Data Protection Officer may be a staff member of a controller or processor, or fulfill

the tasks on the basis of a service contract.

...