A municipal public authority processes personal data in carrying out its tasks (not as a court acting in its judicial capacity). Which DPO rule applies?
Select an answer to reveal the explanation.
Short Explanation
City hall handling citizen files is on the ‘you need a DPO’ list almost by default — that is the public-authority trigger. Selling souvenirs online is irrelevant, and Member State bodies are not skipped just because they are not EU institutions. Courts acting purely judicially are the usual caveat lane.
Full Explanation
Article 37(1)(a) requires designation of a DPO where processing is carried out by a public authority or body, except for courts acting in their judicial capacity. Online commercial activity is not the trigger. The duty is mandatory, not merely voluntary. Member State public authorities are covered; the EDPS regime for EU institutions is a parallel supervisory structure, not an exclusion of national bodies.