Chapter 4 – controller and processor, Section 4 – Data protection officer Article 37 – Designation of the data protection officer Article 38 – Position of the data protection officer Article 39 – Tasks of the data protection officer