Data Protection Officer of the Year 2024: Juha Sallinen Still Has Plenty of Work Ahead

The Biggest Challenges in Data Protection Work

According to Juha, one of the greatest challenges in data protection work is prioritization – how to allocate time and resources effectively while considering companies’ very different starting points regarding data protection.

“I still see organizations that haven’t even started data protection work,” Juha notes, giving a telling example: “One of the most common passwords in Finland is still ‘salasana’ (‘password’). If that’s the level of security, you can’t assume that data is otherwise properly protected either—or if the password is simply empty – and yes, there are those too. So there is still a lot of work to be done, and my expertise must be put to best use in supporting each client’s individual situation.”

“Between 2016–2018, a lot of misinformation about GDPR circulated, and some of these misconceptions still persist in many companies,” Juha remarks.

He cites as an example the belief that GDPR does not apply to all companies. In reality, GDPR is in one way or another part of every company’s operations. “Of course, common sense should be used—for instance, a sole proprietor in excavation work for a municipality has little to do with personal data. However, if a sole proprietor works as a doctor for a wellbeing services county, then they are already dealing with completely different and much more sensitive information.”

Expertise Means Continuous Learning

Data protection legislation is constantly evolving, and keeping up to date requires regular study and active monitoring. Juha maintains his expertise by attending selected industry seminars, such as Alpine Privacy Days and the Nordic Privacy Arena, which also provide valuable insights into legislative developments in other countries.

Juha highlights an interesting example from South Africa’s POPIA (Protection of Personal Information Act), which contains unusually severe sanctions for data protection violations – ranging from fines (10 million rand) to prison sentences (up to 10 years).

“At the moment, we are monitoring the situation in the United States: will the adequacy decision (Data Privacy Framework) remain in force, will it collapse, or will there be a Schrems III? These decisions would have a direct impact on the U.S.-based services organizations use, such as cloud-based office applications.”

Bringing Out Personal Strengths in Data Protection Work

Data protection work may initially seem like an overwhelming whole, with much to consider from both a legal and technical perspective.

“It’s easy to get overloaded in data protection work,” Juha confirms.

That’s why he encourages professionals to find their own area of specialization and to network with other players in the field. Collaboration and knowledge-sharing are key in a constantly evolving sector.

Data Management at the Core of Data Protection

Juha notes that the EU’s GDPR has already proven to be a kind of “gold standard”, which is referred to in, for example, China’s PIPL and Brazil’s LGPD legislation. At the same time, however, constantly increasing regulation can create overload for many organizations.

“Continuously developing new technologies, such as artificial intelligence in its various forms, bring new challenges to data protection, and their effects will be seen for a long time to come,” Juha reflects.

For 2025, Juha predicts that the biggest data protection theme will be data management. Many data breaches occur because old information is stored without proper management. “The ‘D’ in GDPR—data—must be remembered: in addition to contracts, monitoring and technical measures are needed to protect people’s information,” Juha stresses.

The Daily Life and Future of a Data Protection Professional

To balance his daily data protection work, Juha spends winters snowboarding and summers working on various projects at his countryside home, where he lives.

“If I weren’t working in data protection, I would probably focus even more on data management,” Juha reflects. The last ten years have been very interesting, and data protection continues to provide new challenges and learning opportunities.

The Data Protection Officer of the Year diploma will end up on the wall of Juha’s remote office, serving as a reminder of his long and eventful journey in the field of data protection. He is particularly pleased that he was recognized as an outsourced Data Protection Officer.

Juha also wants to give credit to others in the field: “Everyone working in data protection would deserve similar recognition, as the field is full of skilled and dedicated professionals.”

Finally, Juha compares data protection to his beloved sport, snowboarding—with a twinkle in his eye:

“Data protection practices are not a hindrance, but an opportunity for smoother and safer operations—just like a good snowboard that makes the ride enjoyable instead of slowing you down!”