The Director-General has nominated Laura Kiviharju, Massimo Marelli and David Taylor as members of CERN’s new Data Protection Commission (DPC), which took up its functions on 1 June 2022.

Laura Kiviharju is a data protection specialist for the Data Protection Commissioner of Lucerne Canton, Switzerland. Laura also has her own company advising organisations on data protection compliance and certifications. She is a lawyer with several years' experience in implementing and managing data protection frameworks and assessing information security in the private and public sectors in Switzerland and Finland. She is an IAPP-certified Information Privacy Manager (CIPM), Certified Information Systems Security Professional (CISSP) and Certified Auditor for the Europrivacy Certification Scheme. Among other roles, she has previously been a global data protection officer and adviser at Swiss multinational companies, worked in the Finnish National Cybersecurity Centre supervising information-security certification bodies and participated in EU and international cooperations.

Massimo Marelli is the Head of the Data Protection Office at the ICRC. Massimo is a member of the Advisory Board and a Fellow of the European Centre on Privacy and Cybersecurity at the University of Maastricht, and the co-editor of the DigitHarium, a global forum to discuss and debate digital transformation within the humanitarian sector, with a focus on humanitarian protection, policy, ethics and action. He is also a member of the Brussels Privacy Hub Advisory Board, and he co-led the Data Protection in Humanitarian Action Working Series, which resulted in the publication of the Handbook on Data Protection in Humanitarian Action. Prior to his current role, Massimo held several positions as a field delegate and legal adviser at the ICRC. Before joining the ICRC, Massimo worked as a lawyer at the UK Office of Fair Trading, as référendaire at the General Court of the Court of Justice of the European Union and as a solicitor in private practice.

David Taylor is the Senior Lead Privacy and Data Protection Counsel for the Digital and Technology Tower at CBRE, the world's largest commercial property and investment company. David entered the privacy and data protection sector working in academia for 14 years, including as a professor of law. He is a privacy and IT attorney with over 20 years’ experience working with multinational companies to find pragmatic, global-privacy-respectful solutions to their information technology and cybersecurity compliance problems. David has also been a data protection officer (DPO) in a global IT services company, as well as an acting chief information security officer. He has substantial experience with data protection in intergovernmental organisations (IGOs), having worked as a DPO for Europe's largest life sciences and bioinformatics IGO. He is also known for his work as founder and board member of the Swiss non-profit IGOPA, which works on privacy and data protection issues in IGOs.

The DPC’s mandate is to monitor CERN’s compliance with its data protection framework Operational Circular No. 11 (OC 11), entitled “The processing of personal data at CERN”, to ensure the implementation of OC 11 and, in particular, of data subject rights, and to evaluate and investigate complaints lodged by data subjects, regardless of their connection to CERN.

The recruitment panel, composed of one representative each from the Staff Association and the Office of Data Privacy (ODP) and one person appointed by the Director-General, had an impressive longlist of over 100 candidates to choose from. It reached the unanimous conclusion to recommend the appointment of the three above-mentioned candidates – subsequently appointed as members by the Director-General – for their demonstrated, recognised expertise and experience in various areas of data protection, thus covering a broad range of specialities.

All the new DPC members are highly knowledgeable and widely recognised data protection experts with extensive professional experience at the international level.

We are excited to welcome them to CERN. The DPC will play a crucial role in ensuring CERN’s compliance with its data privacy framework and protecting data subject rights.