The Bavarian Data Protection Authority (DPA) has announced that it has ordered a fine against a Bavarian company whose data protection officer (DPO) was subject to conflicts of interest. The DPA has reminded companies that they must appoint a DPO where the automated processing of personal data concerns at least 10 people. Companies are free to choose between an external or internal DPO. If they choose an internal DPO, the DPO cannot be responsible for tasks which are in conflict with the requirement of independence. The Bavarian DPA found that such a conflict existed in this case, as the DPO was also an IT manager. The DPA initially asked the company to appoint a new DPO, but after the company failed to demonstrate compliance for months, a fine was issued.