§ 5 BDSG
Designation
(1)Public bodies shall designate a data protection officer. The designation may be carried out by several public bodies jointly, taking into account their organisational structure and size.
(2)A person may be designated as data protection officer only if that person has the professional qualifications required and, in particular, the expert knowledge of data protection law and data protection practice necessary to fulfil the tasks set out in Section 7.
(3)The designation shall be made on the basis of professional qualifications and, in particular, expert knowledge of data protection law and data protection practice and the ability to fulfil the tasks referred to in Section 7.
(4)The data protection officer shall report directly to the head of the public body.
(5)The data protection officer may, in addition to the tasks as data protection officer, perform other tasks and duties. The public body shall ensure that no conflict of interest arises from such other tasks and duties.