Under GDPR Article 37, a DPO is mandatory if you are a public authority, your core activities involve large-scale monitoring ...