Ray has recently been appointed as the Manager for BBQ and Outdoor Limited, an Irish company that sells barbeques and outdoor furniture. In his first week in the job, Ray realizes that company has no data protection officer so sets about appointing one. He decides to appoint JD, a marketing assistant, as the data protection officer as JD sometimes helps Ray when his computer isn't working. Ray doesn't think that JD has any formal IT qualifications or experience, but he thinks that he's good with computers. After two weeks in the position of DPO, JD comes to Ray with a concern that he has been revising the contract with BBQ and Outdoor Limited's external marketing company. The contract doesn't appear to deal with data protection. Ray decides not to renegotiate the contract, he thinks the marketing company will try to seek more money if the contract is renegotiated.

What are the potential legal issues on the scenario above? And please explain the law on these issues.