#8.1 Preliminary Remarks
A relation between personal data and an organisation can be described as either controlling data (data controller) or processing data (data processor) for someone else (data controller).
A controller processes data for their own purposes, while a processor processes data for the purposes of the controller, and is engaged to do this by the controller.
Each organisation is a controller of some personal data, primarily of their staff and of contact persons of their business partners.
An organisation becomes a processor when another organisation gives them certain personal data asking to do something with those data.
#8.2 A Controller: Definition, Characteristics, Obligations
#8.2.1 Definition
Under Article 4(7) GDPR:
A ‘controller’ means a [1] natural or legal person, public authority, agency or other body which, [2] alone or jointly with others, determines [3] the purposes and means of the processing of personal data; [4] where the purposes and means of such processing are determined by EU or member state law, the controller or the specific criteria for its nomination may be provided for by EU or member state law.
#8.2.2 Every Organisation Is a Controller
Anyone who makes use of personal data for their own purposes is a controller. Everyone makes use of personal data of some kind for their own purposes. There are always subcontractors and suppliers of some kind, and when doing business there is always contact with natural persons. This means that everyone acts as a controller of personal data of some kind. Being a controller is an organisation’s role. This same entity usually acts as a controller, a processor, a data recipient and sometimes as a third party, and if it is a natural person, as a data subject as well. This does not help those who are not well practised in this area to become accustomed to GDPR terminology.
The only practical exception is provided for in Article 2(2)(c) GDPR. This states that the GDPR:
does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity.
Therefore, apart from ordinary consumers, almost everybody is a controller.
Controllers might therefore be:
- legal persons: joint-stock companies, limited liability companies, limited liability partnerships, partnerships, cooperatives, foundations, associations, state-owned enterprises, faiths, research institutes, political parties, trade unions, church legal persons;
- public authorities;
- units or other entities, for example organisational units that do not have legal personality, that are afforded capacity to perform legal transactions by law;
- natural persons who run their own business (microenterprises);
- other natural persons existing in a public space, e.g. bloggers, influencers.
#8.2.3 What Determines That a Particular Entity Is a Controller?
You are a controller if acting individually or with others, you:
- determine the purposes and
- means of personal data processing.
Under the GDPR, the purposes and means of processing can be determined by an organisation individually or with others, in cases relating to joint control of personal data.
#8.2.4 Determining the Purposes and Means of Processing
If a number of organisations are actively involved in data processing, it has to be determined which of them, in fact, determines the purposes and means of processing. This organisation will be considered the controller responsible for all elements of data processing under the GDPR, such as legality, responding to data subject requests, data security, and controlling a data processing supply chain.
Determining who is a controller has to be functional and thus reflect who in fact specifies the purposes and means of data processing. Deciding the purposes and means corresponds to deciding on one’s own behalf and for oneself as to the purpose for which and the means by which personal data are processed.
However, regardless of the above process, Company A uses services of a marketing agency (a Company B) for a part of data of its potential clients. Company B also sends the newsletter of Company A to its potential clients acting on behalf of Company A, so Company B is a typical processor of personal data entrusted by Company A.
#8.2.5 Are We a Data Controller: Practical Test
If someone is not a household or a person that processes data for household purposes, then they are definitely a controller of personal data of some kind. And if you are a processor (you process data for someone else ‘on hire’ being an organisation, including sole proprietorship), then you are for sure a controller for some other data (e.g., data of your personnel). So, each processor is a controller, which does not facilitate understanding the EU data protection system.
#8.2.6 Role of a Controller
The GDPR is chiefly intended for controllers, and controllers are the main parties obligated under the GDPR. A controller is responsible for data processing as a whole, including data entrusted to a processor. A controller is the subject of all GDPR obligations except for Member State, supervisory authority, accreditation bodies and certification bodies’ obligations. A controller is subject to obligations provided for directly and indirectly in the GDPR – the controller is in fact also the subject of provisions applicable to the processor, as a controller is also responsible for a processor. If a number of organisations are involved in the processing, then the key issue is which organisation in fact determines the purposes and means of processing. In the event of an inspection, it is the controller that is required to prove that it processes data in accordance with the GDPR.
#8.2.7 A Controller’s Obligations
More than half of ninety-nine provisions of the GDPR (fifty-seven provisions) provide for obligations of the controller. They are presented in Table 1.1.
#Table 1.1 Controller’s Obligations
No. | Obligation | Article in the GDPR | A controller is obliged to |
|---|---|---|---|
1 | General principles | Article 5 | observe the general rules, such as:
|
2 | Lawfulness of processing | Article 6 Article 9 | ensure legal grounds for the processing in accordance with Article 6 (‘regular’/‘ordinary’ personal data) or Article 9 (special categories) or Article 6 + Article 10 (‘criminal’ data) |
3 | Valid consent | Article 7 | if the processing of data is based on a data subject’s consent – ensure that the consent is informed, voluntary, specific, unambiguous or explicit (in case of special category data) and possible to demonstrate |
4 | Children’s data | Article 8 | if processing children’s data via the internet (information society services) – obtain parental consent |
5 | Criminal data | Article 10 | if processing of data relating to criminal convictions and offences – process such data only under the control of official authority, or when such processing data is authorised by the law – ensure appropriate safeguards for the rights and freedoms of data subjects |
6 | Processing which does not require identification (we like to call them: ‘unidentified data’ or ‘UFO data’) | Article 11 | meet the requirements provided by Article 11 when processing data of unidentified persons |
7 | Execution of rights of data subjects | Articles 12 to 22 | ensure the execution of individual’s rights provided by Articles 12–22 |
8 | Security | Articles 24 and 32 | ensure data security as required under Articles 24 and 32 implement technical and organisational security measures that are appropriate to the risk to the rights and freedoms of data subjects, identified by the controller |
9 | Privacy by design | Article 25(1) | meet the obligations to ensure ‘privacy by design’ (taking into account data protection issues when introducing new services, new projects, etc.) |
10 | Privacy by default | Article 25(2) | ensure ‘privacy by default’ (minimising processing) |
11 | Joint controllers | Article 26 | enter into a joint controller arrangement when the data is processed jointly by two or more controllers |
12 | Representative in the EU | Article 27 | designate a representative in the EU if not established in the EU |
13 | Entrustment of data processing | Article 28 | if the controller engages a processor, enter into a detailed agreement with the processor, engage in the process only trustworthy processors |
14 | Records of processing activities | Article 30 | keep records of processing activities of the controller’s data (very important obligation to manage the data and ensure accountability for the organisation!) |
16 | Supervisory authority | Article 31 | cooperate with the supervisory authority |
17 | Data breach notification | Article 33 | notify the supervisory authority of personal data breach (leak, destruction, damage, amendment, including critical cases of lack of access) |
18 | Data breach communication | Article 34 | inform data subjects affected of a breach of their data when there is high risk to their rights or freedoms |
19 | Data protection impact assessment | Article 35 | conduct a formal data protection impact assessment when a high risk to the rights and freedoms of persons whose data are processed is likely |
20 | Prior consultations | Article 36 | consult the supervisory authority prior to processing data if the data protection impact assessment reveals a high risk and a controller is not sure what measures can mitigate that risk |
21 | Data protection officer – analysis | Articles 37 to 39 | examine whether a data protection officer needs to be designated and designate the data protection officer where required by law |
22 | Transfer of data outside of the EEA | Articles 44–47 and 49 | ensure that an out of EU transfer of data is legal, when transferring data outside of the EEA (EU + Norway, Iceland, Liechtenstein) (third country), employ the measures described in Articles 44–47 or 49 |
23 | Cross-border processing | Article 56 | in the case of cross-border processing, determine the lead supervisory authority described in Article 56 |
Meeting all of the above obligations must be accountable, in practice: documented.
#8.3 A Processor: Definition, Characteristics, Role, and Obligations
#8.3.1 Definition
The definition of a processor is given in Article 4(8) GDPR and states that a ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
#8.3.2 Role of the Processor
A processor acts on behalf of a controller. A processor’s task is to process personal data in accordance with the GDPR for and on behalf of a controller and in accordance with the agreement on entrusting the processing of data (data processing agreement) concluded with the controller. Thus, a processor’s obligations result from two sources:
- 1)an agreement with the controller and
- 2)the GDPR directly.
#8.3.3 Credibility and Sufficient Guarantees
As demonstrated by the obligations of a controller, where processing is to be performed on the controller’s behalf, the controller:
‘shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject’ (Art. 28(1) GDPR).
A processor must be a professional entity. But according to the accountability rule as a logical consequence of a controller’s role in the data processing, the controller has to demonstrate upon the request of the supervisory authority that the processor of its choice meets the requirements provided by the GDPR for processors.
#8.3.4 Agreement with the Processor or Subprocessor
A processor processes personal data on the basis of an agreement or other legal instrument governed by EU law or Member State law.
A processor processes personal data on the basis of an agreement or other legal instrument governed by EU law or Member State law. This agreement is concluded with the controller and must meet all the requirement and include all elements required by Article 28.
A processor may engage another organisations based on the general consent of the controller, i.e. consent for the processor to engage other organisations, provided that the controller is given sufficient notice of that intention, enabling it to object to the specific processor. The GDPR also provides for specific consent, which means that the processor is required to inform the controller on a case-by-case basis whenever it wishes to engage a particular further processor and seek the controller’s consent (or at least allow them to object). The processor is fully liable by law towards the controller for the processors it engages.
#8.3.5 Contractual Obligations: Under the Agreement with the Controller
According to Article 28, the agreement on engaging a processor must contain the following:
- a description of the guarantees by which the processor ensures data security (in the recitals, representations and covenants, or references or other documents demonstrating the credibility of the processor as applicable, as appendices to the agreement);
- an undertaking to process personal data only upon the documented instructions of the controller;
- an undertaking to obtain non-disclosure obligations from personnel unless that personnel is under the statutory duty of confidentiality;
- an undertaking to employ adequate security measures required under Article 32 GDPR (consultations to agree on the level of adequacy between the controller and the processor);
- an undertaking to comply with the rules described above for engaging another processor (subcontractor, entity engaged by the processor to perform processing) (consent/objection, transfer of obligations, adequacy of security measures);
- an undertaking to limit engagement of other processors to specific activities (not being an ‘empty shell’ under Article 28(4) GDPR);
- rules on execution of an individual’s rights – assisting the controller in the performance of obligations towards data subjects ‘insofar as this is possible, by employing the appropriate technical and organisational means, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in chapter III’ (Article 28(3)(e) GDPR);
- rules on notification of data breach, including assisting with notification of data breach;
- rules for participation in the DPIA, including assisting the controller in consultations with the supervisory authority;
- an undertaking to assist the controller in the performance of other obligations
– ‘assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36, taking into account the nature of processing and the information available to the processor’ (Article 28(3)(f) GDPR);
- an undertaking to delete and return, once the agreement expires, data and data copies – ‘at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing and deletes existing copies unless EU or Member State law requires storage of the personal data’ (Article 28(3)(g) GDPR);
- an undertaking to document the activities of the processor and grant the controller access in order to comply with the principle of accountability;
- rules on assisting with the execution of inspections by the supervisory authority and other auditors, including notification of the inspection and determining the lead supervisory authority;
- an undertaking to give notification of the risk of the lawfulness of instructions being compromised; the processor must be required to give prior notice of concerns as to lawfulness of the controller’s instructions, and otherwise face consequences such as loss of recourse towards the controller in case of liability;
- rules on the procedure in the case of concerns as to lawfulness of instructions;
- an undertaking to provide the controller with all information necessary to demonstrate fulfilment of obligations and enable the controller or auditor authorised by the controller to conduct audits, including inspections, and making a contribution towards them.
List of processor’s obligations is impressive which does not make personal data processing entrustment agreement short. But a cautious controller will approach the data entrustment taking into account all possible obligations of a processor to ensure the highest standard and security level of data managed by the controller.
#8.3.6 Practical Problems
Issues that may arise between a controller and a processor are for example:
- 1)scope and understanding of the obligations of the processor under the GDPR – if the processor is not properly aware of its obligations under the GDPR or has no understanding at all of its role as a processor, there might be a lot of discussion, for example on its responsibility;
- 2)the ‘one-size-fits-all’ list of questions for potential processors – applying the same monitoring requirements and tools to a major processor and minor processors;
- 3)the question of contractual power – a small-scale controller will be in a weaker position in a relationship with a large processor as well as a strong controller will try to contractually transfer their responsibilities onto their weaker processors;
- 4)responsibility of another processors – under the GDPR both the controller and the processor are liable (with respect to data security, lawfulness and compliance with the controller’s instructions). While all processors engaged in the data processing are also liable towards the supervisory authority and data subject for the GDPR incompliance, large-scale suppliers, for example cloud computing providers, may be tempted to act ‘in the third line’ (as another processor, formerly ‘subcontractors’) believing that it will protect them against direct penalties from supervisory authorities and legal action from data subjects.
#8.3.7 Obligations under the GDPR
The obligations of the processor under the agreement with the controller include:
- personal data processing only on the documented instructions of the controller (Article 28(3)(a) GDPR);
- ensuring the appropriate level of security of the processed personal data by implementing the appropriate technical and organisational measures, at the same time taking into account ‘the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons’ (Article 32(1) GDPR);
- keeping records of categories of processing activities performed on behalf of the controller (Article 30(2) GDPR);
- making the records available to the supervisory authority upon request (Article 30(4) GDPR);
- cooperation with the supervisory authority in the performance of its tasks (Article 31 GDPR);
- designating a representative in the EU where Article 3(2) GDPR applies (Article 27(1) GDPR);
- notifying the controller without undue delay of personal data breach (Article 33(2) GDPR);
- designating a DPO where required by law (Article 37(1) GDPR).
#8.4 Comparison of the Roles and Obligations of the Controller and Processor
The analysis performed above of the obligations of the controller and processor leads to the conclusion that some of these obligations are the same, for example obligations provided for in Article 30(4), Article 31, Article 32(1), and Article 37(1) GDPR, to name a few. Not all obligations are common to both, and it is this difference that determines the separate roles of each of these entities with respect to personal data protection.
The controller is the ‘superior’ of the processor because the processor is entitled to process personal data upon the controller’s instructions.