Maciej Gawronski, Aleksander P. Czarnowski & Patrycja Naklicka
1)Definition of channels of communication – verbal, unwritten instructions seem to be out of the question in important matters (a practical solution would be to send a written/email/etc. confirmation note). A call centre has the right to demand, among other things, the provision of third-party consents to marketing and electronic communications.
2)Division of responsibility – in practice, division of responsibility may become a big problem. The GDPR does not leave much freedom in this regard; however, the GDPR does not regulate remuneration for basic or extra data processor’s services and more importantly, as data processors before the GDPR were out of scope of data protection liability, they may be not prepared to provide proper compliance maturity soon.
3)Choice of external suppliers – when choosing service providers, a controller will look for an extensive support of data subject requests, proof of appropriate security measures, and support during inspections by the supervisory authority. For processors, this will entail new obligations (and, in practice, increased fees for services).
