Processor or (joint) controller?

In practice, parties processing personal data are often still unsure which of them is the Processor in the sense of the GDPR and which is the Controller. Uncertainty about the division of roles may arise, for example, at the time when parties are required to enter into a data processing agreement. A data processing agreement is concluded in connection with the obligation under Article 28(3) of the General Data Protection Regulation (GDPR). The GDPR requires that the processing of personal data on behalf of a controller be arranged by a processor pursuant to a contract or other comparable legal act.

The Main Rule

The Controller is the party that determines the purpose and means of the processing of personal data. The processor is the party that processes personal data on behalf of the Controller. On the face of it, these are simple criteria, but in practice it turns out that parties often have difficulty qualifying their activities and their relationship to each other.

Who is a Controller and who is a Processor is a factual question, which means that whether a party is a controller or a processor is determined by factual circumstances.

The question arises: "How do you know whether your organisation is a Controller in the sense of the GDPR?”. This article show why this question is so difficult to answer in practice.

Why does it matter if you are a Controller or a Processor?

The GDPR imposes different statutory obligations on both the Controller and the Processor. However, the statutory obligations on the Controller are more numerous and heavier than those of the Processor. For example, the responsibility for ensuring that personal data is processed lawfully, properly and transparently rests with the Controller under Article 5.2 of the GDPR. It is the Controller who, under the GDPR, is responsible for complying with requests from the data subject to invoke his or her rights under the GDPR (right of access, right of erasure, right of data portability etc.). In practice, however, it is often the ICT service provider as Processor that actually carries out the fulfilling of the request. It is important to realise that the Processor cooperates with requests from the data subject on behalf of the Controller and usually under a contractual obligation in the Data Processing Agreement to provide such assistance.

Joint or Partial Controller

There may be more than one Controller. There may also be joint Controllers who jointly determine the purpose and means. In the latter case, the GDPR prescribes that the joint Controllers must define their respective responsibilities for the fulfilment of the obligations of the GDPR in a transparent manner and that this mutual arrangement must then be made transparently available to the data subject. The joint Controllers individually remain subject to all statutory obligations of a Controller, even if they have made agreements with each other about the division of responsibilities.

The Processor has statutory obligations, but is presented within the system of the GDPR as the 'helping hand' of the Controller who merely follows the instructions of the Controller and does not himself pursue any purposes when processing personal data. Experience shows, however, that a party that processes personal data soon begins to regard itself as responsible, even if that party has not determined the purposes for which certain personal data are processed.

Conversely, it is also possible that a party that does consider itself (rightly) as a largely a Processor is still considered as (joint) Controller for a part of the processing of personal data. The question of whether a certain party is a Controller should generally be considered per processing and on the basis of the facts and circumstances of the case. It may happen that two parties are working on a project for one party involving many different instances of processing personal data, the division of roles then seems clear. It is possible, however, that within the framework of that project, a certain processing takes place for which the 'Processor' determines the purposes and the means, or which, out of the total of processing that takes place, moreso serves the (economic) interests of the 'Processor'. In the latter case, the party who is the Processor for the main part of the processing can still be regarded as (co-)Controller for that part of the processing.

Case law

Privacy law is still a relatively young area of law, in the sense that much has changed as a result of digitalisation. The fundamental right to privacy and the recognition of the right to privacy as a human right are older than the content of the GDPR. Nevertheless, the interpretation of the concept "Controller" in the GDPR is a subject on which many authoritative rulings have been issued in a short period of time. From this case law, a somewhat predictable line of interpretation can be drawn when interpreting the concept of "Controller".

In the notorious case of the CJEU 13 May 2014, Case C-131/12, (Google Spain/Costeja Gonzalez), in which, among other things, the so-called "right to be forgotten" was recognised for the first time, an important principle was also established for the qualification of the concept of "Controller". The EU Court of Justice ruled in this case that the concept of "Controller" must be interpreted broadly, in order to offer effective and comprehensive protection to data subjects. The GDPR aims to protect data subjects by means of information obligations. The GDPR also aims to protect data subjects by giving them the power to invoke certain rights where their personal data are processed for another party’s purposes. The EU Court of Justice ruled as follows:

"33. It is the search engine operator which determines the purposes and means of that activity and, consequently, of the processing of personal data carried out by it in that context, so that it must be considered, pursuant to Article 2(d), to be the 'controller' of that processing.

34. Moreover, it should be noted that it would be contrary not only to the clarity of the wording but also to the purpose of that provision, which is to ensure effective and complete protection of data subjects through a broad definition of the term 'controller', for the operator of a search engine to be excluded from that definition on the ground that it does not exercise control over the content published on third-party webpages.
personal data. "

In CJEU 5 June 2018, Case C- 210/16, (Wirtschaftsakademie) and in CJEU 29 July 2019, C-40/17, (Fashion ID), that principle of effective and complete protection was confirmed and extended to include the consideration of the commercial interests that a given party has in a processing of personal data. Such as 'the management or promotion of its activities' and 'obtaining this commercial advantage, which consists in increased advertising of its products'.

In assigning the status of Controller, it the choice is explicitly made to look not so much at how much actual control the (presumed) Controller had over the personal data and whether he has direct access to it at all, but whether his (economic) interests benefit from a particular processing of personal data.

Incidentally, the interests of the (presumed) Respondent do not necessarily have to be commercial in nature, as was shown in the case of CJEU 10 July 2018, C-25/17, (Jehovah's Witnesses). In this case, it was even held that it could not be inferred from the Jehovah's Community's written guidelines or instructions to the member-attestors that the member-attestors were not themselves Controllers. The member-preachers shared the goals of the entire community of Jehovah's Witnesses. The member-attestors themselves decided in which specific cases they would collect personal data on the persons visited, exactly what data they would collect and how they would subsequently process that data. The community of Jehovah's Witnesses and the Member-Providers could be considered jointly responsible in that case.

Effective and complete protection of the data subject

The concept of Controller must therefore be interpreted broadly, in order to ensure full and effective protection for data subjects. It is not necessary for a party to have access to the personal data in order to be a Controller, as it is also possible to be a Controller for some of the processing that takes place. Where a party exercises some influence over the processing for their own purposes or for their own (commercial) advantage or (economic) interests, then that party could be considered a Controller for a particular processing.

It is an important principle that the protection of the data subject is paramount. In the event of uncertainty about the qualification of the legal relationship, the court must choose the interpretation that is most favourable for the data subject who wishes to exercise his rights under the GDPR. The interpretation chosen that leads to the most complete and effective protection of the natural person whose personal data are processed may be unfavourable to an ICT service provider. This is certainly the case when the supplier considers itself to be a Processor in the sense of the GDPR, but in view of the importance of an effective protection of the interests of the data subject is still regarded as a (co-)Controller in a particular circumstance.

What should an ICT supplier take into account?

Unfortunately, it will be difficult for the ICT service provider to predict when it can be designated as a Controller by a court in a concrete situation. In a concrete situation, a court may appoint a certain party as (partial or shared) Controller with the underlying reasoning of offering effective and full protection to data subjects.

What an ICT service provider or other organisation can often influence more is the way in which they qualify themselves, their role and their responsibilities - also in relation to the GDPR - in writing. The GDPR offers extensive protection to the privacy of natural persons. Partly for this reason, it is not necessary to impose more obligations on yourself or your company or organisation than those imposed by the GDPR. It is therefore important that, when drawing up privacy-related documentation, you make the correct assessment(s) based on which statutory obligations apply to you or not.

In most cases, an ICT service provider will only be a Processor. After all, he only provides the means with which his client can achieve his goals. In any case, it is not in the interest of a Processor to have more obligations imposed on him in a data processing agreement, or otherwise in writing, than strictly follows from the GDPR. As an ICT supplier, do not be too quick to accept an agreement that places more responsibility on you than is required under the GDPR, or which states without justification that both parties are jointly responsible.

Advice

Have you concluded or are you about to conclude a data protection agreement? Have you published privacy statements on your website or with your products? Have a check made to ensure that you are not taking on more obligations than are incumbent on your company or organisation under the GDPR. Contact us if you would like any privacy related documentation drafted.

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!