#Draft fan with draft control for owb professional

what is the anticipated outcome intended for which the data is being processed? And how is that result obtained or end achieved? Purpose and means: The data controller is the entity that determines the purposes and means of processing i.e. So if the contract states you’re a processor but you use the data for your own purposes, then you’re a controller regardless of what the agreement states. However, echoing long-standing regulatory guidance, the EDPB notes that “ the terms of a contract are not decisive in all circumstances” - as the alternative would simply allow parties to “ contract out” of their controller role. Importantly, the EDPB confirms that if data protection labels are assigned contractually - if there is no reason to doubt the accuracy of these labels - the labels will likely stand. Even if the contract does not specifically label parties as controllers, it may nonetheless be possible to infer which party exercises a decision making role when it comes to processing personal data.

For example, “ when an entity engages in processing of personal data as part of its interactions with its own employees, customers or members, it will generally be the one who factually can determine the purpose and means around the processing and is therefore acting as a controller within the meaning of GDPR.”Ī review of the contractual terms between different parties can also help determine which party is acting as controller.

#Draft fan with draft control for owb professional

In this assessment, it is often useful have regard to traditional roles and level of professional expertise that implies a certain level of responsibility. More commonly, control will stem from the factual influence an entity has over the processing.Īccording to the EDPB “ all relevant factual circumstances must be taken into account in order to reach a conclusion as to whether a particular entity exercises a determinative influence with respect to the processing of personal data in question.”

An example of the former would be where the legislator has designated a particular entity in law with the ability to exercise control (either expressly or implicitly) for example, national law designating local authorities with the power to administer social welfare payments. The EDPB reminds us that in ascertaining who is controller, the assessment should be based on a factual rather than formal analysis.Ĭontrol can stem from law or from factual influence. The data controller is defined in the GDPR as “ the natural or legal person, public authority, agency or other body which alone or jointly with others, determines the purposes and means of the processing of personal data….”ĭetermination of the Processing: The controller determines the key elements of the processing and to understand who fulfils this role the Board suggest that the following questions should be asked “ why is this processing taking place?” and “ who decides that the processing should take place for the particular purposes?” The EDPB also, in parallel to the Guidelines, published their separate guidance on social media targeting, in which the Board find widespread joint controllership between social media networks and advertisers, based on reasoning, which will likely have application to AdTech more generally (See Section 2b.). They cover well established principles on the differences between controllers and processors which will be familiar ground to seasoned privacy practitioners, but the paper gives further guidance into the often vague world of joint controllership and its consequences (see Section 2).

The Guidelines are detailed – 48 pages of detail. This is a topic that has not been reviewed in detail by the EDPB or the Article 29 Working Party since the latter’s 2010 opinion.Īs the EDPB acknowledge, the meaning of controller, joint controller and processor are of “paramount importance” in data protection law, and the criteria for their correct use, needs to be sufficiently clear and understood - therefore the Board's guidance was much anticipated.