GDPR çərçivəsində nəzarətçi və ya prosessor: kimin kim olduğunu necə müəyyən etmək olar

A controller decides why and how personal data are processed; a processor processes personal data only on the controller’s documented instructions (Article 4(7) and (8) GDPR). Your role follows the facts, not the label in the contract, and it determines who needs a lawful basis, who answers data subject requests, who reports a breach and who is liable if something goes wrong.

Prosessoru kontrollerdən necə ayırd etmək olar?

Ask who decides why the data are processed and, in essence, how. A controller determines the purpose and the essential means of the processing; a processor acts only on the controller’s documented instructions and does not use the data for its own purposes.

Typical processors: a hosting provider, a payroll bureau acting strictly on instructions, an email delivery service. Typical controllers, even though engaged by another party: an accountant performing a statutory audit, a lawyer conducting a case, an occupational health service (arbodienst) exercising its own professional duties.

Müqavilə sizin rolunuzu müəyyən edirmi?

No. Calling yourself a processor in the agreement does not make you one. If a supplier uses the data for its own purposes, such as improving its product, building profiles or marketing to the individuals concerned, it is a controller for that processing. Article 28(10) GDPR says so expressly: a processor that determines the purposes and means is treated as a controller.

Bəs siz və digər tərəf məqsədləri birgə müəyyən etsəniz necə olar?

You are then joint controllers under Article 26 GDPR. You must set out your responsibilities in an arrangement, in particular for data subject rights and the information duties of Articles 13 and 14, and make the essence of that arrangement available to the individuals concerned.

Joint control arises more often than organisations expect. In Wirtschaftsakademie (C-210/16, 5 June 2018) the Court of Justice of the EU treated the administrator of a Facebook fan page as a joint controller with Facebook. Under Article 26(3) GDPR, a data subject can exercise their rights against either joint controller, whatever you agreed internally.

Emal müqaviləsində nələr olmalıdır?

If you engage a processor, a written agreement is compulsory under Article 28(3) and (9) GDPR, and its content is prescribed. It must cover the subject matter and duration of the processing, its nature and purpose, the types of data and categories of data subjects, and your instructions as controller.

It must also cover confidentiality, security measures under Article 32, the conditions for engaging sub-processors, assistance with data subject requests and breach notification, return or deletion of the data at the end, and your audit rights.

Mübahisələr adətən haradan başlayır?

Two clauses cause most trouble. On sub-processing, Article 28(2) GDPR permits general written authorisation, but the processor must inform you of intended changes and give you the opportunity to object. On return or deletion, agree which of the two applies, and in what format, before the relationship ends rather than during a dispute.

Breach notification is a third pressure point. The processor must inform you without undue delay (Article 33(2)); you then have 72 hours to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) under Article 33(1). Agree a short internal deadline for the processor, for example 24 or 48 hours.

Emal səhv gedərsə, kim məsuliyyət daşıyır?

Under Article 82(2) GDPR, you are liable as controller for damage caused by processing that infringes the GDPR. A processor is liable only if it has not complied with obligations that the GDPR places specifically on processors, or has acted outside or contrary to your lawful instructions.

Where both of you are involved in the same processing and responsible for the damage, each can be held liable for the entire damage towards the individual (Article 82(4)). The party that paid can recover the other party’s share afterwards (Article 82(5)), which is why the indemnity clause in a processing agreement is worth negotiating carefully.

What should you check as a controller?

• Whether each supplier that handles personal data for you has signed a processing agreement meeting Article 28(3).
• Whether any supplier uses the data for its own purposes, making it a controller.
• Whether you have a list of sub-processors and a procedure to object to changes.
• Whether the processor must report breaches to you within a fixed number of hours.
• Whether you have joint controller arrangements for shared platforms or campaigns.

What should you check as a processor?

• Whether you use client data only on documented instructions and not for your own product or analytics.
• Whether your sub-processors are bound by the same obligations as you.
• Whether you can return or delete data in the agreed format at the end of the contract.
• Whether your liability cap and indemnity reflect the limited liability under Article 82(2).

What can we do for you with controller and processor roles?

Bizim vasitəsilə İT hüquqşünası Məsələn, sizə kömək edə biləcəyimiz təcrübə:

• We map the roles of each party in your data chain, per processing activity.
• We draft and review processing agreements and joint controller arrangements.
• We negotiate sub-processing, breach notification and liability clauses.
• We advise on liability and recourse between the parties after a data breach.
• We prepare your response to questions from the Autoriteit Persoonsgegevens.

xülasə

• Rolunuz müqavilənizdəki etiketə deyil, faktlara əsaslanır: məqsədi və əsas vasitələri təyin edən şəxs nəzarətçidir.
• If you jointly decide the purposes with another party, you are joint controllers and must record your division of responsibilities (Article 26 GDPR).
• A written processing agreement with the content of Article 28(3) GDPR is compulsory whenever you use a processor.
• The processor reports a breach to you without undue delay; you notify the Autoriteit Persoonsgegevens within 72 hours.
• Both parties can be liable for the entire damage towards the individual, so negotiate the indemnity clause before you sign.

Tez-tez soruşulan suallar