Seminar 17 - Data Processing Agreements

Question 1

Is a DPA a requirement?

Answer 1

Yes. The GDPR makes written contracts between controllers and processors a general requirement, rather than just a way of demonstrating compliance with the seventh data protection principle (appropriate security measures) under the DPA.

Question 2

What are the key changes to make in practice? What do we need to do with regards to dates?

Answer 2

Any contracts in place on 25 May 2018 will need to meet the new GDPR requirements.

Question 3

When is a contract needed? DPA. And where is that in GDPR?

Answer 3

• Whenever a controller uses a processor (a third party who processes personal data on behalf of the controller) it needs to have a written contract in place.
• Similarly, if a processor employs another processor it needs to have a written contract in place. Sub-processor.

Art. 28.3.

Question 4

Why are contracts between controllers and processors important?

Answer 4

• 􏰀 ensure that they both understand their obligations, responsibilities and liabilities;
• 􏰀 help them to comply with the GDPR;
• 􏰀 help controllers to demonstrate their compliance with the GDPR; and
• 􏰀 may increase data subjects’ confidence in the handling of their personal data.

Overall: The contract should set out what the processor is expected to do with the data.

Question 5

What details about the processing must the contract include?

Answer 5

• 􏰀 the subject matter;
• 􏰀 how long it is to be carried out for;
• what processing is being done;
• 􏰀 its purpose;
• 􏰀 the type of personal data;
• 􏰀 the categories of data subjects; and
• 􏰀 the obligations and rights of the data controller.

Question 6

Can standard contracts clauses be used?

Answer 6

• 􏰀 The GDPR allows standard contractual clauses from the EU Commission or a Supervisory Authority (such as the ICO) to be used in contracts between controllers and processors. However, no standard clauses are currently available.

Question 7

What is the controller’s liability when it uses a processor?

Answer 7

As a data controller you are ultimately responsible for ensuring that personal data is processed in accordance with the GDPR.

Question 8

What responsibilities and liabilities do processors have in their own right?

Answer 8

• 􏰀 A processor must only act on the documented instructions of a controller.
• 􏰀 If a processor determines the purpose and means of processing (rather than acting only on the instructions of the controller) then it will be considered to be a controller and will have the same liability as a controller.

Question 9

Who is liable if a sub-processor is used?

Answer 9

The sub-processor has the same direct responsibilities and liabilities under the GDPR as the original processor has.

Question 10

If a sub-processor is used and someone makes a claim for compensation - who is responsible/liable?

Answer 10

Then there are potentially three liable parties: you as controller, the original processor, and the sub-processor.

Question 11

Name an example of a sub-processor?

Answer 11

The readers of a monthly science magazine receive a hard copy delivered to their home. The subscriptions are handled by a company which is separate from the magazine publisher. Rather than arranging the mailings itself, the subscription company uses a different company as sub-processor to administer the mailing list and arrange the mailings to subscribers.

Question 12

Name an example of a processor?

Answer 12

A marketing company sends promotional vouchers to a hairdresser’s customers on the hairdresser’s behalf.