Linked here our full comments on the European Data Protection Board’s Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Submitted by Prof. Derek McAuley, Prof. Lilian Edwards, Dr. Lachlan Urquhart and Dr. Jiahong Chen of Horizon Digital Economy Research Institute.

27 October 2020

Summary: Overall, the EDPB’s adoption of the Guidelines provides additional clarity and certainty for data controllers and processors to comply with the GDPR. We provide three recommendations as to how the Guidelines can be improved in the final version:

• Further clarify the nature of the influence on the purposes and means of the processing exercised by the technology providers, especially when there is a clear power imbalance;
  
  
• Explicitly specify that the arrangement between joint controllers as required by Article 26 should take into account which controller is best-positioned to fulfil a specific duty, ideally with real-life examples of domestic controllers;
  
  
• Encourage joint controllers to agree on such an arrangement in a fair manner by allowing the arrangement to take effect on how data subject requests are handled, provided that it does not create any extra burden on the data subject