Gail,
you are right in saying that only data controllers are required to notify but
everyone has to comply with the 8 principles data processors as well as data
controllers.
A data processor when performing certain functions can become a data
controller. e.g. An employment agency that you have employed as part of its
remit checks with the credit reference agency to see if the applicant appears
on the electoral register and has no county court judgements. That employment
agency is your data processor but when they access the credit reference
agency they become joint data controller with the credit reference agency
with regard to that aspect of the processing. I feel that when the courts get
hold of this legislation they will develop further this relation between and
definition of data controller/data processor.
Chris Brogan
|