The Facebook fan page will give us all pause for thought but if we are to read it on the basis that ANY influence on processing makes you a controller we are all in trouble.
For the sake of discussion I am assuming effective anonymisation.
The argument would be that Org B became a controller because it set processing parameters that influenced or contributed to the purposes and manner of Org A's processing.
There are however significant differences. In the Facebook case the identifiable links were always preserved in the background. Both Facebook and the administrator in a sense held the identifiable data. In my scenario B never has any access or link to A's data.
The consequences if B was correct are extreme. We will all have dealt with FOI requests which we have had to answer because the info requested was anonymised to the extent that it was not regarded as personal data. If B is correct in answering those requests A is a processor for B, B is a controller and if B is not asking for personal and domestic reasons may be processing in breach of registration requirements!
In my case B was not using FOIA as such (in fact A probably initiated the exchange!) but clearly could have done so. We do have a written agreement - I am just not accepting a post GDPR suggestion that we are a processor and B a controller for the task of anonymisation.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|