I'm not sure I follow the argument about the nature of the contractor - it seems to me that the degree of determination of the means of processing is what the relationship turns on (who determines the purpose being clear).
How detailed are the instructions given to the supplier? Are they told what data to collect, how long to keep it, is it clear who should respond to SARs, who provides privacy notices, collects the data, etc. The answer to the 'means' question (i.e. the level of autonomy given to the contractor) will affect whether it is processor, controller or joint controller.
I would hazard towards them being a controller, on the basis of similar rationale that applies to solicitors and the exercise of professional expertise.
Dan
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Speirs, Seth
Sent: 04 April 2019 16:08
To: [log in to unmask]
Subject: Re: [data-protection] Joint Controller or Separate Controllers?
I would have to partially support Phil here. He's right that where you are seeking someone's professional judgement you are getting into controller territory and if you want to retain some control over the data then you really have to go down the road of a joint controller relationship.
That said if you are employing a company rather than an individual contractor then the argument that they are a processor acting on your instructions are a little stronger.
-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of Phil Bradshaw
Sent: 04 April 2019 15:55
To: [log in to unmask]
Subject: Re: [data-protection] Joint Controller or Separate Controllers?
I disagree with the two previous comments.
I would categorise this as controller - controller. In general when someone is providing a professional service and exercising judgement that is controller activity. Is it really different in principle from e.g. a GP getting a report from a cardiologist - yes I know there are differences as a workspace assessment is more specifically defined.
If I was such a supplier, at risk of being sued by someone who suffered injury if my assessment was alleged to be negligent, I certainly would not want to regard myself as a processor, when the customer could on a whim insist I destroy all my records. I wouldn't be happy. My insurer would be less happy ...
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
________________________________________________________________________
The information in this email (and any attachment) may be for the
intended recipient only. If you know you are not the intended recipient,
please do not use or disclose the information in any way and please
delete this email (and any attachment) from your system.
The Council does not accept service of legal documents by e-mail.
________________________________________________________________________
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|