Article 29 GDPR: Difference between revisions

From GDPRhub
No edit summary
 
(9 intermediate revisions by 5 users not shown)
Line 2: Line 2:
![[Article 28 GDPR|←]] Article 29 - Processing under the authority of the controller or processor [[Article 30 GDPR|→]]
![[Article 28 GDPR|←]] Article 29 - Processing under the authority of the controller or processor [[Article 30 GDPR|→]]
|-
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
| style="padding: 20px; background-color:#003399;" |[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|-
|
|


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 17: Line 17:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 31: Line 31:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 50: Line 50:
</div></div>
</div></div>


<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 77: Line 77:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 91: Line 91:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 107: Line 107:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 131: Line 131:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 146: Line 146:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 160: Line 160:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 169: Line 169:
</div></div>
</div></div>


<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<div class="mw-collapsible-content">
Line 184: Line 184:
|}
|}


== Legal Text ==
==Legal Text==
<br /><center>'''Article 29 - Processing under the authority of the controller or processor'''</center><br />
<br /><center>'''Article 29 - Processing under the authority of the controller or processor'''</center>


The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.


== Relevant Recitals==
==Relevant Recitals==
''You can help us fill this section!''
{{Recital/81 GDPR}}


== Commentary ==
==Commentary==
Article 29 GDPR obliges processors and anyone with access to personal data that acts under the authority of the controller or processor to only process those data on instructions from the controller, unless required to do otherwise by Union or Member State law. 


''You can help us fill this section!''
===Commonalities and differences in relation to [[Article 28 GDPR|Article 28(3)(b) GDPR]]===
After deliberations during negotiations between the Council, Parliament and Commission, the provision was maintained in the final text of the GDPR despite some arguments against its relevance. The provision is aimed at reinforcing the processor’s obligations to only act in line with the controller’s instructions, as well as at clarifying that these obligations extend to any person acting under the authority of the controller or processor.<ref>''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 29 GDPR, p. 613 (Oxford University Press 2020).</ref>


== Decisions ==
The discussions on the relevance of Article 29 GDPR were rooted in the fact that [[Article 28 GDPR|Article 28(3)(b) GDPR]] already seems to cover much of the scope of Article 29 GDPR. More specifically, [[Article 28 GDPR|Article 28(3)(b) GDPR]] states that the contract between the controller and processor shall stipulate that the processor “''ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality''”.
 
While [[Article 28 GDPR|Article 28(3)(b) GDPR]] seems to already designate the controller as liable for violations carried out by its employees, ''Millard'' and ''Kamarinou'' suggest that  “''Article 29 GDPR exists to reiterate that, despite the processor’s increased responsibilities under the GDPR, it is ultimately the controller’s instructions which should be followed at every stage of the processing.''”<ref>''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 29 GDPR, p. 615 (Oxford University Press 2020).</ref> As such, Article 29 GDPR explicitly extends the obligations arising from the data processing agreement in [[Article 28 GDPR|Article 28(3)(b) GDPR]] to all persons acting under the authority of the controller and processor.
 
==Decisions==
→ You can find all related decisions in [[:Category:Article 29 GDPR]]
→ You can find all related decisions in [[:Category:Article 29 GDPR]]


== References ==
==References==
<references />
<references />


[[Category:GDPR Articles]]
[[Category:GDPR Articles]]

Latest revision as of 13:15, 2 June 2023

Article 29 - Processing under the authority of the controller or processor
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 29 - Processing under the authority of the controller or processor

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

Relevant Recitals

Recital 81: Entrusting a Processor
To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject. The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.

Commentary

Article 29 GDPR obliges processors and anyone with access to personal data that acts under the authority of the controller or processor to only process those data on instructions from the controller, unless required to do otherwise by Union or Member State law.

Commonalities and differences in relation to Article 28(3)(b) GDPR

After deliberations during negotiations between the Council, Parliament and Commission, the provision was maintained in the final text of the GDPR despite some arguments against its relevance. The provision is aimed at reinforcing the processor’s obligations to only act in line with the controller’s instructions, as well as at clarifying that these obligations extend to any person acting under the authority of the controller or processor.[1]

The discussions on the relevance of Article 29 GDPR were rooted in the fact that Article 28(3)(b) GDPR already seems to cover much of the scope of Article 29 GDPR. More specifically, Article 28(3)(b) GDPR states that the contract between the controller and processor shall stipulate that the processor “ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality”.

While Article 28(3)(b) GDPR seems to already designate the controller as liable for violations carried out by its employees, Millard and Kamarinou suggest that  “Article 29 GDPR exists to reiterate that, despite the processor’s increased responsibilities under the GDPR, it is ultimately the controller’s instructions which should be followed at every stage of the processing.[2] As such, Article 29 GDPR explicitly extends the obligations arising from the data processing agreement in Article 28(3)(b) GDPR to all persons acting under the authority of the controller and processor.

Decisions

→ You can find all related decisions in Category:Article 29 GDPR

References

  1. Millard, Kamarinou, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 29 GDPR, p. 613 (Oxford University Press 2020).
  2. Millard, Kamarinou, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 29 GDPR, p. 615 (Oxford University Press 2020).