contract-law privacy european-union gdpr
In GDPR, who exactly are the processors and what do they have to do?
<p>I thought the processor was just someone who processes <em>all</em> personal data on behalf of the controller, basically a simple substitute for some matters. But from what I read online it seems that a processor is anyone that deals with any personal data, even partial data, as part of a service provided to the controller. So it sounds like <em>everyone</em> that deal with personal data as part of their job is a processor, except the end users of the service. But since processors must be bound by a specific contract to deal with the needs of the controller (article 28 says "processes the personal data only on documented instructions from the controller), then I'm afraid it will soon become a huge mess with a gazillion contracts to sign.</p>

<p>For example, John Doe has a website with a contact form. The contact form collects data, and the end user should accept the privacy policy written by John Doe. John Doe is the controller. However, John Doe's website is managed by a web agency! Is this web agency a processor? I guess so. So John doe needs to write a contract and have the web agency sign it. If every website owner does this, the web agency will have to read and sign hundreds of contracts. But the web agency hosts the sites on a web hosting provider, which in turn becomes another processor! And they use Gmail, provided by Google, which in turn is yet another processor that will have to sign millions of contracts. And so on, in an potentially endless cycle, just thinking that if you read your work email from your iPhone you might have to send a contract to Apple too. </p>

<p>It seems a huge mess to me, but I'm not sure I get it right. It looks like everyone is a processor except the end user, but the confusing thing is that the the law seems to say that it's the controller the one who decides the contractual terms, so it's not just a matter of accepting a privacy policy like we have been doing so far. So far, Google has provided a service to you, and you agreed to their privacy policy. Now it seems it's you, if you are a controller or a processor, that have to come up with a contract and Google has to accept it (if they want to). Like it's the other way around compared to the usual privacy policies. Of course this will probably never happen, and Google will probably come up with predefined contracts that both parties can agree on, but at that point what difference would there be between the contract required by GDPR and the usual privacy policies everyone has been using so far?</p>

<p>I hope the question is clear enough. I'm basically very confused about the actual role and duties of processors in real-world scenarios.</p>

<p>You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about <em>every third party subcontractor</em> that you use for data processing, including various cloud providers.</p>

<blockquote>
  <p>I'm afraid it will soon become a huge mess with a gazillion contracts to sign.</p>
</blockquote>

<p>I disagree.  Yes, the GDPR says that a contract between the controller and processor must exist, but <a href="https://gdpr-info.eu/art-28-gdpr/" rel="nofollow noreferrer">Article 28</a> of the GDPR does not say anything about <em>how</em> the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the  web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is <em>also</em> the DPA as required by the GDPR.</p>

<p>Putting something like the following in the service agreement would do it:</p>

<blockquote>
  <p>The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your <em>complete and final instructions</em> to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us.  You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. </p>
</blockquote>

<p>I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in <em>addition</em> to these amended service contracts.</p>
