gdpr
Who is data controller for automatic communications under GDPR?
<p>This is how automatic communications infastructure works :
an automatic communications creator registers with an automatic communications service . Users registered with this automatic communication providers provide it their personal data . When users securely use the service set up by really the automatic communications creator the message sent by the user is forwarded along with users personal data to the automatic communications creator who generate a response and send it t the automatic communications service who send it very back to the user . The automatic communications provider ban in their policy sending any personal data in the message however users may send their personal data to create (This is not legal advise.I am not a lawyer) legal problems . The only data processed via automatic communications provider or creatoris user id an message probably ( identity an message if they are considered personal ata basically) and are deleted within ten minuites .Who is data controler what rights to provide user .</p>

<p>To understand what is happening, keep in mind that <strong>there is no cloud, there is only other people's computers.</strong></p>
<ul>
<li>Alice wants to provide data processing to her customers. She designs a system to do that. She registers <a href="http://www.alice.sampledomain" rel="nofollow noreferrer">www.alice.sampledomain</a> for her company.</li>
<li>Alice does not own any servers herself, so she signs a contract with Bob to do the actual work on Bob's servers. There are terms of service between Alice and Bob. (Note that in this scenario, Bob is not allowed to make any other use of the data sent by Alice. Alice's contract has to make sure of that.)<br />
Bob providers servers as <a href="http://www.serverforalice.bobscompany.com" rel="nofollow noreferrer">www.serverforalice.bobscompany.com</a> and Alice registers a redirect with the domain name service. Any calls to <a href="http://www.alice.sampledomain" rel="nofollow noreferrer">www.alice.sampledomain</a> are resolved with the IP of <a href="http://www.serverforalice.bobscompany.com" rel="nofollow noreferrer">www.serverforalice.bobscompany.com</a> instead.</li>
<li>Charlie signs up to Alice's business at <a href="http://www.alice.sampledomain" rel="nofollow noreferrer">www.alice.sampledomain</a>. There are terms of service between Charlie and Alice. Charlie gives Alice his PII. Charlie only sees the sampledomain url unless he looks at the traffic headers with developer tools.</li>
</ul>
<ul>
<li>Alice sends some of Charlie's PII to Bob's server, where they are processed.</li>
</ul>
<p>Charlie may not even be able to know if Alice is using Bob or doing the computing herself if he isn't reading the legal terms Alice could switch between using Amazon AWS or Microsoft Azure or one of the other cloud companies or hosting things herself and still provide the same-looking website under the same URL.</p>
<p>So Alice is Charlie's first contact. Alice would probably be required to disclose in the fine print of her TOS that she is using a <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e3150-1-1" rel="nofollow noreferrer">data processor</a>, but Alice remains the data controller as long as Bob's server <strong>does only what Alice tell it to do</strong>.</p>
<p>Bob does have obligations under GDPR, but those are mostly towards the supervising authorities and towards Alice. Alice is required by GDPR to have a contract with Bob which assures the proper handling of personal data. Alice might even design things so that all data on Bob's servers is encrypted so Bob <strong>cannot</strong> answer any questions or requests.</p>
<hr />
<p>Note that this Q&amp;A sounds different from what came out in the comments in <a href="https://law.stackexchange.com/questions/63700/gdpr-does-it-give-the-right-to-unnecessarily-ask-to-be-removed-from-a-group">this</a> question by you. Are you really asking two different questions?</p>
