Opinion No. 22/2024 “on certain obligations arising from the use of data processors and sub-processors [in data processing]” issued by the European Data Protection Board clarifies the obligations of the data controller and processor within the personal data processing chain. The interpretation provided by the Board highlights the increasingly central role of the ability to monitor and manage the supplier chain for compliance purposes. However, the practical implementation of the Board’s guidelines raises certain challenges, especially when compared with the actual conditions of the market.

The Danish Supervisory Authority’s Query

The opinion stems from two queries presented by the Danish Supervisory Authority, which concern the obligations of data controllers toward suppliers. The most significant questions addressed whether the data controller must identify all processors and sub-processors involved in the chain, what verification obligations the controller has regarding their compliance, and whether such obligations are influenced by the classification of the supplier as “high-risk.”

The Board’s Opinion

Obligation of the Data Controller to Verify

Regarding the obligation to identify entities involved in the chain, the Board clarifies the “central” role of the data controller, who is tasked with identifying all entities in the chain, including processors, their sub-processors, subsequent sub-processors, and so forth.

This identification involves determining the name and address of the processor, the contact details of a designated individual, a description of the processing, and a clear delineation of responsibilities related to data processing.

Data controllers must also be in a position to effectively determine the means and purposes of processing and exercise effective authorization powers concerning the identification of sub-processors pursuant to Article 28(4) GDPR. In this regard, the opinion provides clarifications on general authorization, which requires attaching a list of processors that must be kept up-to-date after the agreement is signed. The Board further specifies that only the controller has the authority to decide on the use of additional or new sub-processors.

The Board notes that knowledge of such information is necessary not only for compliance with Article 28 GDPR but also for fulfilling transparency obligations (Articles 13-14 GDPR), the right of access (Article 15 GDPR), and notification obligations in cases of data rectification, erasure, or processing restriction (Article 19 GDPR).

In parallel with this framework, the processor is obligated to maintain an updated list of sub-processors and make it readily accessible to the controller.

Noteworthy is the suggestion for the parties to the data processing agreement to define the modalities for communicating the list of processors, including agreeing, if necessary, on the format of the file containing the list. This reference highlights the possibility of transferring information in formats readable by specific software.

Graduation of the Controller’s Obligations Based on Risk

Regarding the Danish Authority’s query on the possibility of calibrating the controller’s obligations based on the risk level associated with the supplier, the Board’s responses are particularly interesting.

Indeed, while the Board clarifies that the controller’s verification obligations apply independently of the risk level, the manner of execution can be adjusted according to this factor.

The ratio of this interpretation lies in the differing nature of Articles 24 and 28 of the GDPR. The former cannot be interpreted to allow the controller to avoid fulfilling legal obligations due to a low risk level. Conversely, the adequate security measures required of the processor under the latter article must be proportionate to the risk associated with the processing entrusted to them.

As a result, the controller must always map the processors involved and verify that they impose similar obligations on sub-processors throughout the chain. However, the operational methods for conducting these verifications may vary, requiring stricter measures and more stringent checks for processors presenting a high degree of risk.

Operational Considerations

While the Board’s opinion is helpful in clarifying the importance of data control within the production chain, certain aspects remain elusive.

In particular, it is essential to understand how controllers can fulfill the obligations in question when conditions are unilaterally dictated by a service provider with an economic advantage. This observation is significant: the Danish Authority’s query arises precisely from investigations conducted in the context of cloud-based services, where the supplier chain is particularly fragmented, and contractual power is concentrated on the providers.

The EDPB’s interpretation is legally consistent but does not resolve the concerns of controllers struggling to demonstrate compliance with processing activities performed via such services.

From a strategic perspective, the role of the service provider becomes increasingly prominent, as they bear greater responsibility for ensuring not only the efficiency of their product but also its compliance with legal requirements, including organizational standards and the use of sub-suppliers. For those developing cloud-based services, compliance with data law regulations is becoming a market differentiator, as it forms part of the guarantees offered to their clients.

On this point, it is also worth noting that the processor (i.e., the service provider) is required to take an active role. This is clearly evidenced not only by the language of the ruling in question but also by precedents from the Data Protection Authority. Processors are subject to specific legal obligations, independent and parallel to those of the controller, which can lead to independent sanctions in administrative proceedings. Moreover, as highlighted by the EDPB, controllers may pursue contractual liability actions against non-compliant processors.

Article by: Attorney Gabriele Ientile