Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Paragraph 2.1.5  “Of the processing of personal data”

40. The purposes and means determined by the controller must relate to the “processing of personal data”. Article 4 (2) GDPR defines the processing of personal data as “any operation or set of operations which is performed on personal data or on sets of personal data”. As a result, the concept of a controller can be linked either to  a single processing operation or to a set of operations. In practice, this may mean that the control exercised by a particular entity may extend to the entirety of processing at issue but may also be limited to a particular stage in the processing.

41. Anyone who decides to process data must consider whether this includes personal data and, if so, what the obligations are according to the GDPR. An actor will be considered a “controller” even if it does not deliberately target personal data as such or has wrongfully assessed that it does not process personal data.

42. It is not necessary that the controller actually has access to the data that is being processed. Someone who outsources a processing activity and in doing so, has a determinative influence on the purpose and (essential) means of the processing (e.g. by adjusting parameters of a service in such a way that it influences whose personal data shall be processed), is to be regarded as controller even though he or she will never have actual access to the data.

                                 Example: Market research

• Company ABC wishes to understand which types of consumers are most likely to be interested in its products and contracts a service  provider, XYZ, to obtain the relevant information.

• Company ABC instructs XYZ on what type of information it is interested in and  provides a list of questions to be asked to those participating in the market research.

• Company ABC receives only statistical information (e.g., identifying consumer trends perregion) from XYZ and does not have access to the personal data itself. Nevertheless, Company ABC decided that the processing should take place, the processing is carried out for its purpose and its activity and it has provided XYZ with detailed instructionson what information to collect. Company ABC is therefore still to be considered a controller with respect of the processing of personal data that takes place in order to deliver the information it has requested. XYZ may only process the data for the purpose given by Company ABC and according to its detailed instructions and is therefore to be regarded as processor.