CASES, SANCTIONS AND CLAIMS

  • In decision DOS-2018-02716, the Belgian Data Protection Authority found that a data controller failed to put in place a written contract with its data processor.
  • The Polish supervisory authority imposed first administrative fine on a public entity for failing to conclude data processing agreements with its data processors.

REPORTS AND ARTICLES FROM OTHER ORGANISATIONS

OFFICIAL GUIDELINES, REPORTS AND STATEMENTS

  • Baden-Württemberg DPA: sample joint controllers agreement.
  • Irish DPC: Practical Guide to Controller-Processor Contracts (the Guide is available here).
  • Baden-Wuerttemberg DPA: template for agreements between joint data controllers (source in German).
  • Baden-Wurttemberg DPA: template for agreement according to art. 28 GDPR (Controller/Processor).
  • EDPB: public consultation on the Guidelines 07/2020 on the concepts of controller and processor in the GDPR, which aims to clarify the meaning of such concepts, clarifying the roles and distribution of responsibilities between these actors.
  • The State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg announced it has adopted a Model Controller Processor Agreement for commissioned data processing within the EU and the EEA (Article 28 (3) of the GDPR).