CASES, SANCTIONS AND CLAIMS
- In decision DOS-2018-02716, the Belgian Data Protection Authority found that a data controller failed to put in place a written contract with its data processor.
- The Polish supervisory authority imposed first administrative fine on a public entity for failing to conclude data processing agreements with its data processors.
REPORTS AND ARTICLES FROM OTHER ORGANISATIONS
OFFICIAL GUIDELINES, REPORTS AND STATEMENTS
- Baden-Württemberg DPA: sample joint controllers agreement.
- Irish DPC: Practical Guide to Controller-Processor Contracts (the Guide is available here).
- Baden-Wuerttemberg DPA: template for agreements between joint data controllers (source in German).
- Baden-Wurttemberg DPA: template for agreement according to art. 28 GDPR (Controller/Processor).
- EDPB: public consultation on the Guidelines 07/2020 on the concepts of controller and processor in the GDPR, which aims to clarify the meaning of such concepts, clarifying the roles and distribution of responsibilities between these actors.
- The State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg announced it has adopted a Model Controller Processor Agreement for commissioned data processing within the EU and the EEA (Article 28 (3) of the GDPR).