2.2. What are the possible roles for an SME in the processing operations? The obligations of an SME under the GDPR depend on what they do with the personal data they process. Three scenarios can be envisioned. First, an SME may act as a data controller (or controller) and process personal data by itself. Second, it may instruct another entity – a data processor (or processor) – to process personal data on its behalf, while still acting as a controller. Third, it may process personal data on behalf of another entity, and in this way act as a processor. Both controllers and processors must comply with specific rules,64 the ultimate responsibility for the processing of personal data and, in principle, can be held liable for damages arising from any infringement of the GDPR. Processors can only be held liable if they fail to comply with obligations of the GDPR specifically directed to them OR if they acted outside of, or contrary to, the lawful instructions of the controller.65
64
For example, processors must be able to demonstrate compliance, keeping records of processing activities; ensure the security of processing, implementing technical and organizational measures; nominate a DPO in certain situations; notify data breaches to the controller. See FRA/ECtHR/EDPS, Handbook on European data protection law (Publications Office of the European Union 2018), 101, 102. Compared with the previous Data Protection Directive, the obligations posed by the GDPR on processors have increased. See Gabel, D. and Hickman, T., ‘Chapter 11: Obligations of processors – Unlocking the EU General Data Protection Regulation’ in White & Case LLP (ed.), Unlocking the EU General Data Protection Regulation: A practical handbook on the EU’s new data protection law (5 April 2019) https://www.whitecase.com/publications/article/ chapter-11-obligations-processors-unlocking-eu-general-data-protection.
65
Van Alsenoy, B., ‘Liability under EU Data Protection Law: From Directive 95/46 to the General Data Protection Regulation’ (2016) 7 JIPITEC 271 para 1 https://www.jipitec.eu/issues/jipitec-7-3-2016/4506.
2. Personal data protection basics
but the responsibilities of the controller are higher. Controllers bear
41
