IS DATA PROCESSING AGREEMENT A SILVER BULLET UNDER GDPR?

RETURN TO MAIN BLOG


When is access a processing?
An interesting fact: “access to data” was not listed in Article 4 (2) of GDPR as a processing activity. Precisely speaking: “provision of access” is a processing activity, because this is a “disclosure by transmission, dissemination or otherwise making available”, but getting access is not necessarily “an operation performed on data”.

Actually, access to data may be obtained unintentionally or even against the will of the data recipient. It means, when someone provides access to personal data – it processes personal data by performing an active action: operation on personal data by making this data available to third parties. Whereas, when someone gets access to personal data – it is not always a performance of an operation on personal data, not always an action or even a voluntary action of data recipient.

 

CPO MAGAZINE