white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 6: ENTITIES TO BE DEFINED IN THE LAW: DATA CONTROLLER AND
PROCESSOR
6.1 Introduction
Accountability is a central principle in data protection. To translate data protection norms into
action, a widely used method is to identify the party accountable for compliance with these
norms. For this purpose, the concept of control over data is used.
Control over data, in such systems, refers to the competence to take decisions about the
contents and use of data. 258 The entity that has control over data is responsible for compliance
with data protection norms and is termed a ―data controller.‖ In addition to the data controller,
other entities which take part in the processing of data are often identified and defined. For
instance, a data processor is an entity which is closely involved with processing, which
however, acts under the authority of the data controller. 259
Identification of all entities participating in the entire cycle of data processing is not the only
method of allocating responsibility. There are various models which have evolved in this
regard in other jurisdictions. Each operates at a different level of specificity in identifying the
entities involved in processing. These alternatives are considered below.
6.2 Issues and International Practices
European Union
The model that is most prescriptive is the EU GDPR which uses the concepts of data
controller, data processor and third party to identify various entities involved in the
processing of personal data. 260 A data controller is the entity which determines the purposes
and means of processing data. 261 A processor is an entity which processes data on behalf of
the controller. 262 The meaning of ―third party‖ is not immediately apparent from the
definition which refers to other entities apart from controllers or processors who under the
authority of controller or processor are authorised to process data. 263 A useful illustration is of
258 See ‗Definition of data controller‘ in OECD, ‗OECD Guidelines Concerning the Protection of Privacy and
Transborder Flows of Personal Data‘ (2013), available at:
http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.ht
m#part1, (last accessed 31 October 2017).
259 Article 29 Data Protection Working Party Opinion, ‗Opinion 01/2010 on the Concepts of ‗Controller‘ and
‗Processor‘‘, European Commission (16 February 2010), available at:
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp169_en.pdf, (last accessed 31 October 2017).
260 A fourth category of recipient is also identified in Article 4(9), EU GDPR.
261 Article 4(7), EU GDPR.
262 Article 4(8), EU GDPR.
263 Article 4(9), EU GDPR.
48