Processor obligations and the CJEU’s Scania judgment nuances

Reposting, as I disagree in part and think it’s a debate worth having. If someone acts as a processor under GDPR and processes information that the processor cannot lawfully link (or get linked) to an identifiable natural person but that is personal data from the perspective of the controller, the processing on behalf of the controller is obviously under the authority of the controller and thus personal data processing.

However, it raises interesting questions regarding *further processing*, for instance for service improvement purposes.

This is where the CJEU’s Scania judgment comes in:

– If that processing is clearly intended to stay within the processor’s “control”, and there is never any recipient, then the GDPR scope *could* be excluded specifically for those purposes – but there would be a violation of the controller-processor contract if that is not foreseen.

– However, if there is any recipient, the Scania nuance of “indirect” personal data (or my preferred term: “potentially personal data”) comes into play. It doesn’t mean all controller obligations apply to the processor, but some precautions have to be taken. Whether malicious actors and the results of their actions have to be taken into account is a touchy issue.

Data protection privacy