4

According to Rec.81; Art.28(1)-(3) of the GDPR regulation,

"The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller"

A controller that wishes to appoint a processor must only use processors that guarantee compliance with the GDPR. The controller must appoint the processor in the form of a binding written agreement, which states that the processor must:

  • only act on the controller's documented instructions;
  • impose confidentiality obligations on all personnel who process the relevant data;
  • must ensure the security of the personal data that it processes;
  • abide by the rules regarding appointment of sub-processors;
  • implement measures to assist the controller in complying with the rights of data subjects;
  • assist the controller in obtaining approval from DPAs where required;
  • at the controller's election, either return or destroy the personal data at the end of the relationship (except as required by EU or Member State law);
  • and provide the controller with all information necessary to demonstrate compliance with the GDPR.

I've checked every major host provider there is and none offers such guarantees.

So question is, how do I as a controller comply with GDPR if there's no host provider (aka processor) who'll sign a contract addressing all 8 points required by the GDPR?

The regulation clearly states that controller is responsible for this.

Improve this question
4
  • So, none of these providers charge for their services? If they do, then that Is a contract.
    – Dale M ♦
    Commented May 7, 2017 at 10:17
  • Then why do they say "NO CONTRACT"?
    – Nora Varner
    Commented May 7, 2017 at 10:20
  • I presume they mean no ongoing contract i.e. the contract can be cancelled by the consumer at short notice. NO CONTRACT is advertising speak: it doesn't reflect the legal reality.
    – Dale M ♦
    Commented May 7, 2017 at 11:01
  • 1
    Well either way, they don't address the points required by GDRP and that's my issue. Maybe they have it ready for 2018, but that's not enough for people who wish to deal with compliance prior to 2018.
    – Nora Varner
    Commented May 7, 2017 at 11:11

2 Answers 2

Reset to default
6

Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time.

Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the blog post:

If your organization collects, hosts or analyzes personal data of EU residents, GDPR provisions require you to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. To further earn your trust, we are making contractual commitments available to you that provide key GDPR-related assurances about our services. Our contractual commitments guarantee that you can:

  • Respond to requests to correct, amend or delete personal data.
  • Detect and report personal data breaches.
  • Demonstrate your compliance with the GDPR.

Microsoft is the first global cloud services provider to publicly offer you these contractual commitments. We believe privacy is a fundamental right. The GDPR is an important step forward to further clarify and enable individual privacy rights and look forward to sharing additional updates how we can help you comply with this new regulation and, in the process, advance personal privacy protections.

Microsoft has set up an informational site on GDPR here.

If your eyes are on any other provider, I think the only way to learn more is getting in touch and inquiring about their progress and process. Hope this helps.

Improve this answer
1
  • When I worked in health care (USA), I had to ensure that I never created an app that could raise an unhandled exception. Because that would have resulted in a pop-up asking the user to send debugging info to Microsoft. The fine print (that few users would read) said that the info might contain personal data which Microsoft promises to not use. Even if they honor that promise, sending the data would violate the federal law known as HIPAA.
    – WGroleau
    Commented Mar 8, 2022 at 20:26
2

Here's the Google equivalent of that Microsoft blog post:

Our users can count on the fact that Google is committed to GDPR compliance across G Suite and Google Cloud Platform (GCP) services when the GDPR takes effect on May 25, 2018.

It's all still couched in future terms ("We'll make important updates to contractual commitments") so you still have the "not ready NOW" problem.

Here's the Amazon version. Same deal. Looks like everyone's still working on it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .