“When People Just Click”: Addressing the Difficulties of Controller/Processor Agreements Online

Under the new General Data ProtectionData protection Regulation, data controllersController are only allowed to recruit data processors who provide “sufficient guarantees” that they will comply with data protectionData protection lawLaw . However, given the wide definitions of the terms “processing,” “controllerController/processor agreement ” and “processorProcessor ,” it is likely that we will see many situations where at least one of those parties is not acting in a professional capacity, but still comes under the remit of the GDPREuropean General Data Protection Regulation (GDPR) (e.g., if the personal dataPersonal data is being processing in a BlockchainBlockchain ). This creates the risk that parties will simply agree to contracts without having read or understood them, leading to significant legal liabilities for both parties and a lack of sufficient protection for data subjects. This chapter will look at how parties should arrange their contracts to provide the best possible chance of complying with data protectionData protection lawLaw . It will also consider how controllers can use technological and other non-contractual solutions to compliment those agreements while still respecting each party’s autonomy and freedoms. Finally, it will examine the regulatory strategies that can be used to allow amateur controllersController to exist without unnecessarily risking data subject rights and freedoms.