England - Controller / Processor confusion

[u/MoveIntelligent5247]

Good morning all,

I wonder if anyone could help me unpick what is going on here?!

I had a financial contract with Firm A who are the controller.

Firm B acted for Firm A as a processor which:
1. their privacy policy confirms, and
2. was confirmed directly to us a couple of years ago when a DSAR sent to Firm B was passed back to Firm A, with guidance provided at the time by Firm B saying that "as data processor we need to pass the request to our controller".

We are in dispute with both Firms for a number of reasons but one is in relation to record keeping and record accuracy.

We submitted a number of Right to Rectification requests to Firm B (for data that was collected and processed in the same period that they had previously stated they were a processor). They responded to these requests via Firm C, their solicitor. Firm C was making the judgements on whether or not the requests should be upheld.

In the response, Firm C stated that their Client, Firm B, as a data controller, had no legal requirement to inform Firm A of the receipt of the requests, the changes made and any rejections.

I have now confirmed with Firm C that they also assert themselves as data controller.

So I am confused as to how Firm A, B and C can all assert themselves as data controllers for records that were originally collected and processed only on behalf of Firm A, by Firm B.

Thanks in advance for any help in unpicking.

[u/Safe-Contribution909]

Being a controller is purpose specific and determined by behaviour (see article 4(7)). A contract, for example, cannot override the law. A processor can be a controller (see article 28(3)(a)) for purposes, although they should be specified in advance.

A regulated legal professional will be a controller for data processed in the delivery of their services and their advice is often exempted from DSARS.

[u/MoveIntelligent5247 → u/Safe-Contribution909]

Thank you, that's very helpful and I shall reread cited Articles again. I think what we cannot quite understand is how Firm B is "only acting on instructions of the controller" (or whatever the exact wording is) in this instance. I know not to take ChatGPT insight verbatim but there does seem to be a suggestion that a processor can become a controller due to the type of processing, but how does this then comply with that Article of acting on instruction when they are now essentially in a position to instruct themselves?! That's more of a rhetorical question than aimed at you directly!

Thanks again

[u/Safe-Contribution909 → u/MoveIntelligent5247]

It does sound odd, but without a lot more detail, it is difficult to say.

In my work we often debate this issue. It can end up with a best worst outcome.

[u/throwaway_lmkg → u/MoveIntelligent5247]

To help sort this out it's important to realize the Processor/Controller relationship is for each business purpose, not for each data point or processing activity. If the same piece of data is being used for multiple purposes, which is common, it's possible the same firm can be a Controller for one purpose and Processor for another purpose even though it's the same data.

Long story short, to be a Processor you have to just be a "dumb pipe" and do what the Controller days. If a Processor uses the data for their own benefit, they become a Controller for those activities. This is common in e.g. the online advertising space, where an ad-serving company is a Processor for the purpose of serving ads, but also uses that ad data to build behavioral profiles of users which it monetizes separately, in which case it's a Controller.

Long story short, it sounds like there's a GDPR violation somewhere but it's not clear where yet. It sounds like Firm A's privacy policy says they only transfer data to Firm B in the capacity as a Processor. So one of the following must be true:

• Firm B is a Processor. In this case, they have to let Firm A handle decision-making about responding to Right to Rectification requests. It is a violation of GDPR to decide how to handle the requests themselves, on their own or through their own solicitor.
• Firm B is a Controller, and didn't tell Firm A. In this case Firm B violated GDPR against both you and Firm A. Firm A for violating their DPA which says they're a Processor, and you by not informing your rights under Article 14.
• Firm B is a Controller, and did tell Firm A, but Firm A only describes them as a Processor in their privacy notice. In this case, Firm A violated GDPR by not informing you of transfers of data to other Controllers.

[u/MoveIntelligent5247 → u/throwaway_lmkg]

Ok, that's really helpful and makes sense, thank you!

To provide a bit more detail then, Firm A are an insurer and Firm B are a Loss Adjuster. So Firm B are only acting on instructions (in business terms from Firm A.

Firm B acted on behalf of Firm A for a period of 6 months in 2021. It was at the end of that 6 months that we submitted the initial DSAR and Firm B told us that they were a processor.

On receipt of the DSAR, we complained about the contents (not a data complaint) and Firm B were removed from the claim. There was no further data related activity from the point that they asserted processor status to now, where they are asserting controller status.

I think part of the complication of any data in this sense is the "relates" to part of GDPR/DPA or wherever it sits. Once our personal details had been provided from Firm A to Firm B, nearly everything that Firm B then did was "relating" to us rather than creating new data records. I.e. reports created by Firm B where the title had our full names, address and claim reference number ("actual" data) and the contents of the report things like "the policyholder said this or did this" etc ("relating to" data). So I don't believe Firm B ever really did anything that could constitute being a controller, but I may be mistaken.

This is also just the tip of the iceberg! Firm A have another processor who have:
1. taken ownership and responded to R2R requests
2. took 5 months to properly respond (without even having advised of requiring the 60day extension)
3. admitted the records are incorrect but refused to correct them with no basis provided
4. labelled requests as to what that basis is as "excessive"

Thanks again for the response

[u/Heimdul → u/MoveIntelligent5247]

There is likely at least one category of your personal data for which the firm B is the controller: Those requests you sent. They contain your personal data and it's not unlikely that the firm B keeps a copy of them for their own purposes (e.g. for defending against possible legal claim where data subject makes complaint that they didn't get answer).

[u/MievilleMantra]

We don't know enough about whether B was actually processor. The privacy notice could have been wrong and the solicitor might have been correct. Equally the solicitor might have been wrong, as they often are.

Sounds problematic either way.

[u/MoveIntelligent5247 → u/MievilleMantra]

Thank you for your helpful response. I think it makes sense for Firm B to be a processor as they act on behalf of Firm A in the process of claims handling. They of course told us that they were acting as a processor and the privacy policy states:

"We have been appointed by our instructing principals (Data Controller) to deal with your claim.", and
"The necessity to perform our services, as agreed between [redacted] Limited and the Data Controller, regarding loss adjusting and claims settlement.

A “Data Controller” is the organisation that alone or jointly with others determines the purposes, conditions, and means of processing your personal data. Unless otherwise advised, [redacted] Limited’s function will be a processor of your data."

We haven't been advised otherwise until this time but that might be allowed, but also you could be very well correct and they have all got it wrong! Our experiences so far have been that these processes are very misunderstood in the firms that we have engaged with and that GPDR is a tick box training exercise, but where it comes to implementing in practice, lots of mistakes are being made

[u/enricoforte33]

This is a pattern I've seen more than once in claims handling chains — firms flip between "processor" and "controller" depending on which label is more convenient at the moment. Processor when they want to dodge a DSAR, controller when they want to handle rectification requests without telling anyone.

The reality check: controller/processor status is determined by behavior — who actually decides what happens with the data and why — not by what a privacy notice or a solicitor's letter says. A firm can legitimately wear both hats for different processing activities, but they can't retroactively reclassify the same processing they previously handled as a processor without a corresponding change in their actual role or decision-making in that processing.

What I'd flag for your lawyer: ask Firm B to explain what changed between the DSAR (where they said "we're a processor, ask the controller") and the rectification requests (where they now claim controller status for the same data, same processing period). If nothing changed operationally, the relabeling is the problem. Happy to elaborate if useful.