<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Gill Sans MT Pro Light";
panose-1:2 11 3 2 2 1 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h4
{mso-style-priority:9;
mso-style-link:"Heading 4 Char";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.Heading4Char
{mso-style-name:"Heading 4 Char";
mso-style-priority:9;
mso-style-link:"Heading 4";
font-family:"Calibri Light",sans-serif;
color:#2F5496;
font-style:italic;}
span.article-jurisdictions
{mso-style-name:article-jurisdictions;}
span.publication
{mso-style-name:publication;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:black">Thank you for sharing Erika.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Having read the guidance document, it remains clear that the distinction controller / processor is a functional one, which must be based on a factual analysis of the processing activities instead of the contractual
qualification and/or incurred liability.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">The Belgian DPA considers that a processor must operate as a subcontractor for the controller and that he must always operate <u>on the account of the controller and not on his own account</u>.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Regarding Joint Controllership Agreements (JCA), the Belgian DPA notes (freely translated):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> “<i>Joint controllers will have to determine their respective responsibilities in an agreement, pursuant to article 26 GDPR.”</i><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> and<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><i><span style="color:black">“The initiative taken when proposing a subcontracting agreement or the contractual imbalance that exists between parties during negotiations, does not preclude the status of controller
or processor of the person/entity taking the initiative or having a dominant position in the negotiations. One must always make an analysis on the basis of the prescribed factual criteria in order to legally qualify the role of each actor in the processing
activity.”</span></i><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">The above is certainly important regarding part 3 of the EPDP Report (Data Processing Terms) and for determining the responsibilities of ICANN and the (non) contracted parties.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Hope this is useful.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Best,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><br>
Flip<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-GB">Flip Petillion <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">fpetillion@petillion.law<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">+32484652653<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">www.petillion.law<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="NL-BE"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="http://www.petillion.law/"><span lang="EN-GB" style="color:#0563C1;text-decoration:none"><img border="0" width="191" height="43" style="width:1.9895in;height:.4479in" id="Picture_x0020_1" src="cid:image001.png@01D4AF26.14574A30" alt="signature_694283322"></span></a><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="X-NONE" style="font-family:"Gill Sans MT Pro Light",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="X-NONE" style="font-family:"Gill Sans MT Pro Light",sans-serif;color:black"> </span><span style="font-size:10.0pt;font-family:"Gill Sans MT Pro Light",sans-serif;color:black">Attorneys – Advocaten - Avocats</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">council <council-bounces@gnso.icann.org> on behalf of Erika Mann <erika@erikamann.com><br>
<b>Date: </b>Friday, 18 January 2019 at 09:55<br>
<b>To: </b>"council@gnso.icann.org" <council@gnso.icann.org><br>
<b>Subject: </b>[council] GDPR EPDP<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">All - Maybe helpful for your EPDP discussion’s. Keep in mind this document is released by the Belgian national DPA and not the European cross national board of DPAs. Nonetheless I assume that they will have discussed this with their colleagues
but I had no chance (yet) to check this.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Erika <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<h4 style="margin:0cm;margin-bottom:.0001pt;line-height:14.25pt"><a href="https://www.lexology.com/r.ashx?i=6685664&l=88SJB9G"><span style="text-decoration:none">Belgium's privacy watchdog publishes guidance on the notions of controller and processor</span></a><o:p></o:p></h4>
</div>
<div>
<p class="MsoNormal" style="line-height:14.25pt"><b>CMS Belgium<a href="http://www.cms-db.com/" target="_blank"><span style="text-decoration:none"><span style="color:black;border:solid #CCCCCC 1.0pt;padding:0cm"><img border="0" id="_x0000_i1025" src="https://d2dzik4ii1e1u6.cloudfront.net/images/lexology/firm/new/14b37190-7685-41b2-bb3a-88070ed497a9/W350/20150313110547.png" alt="CMS Belgium logo"></span></span></a><o:p></o:p></b></p>
</div>
<div>
<div style="margin-top:12.0pt;margin-bottom:12.0pt;box-sizing: border-box;float:left" id="article-attributes">
<p class="MsoNormal"><span class="article-jurisdictions"><b><a href="https://www.lexology.com/hub/belgium"><span style="text-decoration:none">Belgium</span></a> </b></span><span class="publication">January 17 2019</span><o:p></o:p></p>
</div>
<div id="lex-article-body">
<p style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:7.5pt;margin-left:0cm">
Recently, the Belgian Data Protection Authority (“<a href="https://www.dataprotectionauthority.be/" target="_blank"><span style="text-decoration:none">DPA</span></a>”) published guidance on controller and processor concepts (see original documents in <a href="https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Notions_RT_ST.pdf" target="_blank"><span style="text-decoration:none">French</span></a> and
in <a href="https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/Begrippen_VW_OA.pdf" target="_blank"><span style="text-decoration:none">Dutch</span></a>), refreshing the distinction between these two concepts and their implications.<o:p></o:p></p>
<p style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:7.5pt;margin-left:0cm;box-sizing: border-box">
In view of recent questions about the qualification and concrete application of the concepts of controller and processor, the DPA has decided to recap the principles and definitions applicable to these concepts.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="AppleMailSignature">
<p class="MsoNormal">Sent from my iPhone<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>