Notes

• [1]
  Art. 29 Data Protection Working Party, Opinion 1/2010 on the concepts of “controller” and “processor” (WP 169) adopted on 16 February 2010.
• [2]
  The full version of the feedback of the EBF is available at : https://edpb.europa.eu/sites/edpb/files/webform/public_consultation_reply/ebf_042951_ebf_response_edpb_ guidelines_on_controllerprocessor_191020.pdf.
• [3]
  CJEU, Wirtschaftsakademie, 5 June 2018, C-210/16, LexNow Référence/ID 27275.
• [4]
  CJEU, Fashion ID, 29 July 2019, C-40/17, LexNow Référence/ID 28639.
• [5]
  Art. 4 (8) Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
• [6]
  EDPB Guidelines 07/2020, 24, § 71.
• [7]
  Ibid., § 74.
• [8]
  Ibid., § 76.
• [9]
  EBF response to the European Data Protection Board’s consultation on the Guidelines 7/2020 on the concepts of controller and processor in the GDPR (EBF’s Response), 19 October 2020, EBF_042951, 7.
• [10]
  EDPB Guidelines 07/2020, 24-25, § 78.
• [11]
  EBF’s Response, 19 October 2020, EBF_042951, 7.
• [12]
  CSSF Circular 17/654 as amended by CSSF Circular 19/714, § 31.b.
• [13]
  European Commission, Proposal for a Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector and amending Regulations (EC) no. 1060/2009, (EU) no. 600/2014 and (EU) no. 909/2014, published 24 September 2020, COM(2020) 595 final (DORA Proposal).
• [14]
  Art. 25 (6) DORA Proposal.
• [15]
  Art. 27 DORA Proposal.
• [16]
  CSSF Circular 17/654 as amended by CSSF Circular 19/714, § 24.a; EBA Guidelines on outsourcing arrangements, §35; DORA Proposal, art. 25 (1).
• [17]
  EBF’s Response, 19 October 2020, EBF_042951, 7.
• [18]
  EBF’s Response, 19 October 2020, EBF_042951, 8.
• [19]
  Ibid.
• [20]
  Ibid.
• [21]
  EDPB Guidelines 07/2020, 32, § 107.
• [22]
  EBF’s Response, 19 October 2020, EBF_042951, 9.
• [23]
  Ibid.
• [24]
  Ibid.
• [25]
  EBF’s Response, 19 October 2020, EBF_042951, 10.
• [26]
  A question that is also raised by P. Craddock, NautaDutilh SRL, in his feedback to the EDPB Guidelines.
• [27]
  EDPB Guidelines 07/2020, 39, § 151.
• [28]
  EBF’s Response, 19 October 2020, EBF_042951, 10.
• [29]
  Ibid., 2.
• [30]
  EBF’s Response, 19 October 2020, EBF_042951, 2.
• [31]
  European Commission, draft Annex to the Commission Implementation Decision, on standard contractual clauses between controllers and processors under Article 28 (7) GDPR and Article 29 (7) of Regulation (EU) 2018/1725, available at https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12740-Data-protection-standard-contractual-clauses-betweencontrollers-processors-located-in-the-EU-implementing-act-.
• [32]
  EBF’s Response, 19 October 2020, EBF_042951, 2.
• [33]
  The implementation rules in the EBA Guidelines on outsourcing arrangements (§13-15) foresee application as of 30 September 2019 to all outsourcing arrangements entered into, reviewed or amended on or after this date. The deadline to review and amend existing outsourcing arrangements with a view to ensuring that these are compliant with the guidelines is set on 31 December 2021. Even if that deadline cannot be met, the companies can inform the competent authority of that fact, including measures planned to complete the review or the possible exit strategy.
• [34]
  Art. 36 Dora Proposal.
• [35]
  EDPB Guidelines, p. 16, § 42.
• [36]
  European Commission, Proposal for a Regulation of the European Parliament and of the Council on European data governance (Data Governance Act), COM(2020) 767 final, published on 25 November 2020.
• [37]
  The question of a potentially too broad interpretation of the CJEU case law is also raised by the Luxembourg National GDPR Working Group for Research in its feedback dd. 19.10.2020 to the EDPB Guidelines.
• [38]
  EDPB Guidelines 07/2020, 18, § 52-53.
• [39]
  Ibid., 19, § 58.
• [40]
  Ibid., 20, § 63.
• [41]
  Ibid., 20, § 69-70.
• [42]
  A question that is also raised by KU Leuven Research & Development in its feedback dd. 19.10.2020 to the EDPB Guidelines.
• [43]
  It is expected that the EDPB will publish a version adopted after public consultation.