(Data Protection News & Services)
By decision C‑40/17 of July 29, 2019, Fashion ID vs. German Supervisory Authority, the European Court of Justice ruled that: – The operator of a website, such as Fashion ID, that embeds on its website a social plugin (i.e. Facebook
Under the General Data Protection Regulation (GDPR), any person (including organisations) handling personal data is subject to a different level of obligations and responsibilities with regard to the personal data processing operations they carry out depending on whether they are acting as a processor, a controller or a joint controller.
Indeed, all their GDPR obligations and responsibilities stem from their role and may, as a result, differ greatly. In broad words, controllers bear most responsibilities while processors must only act under the instructions of the controller and therefore, bear much less responsibility on its shoulders.