'A third party to whom data are disclosed': A third group among those processing data

Abstract

• The concepts of ‘data controller’ and ‘data processor’ in the Data Protection Directive are not exhaustive. The Directive defines them by excluding certain criteria (eg determining the means and purposes of the data processing, and carrying it out on behalf of the data controller). Thus, entities that do not fulfil such legal requirements when processing data are excluded from the scope of those concepts, and are considered as part of a third group of those who are processing data. • Moreover, Article 7 (f) of the Directive refers to ‘third parties to whom data are disclosed’ and provides descriptions that imply that this category is based on a different assumption to those relating to data controllers and data processors, and is applicable to anyone who carries out data processing as an essentially personal activity. • Articles 11, 12, and 14 of the Directive also establish a legal status that exempts these ‘third parties’ from some obligations that data controllers must fulfil. • This article analyses and endorses the existence of this third category and the legal issues and problems that arise when trying to subject anyone who processes data to the legal regime applicable to data controllers and processors.