The European Data Protection Board (EDPB) has issued 2 new guidelines: on the concepts of "controller" and "processor" and on targeting of social media users. Both (English) guidelines are now open for feedback.
Since the General Data Protection Regulation (AVG) applies, there have been many questions about the terms "controller" and "processor" and to what extent they have been changed by the AVG. Especially when it comes to joint responsibility and the obligations for processors.
These guidelines explain the various concepts. The guidelines also address the main implications of these concepts for controllers, processors and joint controllers.
Targeting of social media users is a way to provide targeted advertising. It is part of the revenue model of many social media providers.
These guidelines focus on the roles and responsibilities of advertisers and providers. Among other things, the guidelines address privacy risks for social media users and key requirements of privacy legislation, such as the legal basis for processing.
Do you have any comments or suggestions to the Guidelines 07/2020 on the concepts of controller and processor in the GDPR and/or the Guidelines 08/2020 on the targeting of social media users? If so, you can submit them to the EDPB until October 19, 2020.
