DPA case 0612-23/2019/19 – Order (Slovenia, 2022)

The Slovenian DPA initiated an ex oficio investigation of a cloud computing provider. The company acted as an intermediary between clients generating data queries and various different data sources supplying the data itself. It claimed that the clients requesting data were the controllers and that it was merely processing the data on behalf of those clients/controllers. Through its investigation, the Slovenian DPA determined that the basic idea underlying the controller's cloud computing business model was handling of complex technical specifics so as to simplify the technical aspects for its clients, allowing them focus entirely on the content of the data requested. The cloud computing clients, in view of this arrangement, had little to no influence on the technical and organizational measures employed by the cloud computing provider in the handling of data. The DPA emphasised that an entity's status as controller or processor must be a factual determination, not merely a formal designation; if the designated "processor" in fact has some say in the essential purposes and means of processing, it is actually a controller. Article 24 GDPR and Article 5(2) GDPR establish the principle of responsibility, which means that the controller is responsible for compliance with the GDPR. A corollary of this principle is that if an arrangement between two entities makes both responsible for compliance with data protection regulations, both are controllers. In this case, because the cloud computing provider's clients had no power to ensure technical compliance with the GDPR, the cloud computing provider was acting as controller insofar as it determined the technical processes by which data was requested, handled, and transmitted as well as what sub-processors were engaged. As the cloud computing provider and its clients both made determinations of the purposes and means of processing, their arrangement was one of joint controllership. The DPA held that (i) the cloud computi