France’s data protection authority, the Commission nationale de l’informatique et des libertés, issued guidance detailing the importance of identifying if an organization is a controller, joint controller or processor. The CNIL said organizations should “determine the role of the actors involved in the processing of personal data, following a concrete analysis of the methods of creation and implementation of the processing,” and inform data subjects who is processing their data to ensure the organization is compliant with the EU General Data Protection Regulation.
Full story