The French CNIL’s new guidelines on cloud computing revisit the tricky question of whether a cloud provider is a data processor or a data controller. The CNIL says that a cloud provider will generally be considered the data processor, but that the provider will become joint controllerwith the customer if the cloud customer lacks any real autonomy in the negotiation of the contract and in defining how the data are processed.
If the cloud customer is not able to give instructions to the cloud provider and must accept the cloud provider’s proposal “as is,” the CNIL will consider the cloud provider as joint controller, jointly liable with the customer for compliance with French data privacy laws.
Read more
