Selgitustaotlus

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST José Miguel Campos Yours: 18.09.2023 nr [email protected] Ours: 16.10.2023 nr 2.1.-5/23/2368-2 Answer to request The Estonian Data Protection Inspectorate has received Your Letter. Under Article 4(7) of the General Data Protection Regulation (GDPR), a data controller is defined as ‘the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data’. The data processor on the other hand is known under Art. 4(8) GDPR as the natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.” In such a processing situation, where the data processing in question concerns the business client providing the bank with the personal financial data of their business and their own client in order to verify their identity, the banks are data controllers. This is because the banks determine the purposes (i.e., the provision of a bank transfer service for its clients) and the means of processing, as the transfer of personal and financial data is conducted through their online systems. Both the business and the natural persons are merely considered to be clients who use the banks services. A data processing agreement would be necessary only in the case that the bank contracts a third party to process client data on their behalf. For example, if the bank contracts a third-party web hosting service to provide software for their website, this third party would be a processor and a data processing agreement would be necessary under article 28 GDPR. Client-bank relationships in general do not require a data processing agreement. I hope this message has provided clarity on your inquiry. Best regards Aari Helmelaid Legal Assistant authorized by Director General Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee Registrikood 70004235