Should a processor agreement be concluded between a university/school and a user employer?

ANSWER

A controller is obliged to conclude a processor agreement when it entrusts personal data to another external entity for processing on its behalf. Disclosure of personal data means a situation in which the controller reveals or discloses personal data to another external entity for that entity to pursue its own processing purposes and by its own means. When a student internship agreement is concluded between a university (the controller of students' personal data) and a user employer, personal data will be disclosed, not entrusted.

In support of this view, once the user employer receives a student's personal data from the university, it will process them for its own processing purposes, such as records of entries and exits, records of internship time, or granting the student authorization to process personal data. Moreover, the user employer will also decide on the means of processing the personal data received.

The above supports treating the user employer as an independent controller, not a processor. This position has also been confirmed by the Polish Data Protection Authority (UODO), which can be read at the link: https://uodo.gov.pl/pl/225/1454.