Does issuing certificates confirming participation in training not constitute grounds for a data processing agreement?

ANSWER

For training that employers provide to their employees, an assessment must be carried out each time as to whether the training company is an independent data controller or a processor — depending on the factual situation, both options are possible.

Where the employer merely selects training offered by an external company and does not in any way influence its programme or manner of delivery, the company conducting the training will usually be an independent data controller. Employees often register for the training independently so that the employer's lack of involvement leaves no doubt and so that there is no need to conclude a data processing agreement. Issuing certificates in the case of such training will not constitute grounds for concluding a data processing agreement.

Where the employer has influence over the training and decides on its content and course, the training company is merely a processor. In such a situation, where among other things the employer passes data of employees participating in the training for the purpose of issuing certificates to them, a data processing agreement must be concluded.

Under the data processing agreement, the employer will be the controller and the training company the processor.