Company X provides security services to Company Y and passes Company Y the data of security guards who will provide the services. Who is the controller of this data? Is there data entrustment or sharing involved?
ANSWER
When concluding agreements, parties often designate persons assigned to perform them. This data is processed by the other party to the agreement as an independent controller, so data sharing takes place.
With reference to the example, Company Y will be the independent controller of the personal data of security guards from Company X and should fulfil the information obligation towards them. It may fulfil this obligation by, when concluding the agreement with Company X, obligating Company X in the agreement to pass on the information obligation to persons designated to perform the agreement, which it attaches to the agreement. There is no data entrustment here, because Company Y pursues its own purposes by processing the security guards' data. Data sharing takes place; Company Y is the independent controller.
