The Spanish authority has published a decision clarifying the qualification of controller and processor in the context of publicly funded training.

Facts and context

The Spanish Data Protection Authority (AEPD) has today published a decision against the State Public Employment Service (SEPE) for a breach related to the absence of a subcontracting agreement.

The case originated from a complaint filed on 19 October 2023 concerning the collection of data for registration to a course subsidized by SEPE and provided by a training organization, ***EMPRESA.1.

Reasons for the decision

• Obligation to formalize the relationship with a processor (Article 28 of the GDPR): The authority analyzed the relationship between SEPE, which grants subsidies for training actions, and the beneficiary entity (***EMPRESA.1), which provides these trainings. SEPE argued that the beneficiary entity acted as an independent controller, as it selected participants and managed registrations independently. However, the authority considered that SEPE determined the purposes and essential means of the processing. Indeed, the call resolution of 4 July 2022 and its second additional provision explicitly designate SEPE as the controller for the management, financing, control, and evaluation of training programs, and specify that data subjects may exercise their rights with it. Based on the European Data Protection Board (EDPB) guidelines 07/2020, the authority recalled that the qualification of controller arises from decisive influence over the purposes and means, even without direct access to the data. Consequently, ***EMPRESA.1 acted on behalf of SEPE and should be qualified as a processor. The absence of a contract or legal act formalizing this relationship, as required by Article 28(3) of the GDPR, constitutes a violation attributable to SEPE.

Authority's decision

Consequently, the authority found a violation of Article 28 of the GDPR by SEPE.

Furthermore, the authority ordered SEPE to formalize, within six months, a contract or other legal act compliant with Article 28(3) of the GDPR with the training organizations benefiting from its subsidies. Failure to comply with this injunction could lead to the initiation of a new sanction procedure.

Lessons learned

This decision reminds that:

• Within a subsidy scheme, the public body that defines the purposes (management, program control) and the essential means of processing (categories of data, eligible participants) is qualified as the controller, even if the collection is carried out by the subsidized entity.
• The qualification of controller arises from decisive influence over the purposes and means, according to EDPB guidelines 07/2020, regardless of the actual access to data by that body.
• An entity acting on behalf of a controller within a framework defined by the latter must be considered a processor, which requires concluding a contract compliant with Article 28 of the GDPR to govern the relationship.