The legal question is, if service providers, who provide services not with the focus of data processing (like logistic services/fulfilment services) are considered as Processors (Art. 4 No. 8 GDPR) or Controllers (Art. 4 No. 7 GDPR). This question was neglected so far by legislator, authorities and courts so far.
The Bavarian Data Protection Authority writes about this topic as follows:
“The commissioning of professional services of a different kind, i.e., services in which data processing is not the primary focus or in which data processing does not constitute at least an important (core) component, does not constitute commissioned processing within the meaning of data protection law““ (Bayerisches Landesamt für Datenschutzaufsicht, FAQ zur DA-GVO, https://www.lda.bayern.de/media/FAQ_Abgrenzung_Auftragsverarbeitung.pdf).
The Bavarian Data Protection Authority states that service providers whose service is not focused on data processing are not considered as processors and provides a list of examples. The Authority considers Post services and parcel transport services not as acting as Processor (https://www.lda.bayern.de/media/FAQ_Abgrenzung_Auftragsverarbeitung.pdf).
The Data Protection Authority of Lower Saxony confirms this:
„According to the meaning and purpose of Art. 4 No. 8 in conjunction with Art. 28 (1) of the GDPR, commissioned processing can be negated in individual cases if the data processing is only carried out in connection with the provision of a (main) service for another party. According to Recital 81 to the GDPR, the controller must “intend” to entrust the processor with the processing of personal data. This can be denied in individual cases if the data processing is not specifically intended or does not represent the main focus or an important (core) component of the service of the contractor“ (FAQ zur Auftragsverarbeitung nach Artikel 28 der Verordnung (EU) 2019/679 (Die Landesbeaufttagte für den Datenschutz Niedersachsen, Datenschutz-Grundverordnung – DS-GVO) – Stand: Juni 2020).
If data processing is “support function” only for providing another service, the service provider is considered as Controller and not Processor (Local Court Mannheim (AG Mannheim, Judgement dated 11.9.2019 – 5 C 1733/19 WEG, recital 23; Schwartmann/Mühlenbek, in: Schwartmann/Jaspers/Thüsing/Kugelmann, 2. Edition, 2021, Art. 4 No. 7 recital 56 with reference on the Judgement of the Local Court Mannheim mentioned above).
-> If the personal data are provided to a company not for the purpose of processing, but only as a means for carrying out other services, then the company is not a Processor.
Specifically, difficult delineation issues may arise. We refer to the examples given by the Bavarian Data Protection Authority (https://www.lda.bayern.de/media/FAQ_Abgrenzung_Auftragsverarbeitung.pdf).
Stand: Sommer 2022
Dr. Jörg Brettschneider, Rechtsanwalt
