GDPR and SCC roles
The table is tailored under the assumption that myDRE is being used from anDREa BV and was created by Barbara Archbold (Legal Council UMC Utrecht). For more information regarding Standard Contractual Clauses (SCC). Disclaimer, always consult your own DPO and Legal.
SCC for anDREa BV applies when anDREa BV actively participates. If members of a workspace use the services provided by anDREa to perform the action, it is the person with the role Accountable for that particular Workspace that is subject to SCC rules and regulations; this is the responsibility of the institute to which the Workspace belongs.
| Party | GDPR | SCC | Licence myDRE | |
|---|---|---|---|---|
| A.1 | anDREa BV | Processor of licence holder (Institute) of myDRE | If transfer outside EEA by anDREa = anDREa is data exporter – anDREa needs to sign SCCs (module 3 or 4) (in agreed in DPA) ** | Protinus licences to Institute and purchase licences from anDREa |
| A.2 | anDREa BV | Controller for User/Tenant information (processing for anDREa’s own purpose) | If transfer outside EEA by anDREa = anDREa is data exporter – anDREa needs to sign SCCs (module 1 or 2) ** | n/a |
| B | anDREa BV’ processors (i.e. Google, Zoho, Microsoft) | Sub processor of Institute | If transfer outside EEA by anDREa to sub processor of anDREa: anDREa needs to sign SCCs (module 3) (agreed in DPA) | n/a |
| C | Institute | Controller | If Institute is the data exporter (including when Institute gives access to myDRE from outside the EEA) Institute needs to sign SCC’s with data importer (module 1 or 2) | Protinus licences to Institute and purchase licences from anDREa |
| D | Research / collaboration partners of Institute who get access to myDRE through Institute | Controller, or joint controller in case the GDPR defines them as joint controllers. | If these parties transfer data outside the EEA; they are data exporters. They need to sign SCC’s with the receiver/data importer. If they access from outside the EEA = they are a data importer and need to sign SCC’s with the data exporter. That is Institute, not anDREa BV as processor of Institute. | Falls under licence of Institute as long as Institute is controller for myDRE and accountable and responsible for their performance of the study/action/workpackage where the data management of myDRE is a part of Institute’s responsibility. |
| E | Subcontractor/third party/data provider of Institute who get access to myDRE through Institute for the purpose of performing their part of the action | Controller, or joint controller in case the GDPR define them as joint controllers (in some cases/countries the applicable privacy laws define them as processor for the part of performing services for Institute) | If these parties transfer data outside the EEA; they are data exporters. They need to sign SCC’s with the receiver/data importer. If they access from outside the EEA = they are a data importer and need to sign SCC’s with the data exporter. That is Institute, not anDREa BV as processor of Institute. | Falls under licence of Institute as long as Institute is controller for myDRE and accountable and responsible for their performance of the study/action/work package where the data management of myDRE is a part of Institute’s responsibility. |
| F.1 | Subcontractor/third party/data provider within the project but subcontracted by research of collaboration partner of Institute, however Institute give access to myDRE as part of Institute’s action | controller, or joint controller in case the GDPR defines them as joint controllers (in some cases/countries the applicable privacy laws define them as processor for the part of performing services for Institute. | If these parties transfer data outside the EEA; they are data exporters. They need to sign SCC’s with the receiver/data importer. If they access from outside the EEA = they are a data importer and need to sign SCC’s with the data exporter. That is Institute, not anDREa BV as processor of Institute. : | Falls under licence of Institute as long as Institute is controller for myDRE and accountable and responsible for their performance of the study/action/work package where the data management of myDRE is a part of Institute’s responsibility. |
| F.2 | Subcontractor/third party/data provider within the project but subcontracted by research of collaboration partner of Institute, however Institute give access to myDRE as processor | Institute= Processor Other parties, controllers or joint controller anDREa = processor | If these parties transfer data outside the EEA; they are data exporters. They need to sign SCC’s with the receiver/data importer. If they access from outside the EEA = they are a data importer and need to sign SCC’s with the data exporter. All depending on the actual processing. As Institute cannot be a party, this is superfluous this schedule | If Institute only processes on behalf of other parties and is a processor a meant under GDPR: this is out of scope of the licence of Institute = the research of collaboration partners (or even the subcontractors) need to purchase their own licence from Protinus or anDREa. |
- MODULE ONE: Transfer controller to controller
- MODULE TWO: Transfer controller to processor
- MODULE THREE: Transfer processor to processor
- MODULE FOUR: Transfer processor to controller