Source: https://www.dsgvo-portal.de/fdpa_section_62.php
Timestamp: 2020-07-11 23:56:20
Document Index: 654374459

Matched Legal Cases: ['§ 62', '§ 1', '§ 1', '§ 3', '§ 3', '§ 4', '§ 5', '§ 5', '§ 6', '§ 7', '§ 8', '§ 8', '§ 9', '§ 10', '§ 11', '§ 12', '§ 13', '§ 14', '§ 15', '§ 16', '§ 17', '§ 17', '§ 18', '§ 19', '§ 20', '§ 20', '§ 21', '§ 22', '§ 22', '§ 23', '§ 24', '§ 25', '§ 26', '§ 27', '§ 28', '§ 29', '§ 30', '§ 31', '§ 32', '§ 32', '§ 33', '§ 34', '§ 35', '§ 36', '§ 37', '§ 38', '§ 38', '§ 39', '§ 40', '§ 40', '§ 41', '§ 41', '§ 42', '§ 43', '§ 44', '§ 44', '§ 45', '§ 45', '§ 46', '§ 47', '§ 48', '§ 48', '§ 49', '§ 50', '§ 51', '§ 52', '§ 53', '§ 54', '§ 55', '§ 55', '§ 56', '§ 57', '§ 58', '§ 59', '§ 60', '§ 61', '§ 62', '§ 62', '§ 63', '§ 64', '§ 65', '§ 66', '§ 67', '§ 68', '§ 69', '§ 70', '§ 71', '§ 72', '§ 73', '§ 74', '§ 75', '§ 76', '§ 77', '§ 78', '§ 78', '§ 79', '§ 80', '§ 81', '§ 82', '§ 82', '§ 83', '§ 83', '§ 84', '§ 85', '§ 86', 'art 3', '§ 62']

§ 62 FDPA: Processing carried out on behalf of a controller | Federal Data Protection Act
Chapter 1 (§ 1-2)Scope and definitions
§ 1Scope of the Act
Chapter 2 (§ 3-4)Legal basis for processing personal data
§ 3Processing of personal data by public bodies
§ 4Video surveillance of publicly accessible spaces
Chapter 3 (§ 5-7)Data protection officers of public bodies
§ 5Designation
§ 6Position
§ 7Tasks
Chapter 4 (§ 8-16)Federal Commissioner for Data Protection and Freedom of Information
§ 8Establishment
§ 9Competence
§ 10Independence
§ 11Appointment and term of office
§ 12Official relationship
§ 13Rights and obligations
§ 14Tasks
§ 15Activity reports
§ 16Powers
Chapter 5 (§ 17-19)Representation on the European Data Protection Board, single contact point, cooperation among the federal supervisory authorities and those of the Länder concerning European Union matters
§ 17Representation on the European Data Protection Board, single contact point
§ 18Procedures for cooperation among the federal and Länder supervisory authorities
§ 19Responsibilities
Chapter 6 (§ 20-21)Legal remedies
§ 20Judicial remedy
§ 21Application of the supervisory authority for a court decision if it believes that an adequacy decision by the European Commission violates the law
Chapter 1 (§ 22-31)Legal basis for processing personal data
Sub-chapter 1
§ 22Processing of special categories of personal data
§ 23Processing for other purposes by public bodies
§ 24Processing for other purposes by private bodies
§ 25Transfer of data by public bodies
Sub-Chapter 2
§ 26Data processing for employment-related purposes
§ 27Data processing for purposes of scientific or historical research and for statistical purposes
§ 28Data processing for archiving purposes in the public interest
§ 29Rights of the data subject and powers of the supervisory authorities in the case of secrecy obligations
§ 30Consumer loans
§ 31Protection of commercial transactions in the case of scoring and credit reports
Chapter 2 (§ 32-37)Rights of the data subject
§ 32Information to be provided where personal data are collected from the data subject
§ 33Information to be provided where personal data have not been obtained from the data subject
§ 34Right of access by the data subject
§ 35Right to erasure
§ 36Right to object
§ 37Automated individual decision-making, including profiling
Chapter 3 (§ 38-39)Obligations of controllers and processors
§ 38Data protection officers of private bodies
§ 39Accreditation
Chapter 4 (§ 40-40)Supervisory authorities for data processing by private bodies
§ 40Supervisory authorities of the Länder
Chapter 5 (§ 41-43)Penalties
§ 41Application of provisions concerning criminal proceedings and proceedings to impose administrative fines
§ 42Penal provisions
§ 43Provisions on administrative fines
Chapter 6 (§ 44-44)Legal remedies
§ 44Proceedings against a controller or processor
Chapter 1 (§ 45-47)Scope, definitions and general principles for processing personal data
§ 45Scope
§ 46Definitions
§ 47General principles for processing personal data
Chapter 2 (§ 48-54)Legal basis for processing personal data
§ 48Processing of special categories of personal data
§ 49Processing for other purposes
§ 50Processing for archiving, scientific and statistical purposes
§ 51Consent
§ 52Processing on instructions from the controller
§ 53Confidentiality
§ 54Automated individual decision
Chapter 3 (§ 55-61)Rights of the data subject
§ 55General information on data processing
§ 56Notification of data subjects
§ 57Right of access
§ 58Right to rectification and erasure and to restriction of processing
§ 59Modalities for exercising the rights of the data subject
§ 60Right to lodge a complaint with the Federal Commissioner
§ 61Legal remedies against decisions of the Federal Commissioner or if he or she fails to take action
Chapter 4 (§ 62-77)Obligations of controllers and processors
§ 62Processing carried out on behalf of a controller
§ 63Joint controllers
§ 64Requirements for the security of data processing
§ 65Notifying the Federal Commissioner of a personal data breach
§ 66Notifying data subjects affected by a personal data breach
§ 67Conducting a data protection impact assessment
§ 68Cooperation with the Federal Commissioner
§ 69Prior consultation of the Federal Commissioner
§ 70Records of processing activities
§ 71Data protection by design and by default
§ 72Distinction between different categories of data subjects
§ 73Distinction between facts and personal assessments
§ 74Procedures for data transfers
§ 75Rectification and erasure of personal data and restriction of processing
§ 76Logging
§ 77Confidential reporting of violations
Chapter 5 (§ 78-81)Transfers of data to third countries and to international organizations
§ 78General requirements
§ 79Data transfers with appropriate safeguards
§ 80Data transfers without appropriate safeguards
§ 81Other data transfers to recipients in third countries
Chapter 6 (§ 82-82)Cooperation among supervisory authorities
§ 82Mutual assistance
Chapter 7 (§ 83-84)Liability and penalties
§ 83Compensation
§ 84Penal provisions
§ 85Processing of personal data in the context of activities outside the scope of Regulation (EU) 2016/679 and Directive (EU) 2016/680
§ 86Processing of personal data for purposes of state awards and honours
FDPA Part 3 - Chapter 4 - § 62
Processing carried out on behalf of a controller
Where personal data are processed by other persons or bodies on behalf of a controller, the controller shall ensure compliance with the provisions of this Act and other data protection provisions. The data subject shall assert his or her rights to access, rectification, erasure, restriction of processing and the right to receive compensation against the controller.
A controller may use only processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the law and ensure the protection of the rights of the data subjects.
Processors shall not engage other processors without prior written authorization by the controller. If the controller has given the processor general authorization to engage other processors, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors. In this case, the controller may object to such changes.
Where a processor engages another processor, the former shall impose on the latter the same data protection obligations as set out in the contract between the controller and the processor as referred to in subsection 5 if these obligations are not already binding for the latter processor because of other legislation. Where that other processor fails to fulfil these obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.
Processing by a processor shall be governed by a contract or other legal instrument that is binding on the processor with regard to the controller and that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal instrument shall stipulate, in particular, that the processor
acts only on instructions from the controller; if the processor believes that an instruction is unlawful, the processor shall inform the controller without delay;
ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
assists the controller by any appropriate means to ensure compliance with the provisions on the data subject's rights;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of data processing services, and deletes existing copies unless law requires storage of the personal data;
makes available to the controller all information necessary, in particular the logs kept in accordance with Section 76, to demonstrate compliance with these obligations;
allows for and contributes to audits conducted by the controller or another auditor mandated by the controller;
complies with the conditions referred to in subsections 3 and 4 for engaging another processor;
takes all measures required pursuant to Section 64; and
assists the controller in ensuring compliance with the obligations pursuant to Sections 64 to 67 and 69 taking into account the nature of processing and the information available to the processor.
The contract referred to in subsection 5 shall be in writing or in an electronic form.
A processor that determines, in violation of this provision, the purposes and means of processing, shall be considered a controller in respect of that processing.