Is Anyone Really A Processor In The Age Of AI? Responsibility And Risk Under Data Protection Law

Summary

1. In this article it is argued that the distinction between controllers and processors is problematic, particularly in the complex processing environment created by new technologies.  The trend is towards regulators and the courts finding that parties are controllers rather than processors in order to ensure protection of individuals.
2. Organisations which fail to carefully consider whether they are a controller or a processor may be taking on legal risk and the potential for reputational damage.   
3. Completing meticulous and realistic analysis and accepting controller responsibilities where appropriate may bring significant advantages.  Organisations accepting controller responsibilities can use the processes and tools set out in data protection law to demonstrate that their technologies operate in ways that protect individuals’ fundamental rights (but also constitute, where appropriate, a proportionate interference in those rights).  This can bring commercial advantages,