Under the GDPR, your payroll processor starts using clients' pooled employee salary data to sell a pay benchmark; what does that make it, and what follows?

## The scenario A company uses a payroll provider to compute its employees' salaries. The provider is its **processor** under the GDPR: it processes employee data **on behalf of** the company (`Art. 4(8)`) under a contract required by `Art. 28(3)`. The provider then aggregates salary data across all its clients and sells a pay-benchmarking product. No client asked for this. ## Step 1: whose purpose is this? The test for roles is who determines the **purposes and means** of processing (`Art. 4(7)`). Computing payroll is the client's purpose. Building and selling a benchmark is the **provider's own purpose**: it chose to do it, for its own revenue, with data it holds only because clients entrusted it with them. The processor's duties point the same way: - `Art. 28(3)(a)`: the contract must require the processor to process personal data **only on documented instructions** from the controller. - `Art. 29`: the processor and anyone under its authority *shall not process those data except on instructions from the controller*, unless Union or Member State law requires it. Pooling client data for a new product is processing outside those instructions. ## Step 2: what Art. 28(10) does `Art. 28(10)` reads: *Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.* Three things follow from that sentence: 1. **Scope is per processing.** The provider becomes a controller *in respect of that processing*, the benchmark. For the payroll service it is still the client's processor. 2. **The recast does not cure anything.** "Without prejudice to" Arts. 82 (compensation), 83 (administrative fines) and 84 (penalties) means the infringement remains an infringement. 3. **Controller duties now attach.** For the benchmark, the provider must satisfy what the Regulation asks of a controller: the `Art. 5` principles, a lawful basis of its own, information to the employees whose data it uses, data-subject rights, records under `Art. 30(1)` and security. It collected nothing directly from those employees and never told them about this use. ## Step 3: liability `Art. 82(2)` splits liability for damage: | Party | Liable for damage caused by infringing processing when... | |---|---| | **Controller** | it is *involved in* the processing | | **Processor** | it breached obligations *specifically directed to processors*, or acted *outside or contrary to lawful instructions* of the controller | The provider acted outside its instructions, so it is squarely within `Art. 82(2)` as a processor, and as a controller for the benchmark it carries controller liability for that processing. `Art. 82(3)` lets a party escape only by proving it is *not in any way responsible* for the event. ## Step 4: what the client must do The client did not authorise the benchmark, but it is still the controller of its employees' payroll data and chose this processor. Its levers come from `Art. 28`: - **Re-examine sufficient guarantees.** `Art. 28(1)` allows only processors that provide sufficient guarantees. A processor that repurposes client data has shown otherwise. - **Use information and audit rights.** `Art. 28(3)(h)` requires the processor to make available all information necessary to demonstrate compliance and to allow audits and inspections. Ask what data were pooled, since when, and for whom. - **Enforce deletion or return where the relationship ends.** `Art. 28(3)(g)` gives the controller the choice. - **Consider its own obligations** towards its employees and any supervisory authority, which depend on what exactly happened; whether the misuse is also a notifiable personal data breach is a separate question. ## Step 5: the agreed variant Suppose instead the client **agrees** that the provider may reuse its employees' data for the benchmark. That is no longer an infringement under `Art. 28(10)`, but the roles still follow the facts: - The provider determines the benchmark's purpose, so it is a **controller** for that processing, alongside its processor role for payroll. - The client is **disclosing** employee data to another controller for a new purpose, which it must be able to justify on its own terms; an `Art. 28` contract cannot cover it, because the provider is not acting on the client's behalf. - If the client and provider genuinely **jointly determine** the benchmark's purposes and means, they would be **joint controllers** under `Art. 26`, with the arrangement that requires. ## Why interviewers ask this The question tests whether a candidate treats roles as facts rather than labels, knows that Art. 28(10) recasts without excusing, and can separate the processor's liability from the controller's own duties. Whether an aggregated benchmark output could itself be anonymous is a separate technique question; the pooling of identifiable salary records to build it is processing of personal data either way.