An organ­iz­a­tion hir­ing inde­pend­ent con­tract­ors must be aware of the pri­vacy law aspects of the col­lab­or­a­tion. The Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) provides for require­ments to be taken into account by an organ­iz­a­tion. What should be kept in mind from a pri­vacy law per­spect­ive when hir­ing inde­pend­ent con­tract­ors, from the start of the assign­ment rela­tion­ship until its end?

 

Enter­ing into an assign­ment rela­tion­ship with an inde­pend­ent con­tract­or

When per­son­al data is pro­cessed by the inde­pend­ent con­tract­or, the pri­vacy qual­i­fic­a­tion of the inde­pend­ent con­tract­or must be con­sidered. For instance, a data pro­cessing agree­ment may be required.

 

Three qual­i­fic­a­tions apply in an assign­ment rela­tion­ship with an inde­pend­ent con­tract­or:

1.Internal man­age­ment

Intern­al man­age­ment occurs when an inde­pend­ent con­tract­or is sub­ject to the organization’s author­ity or has a hier­arch­ic­al rela­tion­ship with the per­son respons­ible for the pro­cessing of per­son­al data. This is the case, for example, if an inde­pend­ent con­tract­or has been engaged by an organ­iz­a­tion to tem­por­ar­ily ful­fil the duties of one of the employ­ees (with the inde­pend­ent con­tract­or work­ing with­in the secure work­ing envir­on­ment). In that case, a data pro­cessing agree­ment is not required. How­ever, it is recom­men­ded to make (con­trac­tu­al) agree­ments with the inde­pend­ent con­tract­or about the pro­cessing of per­son­al data and its con­fid­en­ti­al­ity.

2. Con­trol­ler

An inde­pend­ent con­tract­or qual­i­fies as a con­trol­ler if the inde­pend­ent con­tract­or, wheth­er inde­pend­ently or in con­sulta­tion with the organ­iz­a­tion, determ­ines the pur­pose and essen­tial means for the pro­cessing. A con­trol­ler may be either an inde­pend­ent or a joint con­trol­ler. In the case of joint con­trol­ler­ship, the parties must agree on how to inter­pret the oblig­a­tions under the GDPR. This will be the case when the pur­pose and means of the pro­cessing is determ­ined by the organ­iz­a­tion and the inde­pend­ent con­tract­or in mutu­al con­sulta­tion, for example when a joint pro­ject is set up that requires the expert­ise of both the inde­pend­ent con­tract­or and the organ­iz­a­tion. The agree­ments made between joint con­trol­lers are often laid down in an agree­ment.

3. Pro­cessor

An inde­pend­ent con­tract­or qual­i­fies as a pro­cessor if the inde­pend­ent con­tract­or, with­in the frame­work of the assign­ment, pro­cesses per­son­al data for the bene­fit of the organ­iz­a­tion, without being under the organization’s dir­ect author­ity. This means that the inde­pend­ent con­tract­or is obliged to fol­low the organization’s instruc­tions for the pro­cessing of per­son­al data. An example of a pro­cessor is an inde­pend­ent con­tract­or who handles the payroll admin­is­tra­tion on behalf of an organ­iz­a­tion, where there is no rela­tion­ship of author­ity (and there­fore no intern­al man­age­ment). In this case, a data pro­cessing agree­ment with a pro­cessor is man­dat­ory.

 

The inde­pend­ent contractor’s onboard­ing

Under the GDPR, the organ­iz­a­tion is obliged to inform the engaged inde­pend­ent con­tract­or about the pro­cessing of per­son­al data. It is advis­able to include this pro­cessing of per­son­al data in the intern­al pri­vacy state­ment and the pri­vacy policy. In addi­tion, it is recom­men­ded to provide the inde­pend­ent con­tract­or with oth­er pri­vacy doc­u­ment­a­tion, such as a data breach pro­ced­ure, inform­a­tion secur­ity policy or GDPR train­ing.

 

End of the inde­pend­ent contractor’s assign­ment

The organization’s respons­ib­il­ity does not end when the assign­ment of the inde­pend­ent con­tract­or ends. Before an assign­ment rela­tion­ship comes to an end, it is import­ant to request an inde­pend­ent con­tract­or to delete the per­son­al data that the inde­pend­ent con­tract­or has pro­cessed on behalf of the organ­iz­a­tion (please note: this does not apply if the inde­pend­ent con­tract­or is a con­trol­ler). The inde­pend­ent con­tract­or must also be giv­en instruc­tions on how to handle busi­ness-sens­it­ive inform­a­tion after the assign­ment has ended.

 

Our pri­vacy experts will be happy to handle any ques­tions you may have on this sub­ject.

Want to know more about everything related to the top­ic of inde­pend­ent con­tract­ors? Click here!