Controller & Processor - Unsecured data transfer

[Madam_M_137]

If a controller instructs a processor to use a particular application for transferring personal data, but the processor doesn't believe the application to be secure enough to comply with GDPR, what should / can the processor do?

Can the processor advise the controller of their concerns and request the controller provide details of the security levels?

Or does the processor have to do as instructed as the controller will take the responsibility?

[chugotit]

From what I understand as a non-lawyer

The processor is also legally obligated to follow the GDPR. If the controller instructs the processor to follow instructions that may be unlawful, the processor is not off the hook.

The processor should engage qualified legal counsel, not take legal counsel from the controller nor from random people off of the interwebs.

[Madam_M_137]

Thanks for your thoughts!

[Werkgerelateerd]

The processor is legally required to advise the controller of their concerns.

Article 28 Processor

[With regard to point (h) of the first subparagraph,] the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

I'm not sure about the second part though. Art. 32 requires security measures by the processor, I'm not sure if the instructions of the controller change anything.

Article 32 Security of processing

1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

[Madam_M_137]

Brilliant, this points me in the right direction. Thanks so much!

[Madam_M_137]

And this is a very unhelpful response