Policingprivacy.eu – EDRi's comments on the proposed Data Protection Directive for Law Enforcement

(a) act only on instructions from the controller, in particular, where the transfer of the personal data used is prohibited;
(b) employ only staff who are under a statutory obligation of confidentiality;
(c) take all required measures to comply with the provisions adopted pursuant to Article 27;
(d) enlist another processor only with the prior permission of the controller;
(e) insofar as this is possible given the nature of the processing, create in agreement with the controller the necessary technical and organisational requirements for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III;
(f) assist the controller in ensuring compliance with the provisions adopted pursuant to Articles 27 to 29;
(g) hand over all results to the controller after the end of the processing and not process the personal data otherwise;
(h) make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this Article.
(i) take into account the principle of data protection by design.

2a. The controller and the processor shall document in writing the controller’s instructions and the the processor’s obligation referred to in paragraph 2.

3. If a processor processes personal data other than as instructed by the controller, the processor shall be considered to be a controller in respect of that processing and shall be subject to the rules on joint controllers laid down in Article 20.