A company’s public privacy notice names its cloud processor as if that vendor were the controller deciding purposes and means. What identification error must be fixed?
Select an answer to reveal the explanation.
Short Explanation
The controller is the one steering the ship—setting purposes and means—not the dockworker hosting the cargo. Putting the processor’s name in the controller slot confuses everyone about who is accountable. Fix the notice so the real controller (and any joint-controller essentials) is clearly named.
Full Explanation
The privacy notice must identify the controller—the organisation that determines purposes and means—and, where applicable, joint-controller arrangement essentials under Article 26. Naming a cloud processor as if it were the controller misleads individuals about who answers for the processing and where to send rights requests. Civic bodies and companies that outsource hosting must keep accountability identity accurate even when infrastructure brands are more famous than the controller.
Hosting infrastructure does not automatically make processors joint controllers. Organisational controller identity is not optional merely because a DPO is named. Omitting controller identity to reduce social-engineering risk conflicts with mandatory transparency; use appropriate contact design instead of anonymity.
Exam caveat: processor vs controller is a factual allocation of purpose/means decisions, not a contract label alone. Joint-controller summaries should explain who collects what and how to exercise rights.
Operational check: replace processor-as-controller wording with the true controller legal name and contact routes, list processors as recipients/processors where appropriate, and align website footer, contracts, and RoPA identity fields.