A contractor stores and processes photos submitted through the city's 311 app. Which mapping of data roles is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Owning the purpose of the photo program is different from running the hard drives. The city still decides why photos are collected and who may see them; the vendor just processes under those rules. Hosting location does not steal ownership—or dump accountability—onto the contractor alone.
Full Explanation
Data roles distinguish parties who determine purposes and means (controller/owner-class) from parties who process data on behalf of another (processor/custodian-class). Municipal programs typically retain controller accountability even when vendors host or process data. Contracts and technical controls must reflect that the city sets classification, retention, and access rules the vendor implements.