12 4 Annex 3, Clause Will Skatteministeriet accept The Ministry of Taxation can 2017 3.1, fourth to modify the clause to the accept the alternative wording paragraph following in to specify presented by the bidder and will that the purpose limitation the fourth paragraph of relates to the controller’s Clause 3.1 of Annex 3 instructions? accordingly. Processor may not “The process personal data for any other purposes than instructed unless the Processor is obliged to do so under EU law or the law of a Member State. If so, the Processor shall notify the Controller of such legal obligation before commencing the processing.” 13 4 April Annex 3, Clause In a cloud The Ministry of Taxation 2017 5, fourth and environment, data center acknowledges the concerns of the fifth paragraph visits entail operational and bidder in this respect. security challenges that the cloud vendor needs to The EU General Data minimize in the interest of Protection Regulation, art. 28.3 all customers. If a cloud (h), stipulates, that the processing vendor allowed all customers by processor be governed by a rights for on-site audits it contract, which shall stipulate, in would be unmanageable and particular, that the processor shall would compromise the make available to the controller security, integrity and all information necessary to confidentiality of the (other) demonstrate compliance with the customers. obligations laid down in GDPR Would Skatteministeriet, on art. 28 and allow for and that basis, accept to change contribute to audits, including the first paragraph of clause inspections, conducted by the 9 to the following: controller or another auditor the Controller’s mandated by the controller. In “Upon written request, the this way, the Ministry of Processor will provide the Taxation is obligated by law to Controller with the most reserve the right to perform audits. recent certifications and/or summary audit report(s)
12 4 2017 Annex 3, Clause 3.1, fourth paragraph Will Skatteministeriet accept to modify the clause to the following in to specify that the purpose limitation relates to the controller’s instructions? “The Processor may not process personal data for any other purposes than instructed unless the Processor is obliged to do so under EU law or the law of a Member State. If so, the Processor shall notify the Controller of such legal obligation before commencing the processing.” The Ministry of Taxation can accept the alternative wording presented by the bidder and will the fourth paragraph of Clause 3.1 of Annex 3 accordingly. 13 4 April 2017 Annex 3, Clause 5, fourth and fifth paragraph In a cloud environment, data center visits entail operational and security challenges that the cloud vendor needs to minimize in the interest of all customers. If a cloud vendor allowed all customers rights for on-site audits it would be unmanageable and would compromise the security, integrity and confidentiality of the (other) customers. Would Skatteministeriet, on that basis, accept to change the first paragraph of clause 9 to the following: “Upon the Controller’s written request, the Processor will provide the Controller with the most recent certifications and/or summary audit report(s) The Ministry of Taxation acknowledges the concerns of the bidder in this respect. The EU General Data Protection Regulation, art. 28.3 (h), stipulates, that the processing by processor be governed by a contract, which shall stipulate, in particular, that the processor shall make available to the controller all information necessary to demonstrate compliance with the obligations laid down in GDPR art. 28 and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. In this way, the Ministry of Taxation is obligated by law to reserve the right to perform audits.
Questions-and-Answers-DOK186715242-per-7-april.docx