in a transparent manner, determine their respective responsibilities for compliance with the obligations under this Directive, in particular as regards the exercise of the rights of the data subject and their respective duties to provide the information referred to in Article 10a, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement shall designate the point of contact for data subjects. Member States may designate which of the joint controllers can act as a single point of contact for data subjects to exercise their rights. 1a. Irrespective of the terms of the arrangement referred to in paragraph 1, Member States may provide that the data subject may exercise his or her rights under the provisions adopted pursuant to this Directive in respect of and against each of the controllers. Article 21 Processor 1. Member States shall provide that where a processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a way that the processing will meet the requirements of this Directive and ensure the protection of the rights of the data subject. 1a. Member States shall provide that the processor shall not enlist another processor without the prior specific or general written authorisation of the controller. In the latter case, the processor shall always inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the opportunity to the controller to object to such changes. 2. Member States shall provide that the carrying out of processing by a processor shall be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the obligations and rights of the controller and stipulating in particular that the processor shall:
in a transparent manner, determine their respective responsibilities for compliance with the obligations under this Directive, in particular as regards the exercise of the rights of the data subject and their respective duties to provide the information referred to in Article 10a, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement shall designate the point of contact for data subjects. Member States may designate which of the joint controllers can act as a single point of contact for data subjects to exercise their rights. 1a. Irrespective of the terms of the arrangement referred to in paragraph 1, Member States may provide that the data subject may exercise his or her rights under the provisions adopted pursuant to this Directive in respect of and against each of the controllers. Article 21 Processor 1. Member States shall provide that where a processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a way that the processing will meet the requirements of this Directive and ensure the protection of the rights of the data subject. 1a. Member States shall provide that the processor shall not enlist another processor without the prior specific or general written authorisation of the controller. In the latter case, the processor shall always inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the opportunity to the controller to object to such changes. 2. Member States shall provide that the carrying out of processing by a processor shall be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the obligations and rights of the controller and stipulating in particular that the processor shall:
4_consolidated_text_EN.docx