1. The controller is responsible for the processing of personal data
The party that determines for what purposes and how personal data is being processed in hobby activities is the controller. As a rule, the party responsible for the hobby activity is the controller of the personal data. It is the controller’s duty to ensure that the processing of personal data complies with the data protection legislation.
The definition of ‘controller’ is functional: the purpose of the definition is to allocate responsibility for compliance with data protection regulations to the party that can actually influence the processing. When a hobby organiser uses an external service provider for managing the personal data of participants, an ERP system provided by an IT service provider, or an accounting firm for drawing up its accounts, the hobby organiser is the controller of the personal data processed by these external service providers, because it decided how and for what purposes the personal data is processed. In such cases, the external service provider is the processor. Even though the processor is processing the hobby organiser’s personal data, as the controller, the hobby organiser remains responsible for the personal data.
