ARE YOU A PIC OR A PIP?

PIC means Personal Information Controller.

A PIC has control over the processing of personal data.

A useful way to think about control is to ask:

• Who decides what information is collected?
• Who decides why it is being processed?
• Who decides how far the processing will go?

PIP means Personal Information Processor.

A PIP processes personal data for a PIC.

The important question is whether the party is carrying out the processing on the PIC's behalf and under its instructions, rather than deciding for itself why the data should be processed.

When trying to identify the roles, ask:

• Who decided to collect the data?
• Who decided why it was needed?
• Who determines what happens to it?
• Is another party simply processing it under those instructions?

The answers matter more than the labels in the agreement.

An online store collects customer information to process orders.

It engages a service provider to handle that information solely to perform a service for the store and according to the store's instructions.

That arrangement may involve the store acting as PIC and the service provider acting as PIP.

Suppose the service provider also decides to use the customer information for its own purposes.

That requires another look at the roles.

The parties are the same. The data may even be the same. But what each party is doing with the data has changed.

And so may the analysis.

The same organization can be processing personal data in different circumstances and for different purposes.

So asking whether a company is simply “a PIC or a PIP” can sometimes be the wrong question.

The better question is:

• What role is it playing in this processing?

First, understand what is happening to the data.

Then determine the roles.

Then make the contract reflect them.

The actual processing determines the role.

The role should determine the contract.

MC LEGAL