Controller and processor roles across a marketing stack with US and Indian data flows
Bloem & Co is a Dutch online garden retailer with 300,000 customers. It uses MailForge Inc., a US email vendor, to send newsletters and abandoned-cart emails. The contract lets MailForge decide how long it keeps message logs and permits it to use subcontractors without approval; a support subcontractor, SupportHub Pvt Ltd in Pune, India, answers customer tickets using the same data. MailForge is not certified under the EU-US Data Privacy Framework. Payments are handled by PayRiver, a Dutch bank that runs its own fraud-screening for its own purposes and shares fraud scores back to Bloem & Co. In April, MailForge received a US subpoena and disclosed 4,000 Dutch customer email addresses without telling Bloem & Co; the retailer learned about it from a customer. The marketing director says 'they must have signed standard clauses somewhere, so we are fine'.
1. Map the role of each party for each data flow and identify every contractual defect you can see.
Read the worked answer
Roles:
- Bloem & Co is controller for the marketing and cart-recovery processing, determining purposes and means.
- MailForge Inc. is a processor for that processing. It is not a controller merely because it sets a retention period: Article 28(3)(a) requires the processor to act only on documented instructions, and a processor that fixes retention for its own convenience is acting outside them. The contract clause letting it decide log retention is itself a defect and points towards MailForge becoming a controller for that part (Article 28(10)).
- SupportHub Pvt Ltd is a sub-processor. Article 28(2) requires prior specific or general written authorisation from the controller, with a right to object. A clause allowing subcontractors without approval is non-compliant.
- PayRiver is an independent controller for its own fraud-screening purposes, so the relationship is controller-to-controller. No Article 28 contract is needed, but the reciprocal data flows must be covered by transparency under Articles 13 and 14 and by a lawful basis for each side.
Contract defects under Article 28(3): no documented-instruction clause, no sub-processor approval, no confidentiality undertaking, no assistance with data subject rights or breach handling, no deletion-or-return term, no audit right, and no clause requiring the processor to notify the controller of legally binding requests unless prohibited by law. The April subpoena shows why that last clause matters: MailForge should have notified Bloem & Co unless a gag order applied, and it could not lawfully treat a subpoena as an instruction from its controller without checking.
2. What transfer mechanism is needed for the US and India flows, given MailForge is not DPF-certified?
Read the worked answer
Both flows are restricted transfers under Chapter V and need a mechanism plus an assessment.
United States (MailForge). The EU-US Data Privacy Framework is an Article 45 adequacy decision, but it only covers organisations that have self-certified and appear on the DPF list. MailForge is not certified, so adequacy is unavailable. The fallback is Article 46(2)(c) or (d): Standard Contractual Clauses, specifically the 2021 modular clauses, with the controller as data exporter and MailForge as data importer using Module Two (controller to processor).
India (SupportHub). There is no adequacy decision for India. The SCCs must be flowed down: the processor-to-sub-processor relationship uses Module Three, and because SupportHub receives data from an EU controller through MailForge, a separate set covering that link is the cleanest approach.
Transfer impact assessment. SCCs alone are not sufficient after Schrems II. The controller must assess the third country's law and practice, whether the importer can comply, and what supplementary measures are needed: encryption with keys held in the EU, pseudonymisation, minimisation of what crosses the border, and a documented escalation path for government requests. The April subpoena is direct evidence of the risk and must be addressed in the assessment.
Practical point. Saying 'standard clauses exist somewhere' is not enough. The clauses must actually be signed with the correct parties and modules, be consistent with the Article 28 terms, and be supported by a documented assessment that the controller can produce to the Dutch AP on request.
3. How should Bloem & Co respond to the subpoena disclosure, and what liability exposure exists?
Read the worked answer
Immediate response. Treat it as a personal data breach. The unauthorised disclosure of 4,000 email addresses is a confidentiality breach under Article 4(12). Bloem & Co became aware when the customer told it, so the Article 33 clock runs from that point, not from the subpoena date. Assess the risk: email addresses alone are low-risk, but combined with purchase history or the fact of being a customer, phishing risk may justify notifying the AP; the reasoning must be recorded in the Article 33(5) register either way.
Contractual and operational steps:
- Demand the full facts from MailForge: what was requested, what was disclosed, whether a gag order applied, what legal basis MailForge relied on.
- Suspend or restrict the data flow until the position is clear.
- Serve notice to cure the Article 28 defects or terminate.
- Issue instructions on government requests: notify the controller unless legally prohibited, challenge overbroad requests, disclose the minimum.
Liability. Under Article 82(1) any controller or processor that has suffered or caused damage is liable. A controller is liable for the whole damage caused by its processor's processing (Article 82(2)) and can then seek recourse from the processor. MailForge is liable only if it failed in its processor-specific obligations or acted outside lawful instructions - which is arguable here. Under Article 28(10), a processor that determines purposes and means is treated as a controller for that processing.
Exposure. Article 83(5) fines for unlawful transfers are up to EUR 20 million or 4% of worldwide turnover; Article 83(4) covers Article 28 breaches at up to EUR 10 million or 2%. Customer compensation claims under Article 82 are separate.