21. OUTLINE – This book is divided into five parts, whereby each part aims to answer one or more of the research sub-questions identified in the previous chapter. The following sections will briefly elaborate upon the main topics that are covered by each part, as well as their methodological approach. Further details regarding scope and methodology can be found in the introductory chapter of each part.

STATE OF THE ART

22. AIM – Part II of the book will analyse the nature and role of the controller and processor concepts under current EU data protection law. The aim is to obtain a better understanding of the meaning of the concepts, as well as the functions they fulfil within EU protection law. To this end, an analysis shall be made of the regulatory scheme of EU data protection law, with special attention to (a) the definitions of controller and processor; (b) the allocation of responsibility and liability; and (c) the additional functions fulfilled by the controller and processor concepts.

23. SCOPE – Even though the GDPR has repealed Directive 95/46, Part II still contains multiple references to the provisions of Directive 95/46. There are several reasons for doing so. First, the definitions of controller and processor contained in Directive 95/46 were incorporated by the GDPR without substantive modification. Second, most of the literature, guidance and case law interpreting the concepts of controller and processor has been developed in the context of Directive 95/46. Third, Directive 95/46 forms the backdrop against which the GDPR was developed. To properly understand the nature and role of the controller and processor concepts under the GDPR, it is necessary to understand the meaning and role of these concepts under Directive 95/46.

24. METHODOLOGY – Part II of the book will follow an internal approach. The primary sources of analysis shall be the text of the GDPR and of Directive 95/46, their preparatory works, the case law of the CJEU and the guidance issued by the Article 29 Working Party and European Data Protection Board. Where appropriate, reference shall also be made to the preparatory works of national implementations of Directive 95/46 (e.g. the Netherlands, Belgium), as a means to clarify and supplement the insights offered by the primary sources.