Recipient vs DataController

[henarmartinsantos]

Recipient in UC-12 to UC-16: ex:NonHealthcareProfessional

• The recipient is the same as the asignee (data controller) in the Request.
• Why is not the physician the recipient in the previous use cases? --> Because a Recipient is a third party that is not DataController

Recipient vs DataController:

• UC-12 to UC-16: nonHCP as Data Controller:

  • Policy:

    • Recipient: https://example.org/NonHealthcareProfessional

    Always even if nonHCP as DC?

  • Request:

    • Recipient: NOT STATED. -> Recipient is a third party that is not DataController
    • DataController: https://example.org/NonHealthcareProfessional

[henarmartinsantos]

• UC-17 to UC-21: no Data Controller:
  • Policy:
    • Recipient: https://example.org/NonHealthcareProfessional
  • Request:
    • Recipient: https://example.org/NonHealthcareProfessional
    • DataController: None or https://example.org/user21?
      - Should it be omitted? Should it only be stated if requesting to be DataController?

[henarmartinsantos]

Is the recipient only stated in the policy as constraint or does it also need to be stated as a constraint or as a permission in the request?

[henarmartinsantos]

@JelleCousyns comment:

The Data Controller is who is responsible if anything happens. This means that the Data Controller must be a legal entity.

It can be 2 entities, either as joined controllers or as independent controllers (UC-24 & UC-25). In these cases, it must be documented which entity is Data Controller in which case.