Recital 42

As a matter of principle, a European Production Order should be addressed to the service provider, acting as controller. However, in some circumstances, determining whether a service provider has the role of controller or processor can prove particularly challenging, in particular where several service providers are involved in the processing of data or where service providers process the data on behalf of a natural person. Distinguishing between the roles of controller and processor with regard to a particular set of data requires not only specialised knowledge of the legal context, but could also require interpretation of often very complex contractual frameworks providing in a specific case for allocation to various service providers of different tasks and roles with regard to a particular set of data. Where service providers process data on behalf of a natural person, it may be difficult in some cases to determine who the controller is, even where there is only one service provider involved. Where the data concerned are stored or otherwise processed by a service provider and there is no clarity as to who the controller is, despite reasonable efforts on the part of the issuing authority, it should therefore be possible to address a European Production Order directly to that service provider. Moreover, in some cases, addressing the controller could be detrimental to the investigation in the case concerned, for example because the controller is a suspect or an accused or convicted person or there are indications that the controller could be acting in the interest of the person that is the subject of the investigation. Also in those cases, it should be possible to address a European Production Order directly to the service provider processing the data on behalf of the controller. That should not affect the right of the issuing authority to order the service provider to preserve the data.