CenturyLink offers several products, many of which are customizable, to customers in more than 60 countries, so we do not maintain universal summaries or diagrams of data flows. Customers can gain an infrastructure-level view of how and where the data flows from the relevant product documentation and each customer’s specific network or solution design. 

CenturyLink’s enterprise services rarely, if ever, require direct contact between CenturyLink and individual data subjects protected by the GDPR. If we process any personal data, it will be either on instructions from a customer (the “controller” as defined by GDPR) or when CenturyLink acts as the controller in accordance with the legal grounds defined in Section 6 of GDPR.

CenturyLink has undertaken a review of our products to assess their potential for processing personal data. In addition, we are committed to regularly reviewing our products for this purpose. In most cases, CenturyLink does not have access to personal data, including information that is transmitted, stored, hosted or processed through a customer’s use of our products’ functions. However, whenever necessary and consistent with the nature of our services, we will assist our customers in meeting their obligations under the GDPR.

What are CenturyLink’s procedures for providing notice of data breaches?

CenturyLink will provide notifications of breaches to all of our customers likely affected by a breach in accordance with legal requirements and as agreed with our customers. When a breach is suspected, CenturyLink takes the following steps:

1. Determine if a breach occurred
2. Research and identify products the breach may affect
3. Identify and notify our customers potentially affected by the breach

CenturyLink’s level of access to information affected by a breach, including the specific data and data subjects, varies from product to product. As a result, the amount of information in breach notifications will vary accordingly.

Whether or how much personal data CenturyLink can return or destroy depends on the functionalities of the product processing the data. For instance, we do not access, host, store or process the content of messages or other information traveling in our network, so we cannot return copies of such data.

However, when the data involves services where CenturyLink operates as a processor, such as information storage and hosting products, we will grant customers access to the data for retrieval or destruction. In most of these cases, we do not have access to information but will help customers as appropriate to address their GDPR obligations relating to retention, destruction and retrieval of data processed by CenturyLink products. Typically, customers will have full control of these activities through the tools and functionalities available with the products.

Depending on the specific CenturyLink product and customer arrangement, CenturyLink acts as controller, processer or both. As such, we will make the necessary contractual arrangements to comply with GDPR. We will address general GDPR obligations at the master agreement level. In specific cases of personal data processing by our services, we will address contractual language as appropriate.

It is the customer’s responsibility, through the use of object delivery controls, to ensure that any personal data related to individual end-users that access the customer’s content through the CenturyLink CDN is not cached on the CenturyLink CDN.  CenturyLink CDN customers can leverage a variety of self-service and security options available through the platform. Customers have the ability to manage their video delivery, object delivery and origin storage services through the secured and authorized use of the customer Media Portal. Customers may also use the Media Portal for the following:

• Reporting
• Analytics
• Access invoices
• Provision new services
• Optimize content publication
• Manage account permissions
• APIs
• Modify service attributes and parameters