Article 26 GDPR: Difference between revisions

From GDPRhub
Line 242: Line 242:
The form of the agreement is not prescribed, and the parties are generally free to decide on it. However, this document defines their responsibilities, so in order to provide clarity and legal certainty between the parties seems reasonable.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), margin number 173 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> This form also facilitates the controller's task of demonstrating compliance with the GDPR (see [[Article 24 GDPR|Article 24]] GDPR). Of course the formal agreement should also reflect the ''actual'' distribution of responsibilities and obligations.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 55 (C.H. Beck 2024, 4th Edition).</ref> The agreement should be able to describe the "''respective responsibilities''" in a "''transparent manner''" meaning it should be written in clear and straightforward language. Additionally, to provide a better framework for the allocation of responsibilities between the parties, the arrangement should also includes general information about the joint processing. This should include specifying the relationship between the joint controllers; the function of each controller; and a description of the processing activity including the subject matter and purpose of the processing, the type of personal data involved, and the categories of data subjects.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 46 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]); ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).</ref>
The form of the agreement is not prescribed, and the parties are generally free to decide on it. However, this document defines their responsibilities, so in order to provide clarity and legal certainty between the parties seems reasonable.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), margin number 173 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> This form also facilitates the controller's task of demonstrating compliance with the GDPR (see [[Article 24 GDPR|Article 24]] GDPR). Of course the formal agreement should also reflect the ''actual'' distribution of responsibilities and obligations.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 55 (C.H. Beck 2024, 4th Edition).</ref> The agreement should be able to describe the "''respective responsibilities''" in a "''transparent manner''" meaning it should be written in clear and straightforward language. Additionally, to provide a better framework for the allocation of responsibilities between the parties, the arrangement should also includes general information about the joint processing. This should include specifying the relationship between the joint controllers; the function of each controller; and a description of the processing activity including the subject matter and purpose of the processing, the type of personal data involved, and the categories of data subjects.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 46 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]); ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).</ref>


The formal agreement between the controllers should, in particular, also include the distribution of responsibilities in connection with the rights of the data subjects and the respective obligations of the controllers. If on of the controllers act as a designated contact point for the data subject, that fact should also be reflected in the agreement.
The formal agreement between the controllers should, in particular, also include the distribution of responsibilities in connection with the rights of the data subjects and the respective obligations of the controllers. If on of the controllers act as a designated contact point for the data subject, that fact should also be reflected in the agreement.<ref>for an extensive list of issues that should be subject of the joint controller agreement see ''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24 GDPR, margin number 59 (C.H. Beck 2024, 4th Edition).</ref>


The agreement between the joint controllers can be combined with other agreements between the same parties. However, the transparency of the determination of the respective agreements must not be undermined by such a combination.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).</ref>  
The agreement between the joint controllers can be combined with other agreements between the same parties. However, the transparency of the determination of the respective agreements must not be undermined by such a combination.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).</ref>  
Line 249: Line 249:


==== Which may designate a contact point for the data subjects ====
==== Which may designate a contact point for the data subjects ====
Providing data subjects with a single point of contact for multiple joint controllers serves two important purposes. First, it enables data subjects to know whom to approach for any matters related to the processing of their personal data. Secondly, it allows the joint controllers to coordinate their interactions and communications with data subjects more efficiently. In order to facilitate the exercise of data subjects' rights as per the GDPR, the EDPB recommends that joint controllers designate a contact point for this purpose. This contact point can be the Data Protection Officer (DPO), if available, the representative in the Union (for joint controllers not established in the Union), or any other designated contact point where relevant information can be obtained.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>
While the implementation of a single contact point for data subjects is not mandatory, it can serve two important purposes. First, it enables data subjects to know whom to approach for any matters related to the processing of their personal data. Secondly, it allows the joint controllers to coordinate their interactions and communications with data subjects more efficiently. In order to facilitate the exercise of data subjects' rights as per the GDPR, the EDPB recommends that joint controllers designate a contact point for this purpose. This contact point can be the Data Protection Officer (DPO) of one of the joint controllers or the representative in the Union (for joint controllers not established in the Union), or any other designated contact point where relevant information can be obtained.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 182 et seqq. (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>


==== Unless Union or Member State law applies ====
==== Unless Union or Member State law applies ====
Line 258: Line 258:


==== Duly reflect respective roles and relationships vis-à-vis the data subject ====
==== Duly reflect respective roles and relationships vis-à-vis the data subject ====
Joint controllers must establish how and by whom the required information will be provided to data subjects and how and by whom responses to data subject requests will be handled. The organization of these obligations in the arrangement should accurately reflect the reality of the joint processing. For instance, if only one of the joint controllers is responsible for communicating with data subjects regarding the joint processing, that controller may be better positioned to inform data subjects and address their requests effectively.
Joint controllers must establish how and by whom the required information will be provided to data subjects and how and by whom responses to data subject requests will be handled. The organization of these obligations in the arrangement should accurately reflect the reality of the joint processing. For instance, if only one of the joint controllers is responsible for communicating with data subjects regarding the joint processing, that controller may be better positioned to inform data subjects and address their requests effectively.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 178 (available [https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref>


==== Essence of the arrangement ====
While the joint controllership agreement is binding between the controllers as parties to the agreement the data subject is not bound by the agreement; for them it is a tool to increase transparency.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 62 (C.H. Beck 2024, 4th Edition).</ref> 
The "''essence''" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. What should be covered by the notion of “essence of the arrangement” is not specified by the GDPR.<blockquote><u>EDPB</u>: The EDPB recommends that the essence cover at least all the elements of the information referred to in Articles [[Article 13 GDPR|13]] and [[Article 14 GDPR|14]] GDPR that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements. Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref></blockquote>The GDPR does not specify how the information regarding the joint arrangement should be made available to the data subject. Unlike other provisions such as [[Article 30 GDPR|Article 30(4) GDPR]] for the record of processing or [[Article 40 GDPR|Article 40(11) GDPR]]  for the register of approved codes of conduct, Article 26(2) GDPR does not explicitly require the information to be made available "upon request" or "publicly available by way of appropriate means". As a result, it is the responsibility of the joint controllers to determine the most effective approach for providing the essence of the arrangement to data subjects.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> In most cases, it will be appropriate to include the information of the essence of the agreement in the initial information to the data subject ([[Article 13 GDPR|Article 13]] or [[Article 14 GDPR|14 GDPR]]) and in any response to an access request in accordance with [[Article 15 GDPR]].<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 9 (C.H. Beck 2024, 4th Edition).</ref> Joint controllers should ensure that the information is consistently provided in a coherent manner.<blockquote><u>Example</u>: In order to comply with the the obligation to provide data subjects with the essence of the agreement between joint controllers they include this information alongside the information outlined in Article [[Article 13 GDPR|13]] or [[Article 14 GDPR|14]] GDPR, within their privacy policy, and upon request by a data subject to the designated data protection officer or contact point. </blockquote>
 
==== Essence of the arrangement shall be made available to the data subject ====
 
The "''essence''" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. What should be covered by the notion of “essence of the arrangement” is not specified by the GDPR.
 
The EDPB recommends that data subjects are provided with, at least, all the elements of the information referred to in Articles [[Article 13 GDPR|13]] and [[Article 14 GDPR|14]] GDPR, and for each of these elements, the data subjects should be made aware of the arrangement between the joint controller regarding the responsibility for ensuring compliance with the respective element. Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 179 et seq. (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>
 
The obligation to provide the essence of the agreement between the joint controllers to data subjects originates from the transparency principle of [[Article 5 GDPR|Article 5(1)(a) GDPR]]. However, the validity of the agreement between the controllers is independent of the respective information of the data subject.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 60 (C.H. Beck 2024, 4th Edition).</ref>  
 
The GDPR does not specify how the information regarding the joint arrangement should be made available to the data subject. Unlike other provisions such as [[Article 30 GDPR|Article 30(4) GDPR]] for the record of processing or [[Article 40 GDPR|Article 40(11) GDPR]]  for the register of approved codes of conduct, Article 26(2) GDPR does not explicitly require the information to be made available "upon request" or "publicly available by way of appropriate means". As a result, it is the responsibility of the joint controllers to determine the most effective approach for providing the essence of the arrangement to data subjects.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 181 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> In most cases, it will be appropriate to include the information of the essence of the agreement in the initial information to the data subject ([[Article 13 GDPR|Article 13]] or [[Article 14 GDPR|14 GDPR]]) and in any response to an access request in accordance with [[Article 15 GDPR]].<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 9 (C.H. Beck 2024, 4th Edition).</ref> Joint controllers should ensure that the information is consistently provided in a coherent manner.<blockquote><u>Example</u>: In order to comply with the the obligation to provide data subjects with the essence of the agreement between joint controllers they include this information alongside the information outlined in Article [[Article 13 GDPR|13]] or [[Article 14 GDPR|14]] GDPR, within their privacy policy, and upon request by a data subject to the designated data protection officer or contact point. </blockquote>Generally, the joint controllers don't have to provide the data subject with the full agreement. Also, the commercial agreement between the parties (if included in the same agreement) do not have to be provided to the data subject.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 60 (C.H. Beck 2024, 4th Edition).</ref> 


=== (3) Effects on the rights of data subjects ===
=== (3) Effects on the rights of data subjects ===
It should be noted that under [[Article 26 GDPR|Article 26(3) GDPR]], a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "''in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA''".<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 48 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).
It should be noted that under [[Article 26 GDPR|Article 26(3) GDPR]], a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject who's position should not be deteriorated by the fact that more actors are involved in he processing of their personal data. <blockquote><u>Example:</u> A data subject's personal data is processed by joint controllers established in different member states. The data subject can choose to contact the controller established in the member state most convenient to the data subject (e.g. the controller established in their home country).<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 187 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).
</ref>
</ref></blockquote>Therefore, even if the agreement between the joint controllers stipulate that one specific controller handles access requests and the data subjects are made aware of that, the data subject is free to make an access request with one of the other joint controllers. The joint controllership agreement should anticipate that and could require the controller receiving the request to forward it to the responsible controller.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 189 (available [https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref> However, independent of agreement  between the joint controllers (and the actual internal handling of a request between the joint controllers), the receiver of the data subject's requests remains responsible to the data subject for the request.<ref>''Wyrobek'', in Knyrim, DatKomm, Article 26 GDPR, margin numbers 49 (Manz 2021).</ref> 


One consequence of this approach is that the liability of a controller will be restricted to the processing of the personal data for which it “''actually determines the purposes and means of processing''”. This implies, ''prima facie'', that a data subject cannot hold a controller to account for data processing beyond that which it is involved with. This means that the responsibility of each controller is limited to the set of operations it carries out. The EDPB suggests that joint controllership is related to a specific processing operation. In other words, joint controllership can exist in relation to a specific activity, such as marketing, while the controllers remain independent for all other "shared" processing activities.  
Besides compliance with data subjects rights joint controllers are also jointly liable for damages in case a data subject suffered material or non material damages as a result of an infringement of the GDPR in connection with the respective processing activity (see commentary to [[Article 82 GDPR|Article 82(4) GDPR]]).  
==Decisions==
==Decisions==
→ You can find all related decisions in [[:Category:Article 26 GDPR]]
→ You can find all related decisions in [[:Category:Article 26 GDPR]]

Revision as of 13:39, 29 August 2024

Article 26 - Joint controllers
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 26 - Joint controllers

1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

Relevant Recitals

Recital 58: Modalities for Transparent Information Provision
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.

Recital 79: Clear Allocation of Responsibilities
The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

Commentary

Article 26 implements the concept of joint controllership for cases in which two or more controllers together determine the purposes and means of processing. The goal of this provision is to achieve a clear allocation of the responsibilities under the GDPR between the joint controllers. Therefore, the joint controllers have to jointly determine the respective compliance responsibilities in an agreement between them. The provision also empowers data subjects, who should not suffer any disadvantage due to the joint controllership, by requiring transparency and accountability where multiple controllers jointly engage in processing operations. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller.

EDPB and Article 29 Working Party Guidelines: relevant guidelines for this Article are (i) EDPB, 'Guidelines 07/2020 on the concepts of controller and processor in the GDPR', 7 July 2021 (Version 2.1) (available here); (ii) WP29, 'Opinion 1/2010 on the concepts of "controller" and "processor"', 264/10/EN WP169, 16 February 2010 (available here).

(1) Joint controllership

Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "jointly determine the purposes and means of processing". Joint controllership does not arise in all cases of processing involving multiple entities. The key factor for determining joint controllership is the collective involvement of two or more entities in deciding both the purposes and means of processing.[1] If all entities involved have a say in both of these aspects, they should be regarded as joint controllers for that particular processing activity.[2]

Two or more controllers

According to the definition in Article 4(7) GDPR a controller is someone - who alone or jointly with others - determines the purposes and means of the processing of personal data. If the determination of the purposes and means of the processing happens by a cooperation of at least two controllers together (i.e. jointly), they are joint controllers. This is the case when at least two actors have a decisive influence over whether and how the processing takes place.[3]

In order to establish wether the different parties involved in any data protection activity are indeed controllers, it is important that those parties consider their respective rolls in the processing and in advance instead of retrospectively.[4] Particularly challenging is the distinction between joint controllers, processors (see Article 28 GDPR) and separate independent controllers in situations with multiple actors in a processing activities.

Jointly determine purposes and means of processing

For a commentary on the purposes and means of processing see the definition of the controller in Article 4(7) GDPR.

The term “jointly” must be interpreted as meaning “together with” or “not alone”. In other words, attention must be paid to whether multiple entities act in a joint manner. This assessment of joint participation should be based on a factual, rather than formal basis.[5]

There are various ways in which joint participation can occur. For instance, it can manifest as a "common decision"[6] made by multiple entities or arise from "converging decisions", which occur when controllers take decisions that complement one another separately.[7] In practice, it very much depends on the specific case in which the cooperation and participation of the actors can take various forms and can also be unevenly distributed.[8] Only when the joint participation leads to the joint determination of the purpose and means of the processing the controllers act as joint controllers.[9]

[Examples: Wirtschaftsakademie; Zeugen Jehovas; Fashion ID]

However, it is not necessary that all joint controller actually have access to the personal data that is processed.[10]

Example: In the case of Jehovah's Witnesses, the CJEU determined that a religious community and its members who engage in preaching, should be considered joint controllers for the processing of personal data conducted by the members during door-to-door preaching. The CJEU concluded that it was not necessary for the community to have access to the specific data or to provide written guidelines or instructions to its members regarding the data processing.[11]

Also, the use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.[12] But if, for example, two or more controllers develop and use a joint infrastructure together they are likely to be considered joint controller for such the respective processing on the joint infrastructure.[13]

Jointly determining the purposes and means of processing does not necessarily mean that two or more controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time.[14] Furthermore, there are scenarios where different actors sequentially process the same personal data in a chain of operations. Each of these actors has an autonomous purpose and independent means within their respective part of the chain. If there is no joint participation in determining the purposes and means of the same processing operation or set of operations, joint controllership must be ruled out. In such cases, the various actors should be considered successive independent controllers.[15]

Hence, collaboration between two controllers does not always result in joint controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be considered to be joint controllers. For example, the exchange of the same data or set of data between two entities without jointly determined purposes or jointly determined means of processing should be considered as a transmission of data between separate controllers. Joint controllership "may also be excluded in a situation where several entities use a shared database or a common infrastructure, if each entity independently determines its own purposes."[16]

Example: A group of companies uses the same database for the management of clients and prospects. Such database is hosted on the servers of the parent company who is therefore a processor of the companies with respect to the storage of the data. Each entity of the group enters the data of its own clients and prospects and processes such data for its own purposes only. Also, each entity decides independently on the access, the retention periods, the correction or deletion of their clients and prospects’ data. They cannot access or use each other’s data. The mere fact that these companies use a shared group database does not as such entail joint controllership. Under these circumstances, each company is a separate controller.[17]

A helpful tool for (joint) controllers as well as processors ist the flowchart provided by the EDPB in order to evaluate an actor's data protection role in a processing activity.[18]

Determine their respective responsibilities

According to Article 26(1) of the GDPR, joint controllers are required to determine and agree on their respective responsibilities for fulfilling the obligations set forth in the Regulation. This process should be transparent, ensuring that it is clear and explicit which tasks each joint controller is responsible for regarding the specific joint processing activity. The purpose of this provision is to ensure that, in situations where multiple actors are involved, responsibility for GDPR compliance is clearly allocated. To achieve this, the EDPB clarifies that responsibilities should be assigned taking into account the contractual party's proximity to the specific processing. In other words, once again, the factual circumstances help determine who should be responsible for what. Independent of the agreement between the controllers the relevant circumstances and the internal assessment regarding the allocated responsibilities should be documented.[19]

Example: In case only one of the joint controllers collects personal data from the data subject it might me reasonable that this joint controller is made responsible for informing the data subject in accordance with Article 13 GDPR since this controller is in the best position to effectively ensure compliance with this obligation.

The aim of the agreement between the parties, as mentioned, is to ensure compliance with the GDPR. In this regard, the second sentence of Article 26(1) highlights the importance of paying particular attention to the exercise of data subject rights and the information obligations outlined in Articles 13 and 14 of the GDPR. This is intended to prevent negative consequences of the involvement of more than one controller for the data subjects regarding these aspects of compliance (rights and transparency). Nevertheless, as the inclusion of the phrase "in particular" shows, the obligations related to the allocation of compliance responsibilities among the involved parties are not exhaustive. Therefore, it can be inferred that the distribution of compliance responsibilities among joint controllers is not confined to the specific topics mentioned in Article 26(1), but also encompasses other obligations of controllers under the GDPR.

The EDPB lists a number of compliance measures and related obligations that must be considered when joint controllers determine their respective responsibilities:

  • the implementation of general data protection principles (Article 5),
  • determination of the legal basis for processing (Article 6),
  • implementation of security measures (Article 32),
  • notification of personal data breaches to the supervisory authority and data subjects (Articles 33 and 34),
  • conducting Data Protection Impact Assessments (Articles 35 and 36),
  • engaging a processor (Article 28),
  • ensuring compliance with data transfer requirements for third countries (Chapter V), and
  • organizing communication with data subjects and supervisory authorities.[20]

Joint responsibility does not necessarily mean that the responsibilities of the involved controllers is distributed evenly between them.[21] And some obligations cannot be distribute at all and the joint controllers individually need to comply with the same requirements. This can be the case for the for each joint controller's obligation to maintain a record of processing activities or to appoint a Data Protection Officer (DPO) if the conditions outlined in Article 30 or 37(1) respectively are met. These requirements are not specifically tied to the joint processing activity but are applicable to each controller individually.[22]

By means of an arrangement

The form of the agreement is not prescribed, and the parties are generally free to decide on it. However, this document defines their responsibilities, so in order to provide clarity and legal certainty between the parties seems reasonable.[23] This form also facilitates the controller's task of demonstrating compliance with the GDPR (see Article 24 GDPR). Of course the formal agreement should also reflect the actual distribution of responsibilities and obligations.[24] The agreement should be able to describe the "respective responsibilities" in a "transparent manner" meaning it should be written in clear and straightforward language. Additionally, to provide a better framework for the allocation of responsibilities between the parties, the arrangement should also includes general information about the joint processing. This should include specifying the relationship between the joint controllers; the function of each controller; and a description of the processing activity including the subject matter and purpose of the processing, the type of personal data involved, and the categories of data subjects.[25]

The formal agreement between the controllers should, in particular, also include the distribution of responsibilities in connection with the rights of the data subjects and the respective obligations of the controllers. If on of the controllers act as a designated contact point for the data subject, that fact should also be reflected in the agreement.[26]

The agreement between the joint controllers can be combined with other agreements between the same parties. However, the transparency of the determination of the respective agreements must not be undermined by such a combination.[27]

Each controller should be aware that the fact that a processing activity falls under the joint controllership of more than one controller has to be recorded in the record of processing activities in accordance with Article 30(1)(a) GDPR as well as in a notice to the supervisory authority in connection with a prior consultation in accordance with Article 36(3)(a) GDPR. In essence, the information in these documents should therefore correspond with the information in the agreement between the joint controllers.

Which may designate a contact point for the data subjects

While the implementation of a single contact point for data subjects is not mandatory, it can serve two important purposes. First, it enables data subjects to know whom to approach for any matters related to the processing of their personal data. Secondly, it allows the joint controllers to coordinate their interactions and communications with data subjects more efficiently. In order to facilitate the exercise of data subjects' rights as per the GDPR, the EDPB recommends that joint controllers designate a contact point for this purpose. This contact point can be the Data Protection Officer (DPO) of one of the joint controllers or the representative in the Union (for joint controllers not established in the Union), or any other designated contact point where relevant information can be obtained.[28]

Unless Union or Member State law applies

Article 26 GDPR requires the joint controllers have an arrangement that clearly allocates the roles of each party. This is not an absolute rule. Where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary.[29] Such a determination by Union or Member State law also takes precedence over any respective agreement between the joint controllers.[30]

(2) Joint controllership arrangement

Joint controllers must clarify their respective roles in the arrangement, particularly concerning the exercise of data subject rights and their obligations to provide information as outlined in Articles 13 and 14 of the GDPR (see above). Article 26(2) of the GDPR emphasizes the significance of these specific obligations.

Duly reflect respective roles and relationships vis-à-vis the data subject

Joint controllers must establish how and by whom the required information will be provided to data subjects and how and by whom responses to data subject requests will be handled. The organization of these obligations in the arrangement should accurately reflect the reality of the joint processing. For instance, if only one of the joint controllers is responsible for communicating with data subjects regarding the joint processing, that controller may be better positioned to inform data subjects and address their requests effectively.[31]

While the joint controllership agreement is binding between the controllers as parties to the agreement the data subject is not bound by the agreement; for them it is a tool to increase transparency.[32]

Essence of the arrangement shall be made available to the data subject

The "essence" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. What should be covered by the notion of “essence of the arrangement” is not specified by the GDPR.

The EDPB recommends that data subjects are provided with, at least, all the elements of the information referred to in Articles 13 and 14 GDPR, and for each of these elements, the data subjects should be made aware of the arrangement between the joint controller regarding the responsibility for ensuring compliance with the respective element. Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.[33]

The obligation to provide the essence of the agreement between the joint controllers to data subjects originates from the transparency principle of Article 5(1)(a) GDPR. However, the validity of the agreement between the controllers is independent of the respective information of the data subject.[34]

The GDPR does not specify how the information regarding the joint arrangement should be made available to the data subject. Unlike other provisions such as Article 30(4) GDPR for the record of processing or Article 40(11) GDPR for the register of approved codes of conduct, Article 26(2) GDPR does not explicitly require the information to be made available "upon request" or "publicly available by way of appropriate means". As a result, it is the responsibility of the joint controllers to determine the most effective approach for providing the essence of the arrangement to data subjects.[35] In most cases, it will be appropriate to include the information of the essence of the agreement in the initial information to the data subject (Article 13 or 14 GDPR) and in any response to an access request in accordance with Article 15 GDPR.[36] Joint controllers should ensure that the information is consistently provided in a coherent manner.

Example: In order to comply with the the obligation to provide data subjects with the essence of the agreement between joint controllers they include this information alongside the information outlined in Article 13 or 14 GDPR, within their privacy policy, and upon request by a data subject to the designated data protection officer or contact point.

Generally, the joint controllers don't have to provide the data subject with the full agreement. Also, the commercial agreement between the parties (if included in the same agreement) do not have to be provided to the data subject.[37]

(3) Effects on the rights of data subjects

It should be noted that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject who's position should not be deteriorated by the fact that more actors are involved in he processing of their personal data.

Example: A data subject's personal data is processed by joint controllers established in different member states. The data subject can choose to contact the controller established in the member state most convenient to the data subject (e.g. the controller established in their home country).[38]

Therefore, even if the agreement between the joint controllers stipulate that one specific controller handles access requests and the data subjects are made aware of that, the data subject is free to make an access request with one of the other joint controllers. The joint controllership agreement should anticipate that and could require the controller receiving the request to forward it to the responsible controller.[39] However, independent of agreement between the joint controllers (and the actual internal handling of a request between the joint controllers), the receiver of the data subject's requests remains responsible to the data subject for the request.[40]

Besides compliance with data subjects rights joint controllers are also jointly liable for damages in case a data subject suffered material or non material damages as a result of an infringement of the GDPR in connection with the respective processing activity (see commentary to Article 82(4) GDPR).

Decisions

→ You can find all related decisions in Category:Article 26 GDPR

References

  1. Petri, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 26 GDPR, margin number 12 (C.H. Beck 2019).
  2. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available here).
  3. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 54 (available here).
  4. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 10 (C.H. Beck 2024, 4th Edition).
  5. A purely formal criterion would not be adequate for two main reasons. Firstly, there are situations where the formal appointment of a joint controller, mandated by law or contract, may be missing. Secondly, there are cases where the formal appointment does not accurately reflect the actual arrangements, as it may assign the role of controller to an entity that does not have the authority to "determine" the purposes and means of the processing. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 52 (available here).
  6. "Joint participation through a common decision means deciding together and involves a common intention in accordance with the most common understanding of the term “jointly” referred to in Article 26 of the GDPR." - EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 55 (available here).
  7. An important criterion to identify converging decisions in this context is whether the processing would not be possible without both parties’ participation in the purposes and means in the sense that the processing by each party is inseparable, i.e. inextricably linked. The situation of joint controllers acting on the basis of converging decisions should however be distinguished from the case of a processor, since the latter – while participating in the performance of a processing – does not process the data for its own purposes but carries out the processing on behalf of the controller. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 55 (available here).
  8. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 16 (C.H. Beck 2024, 4th Edition).
  9. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 51 (available here).
  10. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 56 (available here).
  11. CJEU, C‑25/17, Jehovan todistajat, 10.7.2018 (available here).
  12. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 21 (available here).
  13. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 20 (C.H. Beck 2024, 4th Edition).
  14. The CJEU clarified in its Fashion ID decision that an entity will be considered a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing. See, CJEU, Case C-40/17, Fashion ID, 29 July 2019 (available here).
  15. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 72 (available here).
  16. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 71 (available here).
  17. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 71 (available here).
  18. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 49 et seqq (available here).
  19. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 167 et seq. (available here).
  20. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 166 (available here).
  21. CJEU, Case C-210/16, Wirtschaftsakademie, 5 June 2015, margin number 43 (available here).
  22. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 170 (available here).
  23. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), margin number 173 (available here).
  24. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 55 (C.H. Beck 2024, 4th Edition).
  25. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 46 (available here); Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).
  26. for an extensive list of issues that should be subject of the joint controller agreement see Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 24 GDPR, margin number 59 (C.H. Beck 2024, 4th Edition).
  27. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).
  28. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 182 et seqq. (available here).
  29. Millard, Kamarinou, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 26 GDPR, p. 587 (Oxford University Press 2020).
  30. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 53 (C.H. Beck 2024, 4th Edition).
  31. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 178 (available here).
  32. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 62 (C.H. Beck 2024, 4th Edition).
  33. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 179 et seq. (available here).
  34. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 60 (C.H. Beck 2024, 4th Edition).
  35. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 181 (available here).
  36. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 9 (C.H. Beck 2024, 4th Edition).
  37. Hartung, in Kühling, Buchner, DS-GVO BDSG, Article 26 GDPR, margin number 60 (C.H. Beck 2024, 4th Edition).
  38. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 187 (available here).
  39. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), margin number 189 (available here).
  40. Wyrobek, in Knyrim, DatKomm, Article 26 GDPR, margin numbers 49 (Manz 2021).