Article 26 GDPR

← Article 26 - Joint controllers →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 26 - Joint controllers

1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

Relevant Recitals

Recital 58: Transparency

The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualization be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.

Recital 79: Allocation of the Responsibilities

The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

Overview

Article 26 of the GDPR aims to provide clarity on how responsibility should be allocated in instances where there is more than one data controller. The purpose of this is to ensure that controllers comply with their obligations in a way that is transparent towards the data subject, and in a way that makes it easier for the data subject to exercise their rights against each controller.

Although the notion of Joint Controllership did not exist in the Data Protection Directive (95/46/EC), the GDPR’s predecessor, its history can be traced back to the Modernized Convention 108 for the Protection of Individuals with Regard to the Processing of Personal Data, which referred to the notion of ‘joint controllers’ in in Article 2. Historically, Member States have also had varying approaches towards Joint Controllership on a national level: for instance, while the United Kingdom referred to notions of both joint controllers and controllers in section 1(1) of the UK Data Protection Act 1998, Poland on the other hand, did not recognize the concept of Joint Controllership in law, but recognized it in practice by national Data Protection Authorities.

This commentary will subsequently explore the different elements of Article 26 and seek to provide some clarity on how it is operationalized in practice.

Article 26 (1) GDPR

Jointly

The term “jointly” must be interpreted as meaning “together with” or “not alone”.[1] In other words, when determining the existence of joint controllership, attention must be paid to whether or not multiple entities determine the purposes and means of processing in a joint manner. This assessment of joint participation should be carried on a factual, rather than formal, basis.

When assessing whether there is joint participation by two or more controllers, it is necessary to look at whether there is decisive influence by the controllers over when and how processing takes place. Typically, two controllers will be held to be “jointly” controlling in instances where they together determine the purposes and means of processing. [2] This can take place through acts such as taking a common decision together, or taking decisions separately that complement one another. [3] The EDPB has highlighted that an important criterion for joint controllership is the notion of an inextricable linkage between the processing activities of two parties.

On a more specific note, the fact that one of the parties may not have access to the personal data that is being processed is not enough to exclude it from joint controllership. This was confirmed in Wirtschaftsakademie[4], where the CJEU found that an operator of a social network and an administrator of a fan page hosted on that network were both jointly responsible for the processing of the personal data of visitors who came to that page, even if the administrator of the fan page didn’t have access to the personal data in question. Instead, the ‘contribution’ of the administrator came from the act of defining the parameters of the fan-page. However, the CJEU did clarify that although the operator of the social network and the administrator of the fan page were joint controllers, it did not necessarily follow that both controllers had equal shares of responsibility, because the two controllers “may be involved at different stages of that processing of personal data and to different degrees”[5].

This does not mean, however, that collaboration between two controllers will always result in Joint Controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers.[6] However, from a practical standpoint, it is questionable how clear this distinction is, as it may not always be easy to determine whether a purpose of processing is for unilateral or bilateral purposes.

With regards to who can be a joint controller, the Article 29 Working Party has stated that even users of social networking sites can themselves become joint controllers when their purposes of processing personal data are no longer for “purely personal or household activities”. [7] In other words, an individual can too be a joint controller when they engage in processing for a commercial purpose.

Determining the purposes and means of processing

A second requirement for joint controllership is that the multiple controllers must jointly determine the purposes and means of processing. However, the CJEU clarified in Fashion ID[8] that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing.[9]  This means that the responsibility of each controller is limited to the set of operations it decides upon.

Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time. Different controllers may be involved at different times and stages of processing, and to different degrees. However, one consequence of this approach is that liability of a controller will be restricted to the processing of the personal data for which it “actually determines the purposes and means of processing”[10]. This implies, prima facie, that a data subject cannot hold a controller to account for data processing beyond that which the controller is involved with[11].

Jointly determining the purposes and means of processing also does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllership may still exist in situations where the purposes pursued are closely linked or complementary, but not identical. This may happen in instances where there is a mutual benefit that arises from the same processing operation, like an economic benefit, which was the case in Fashion ID. Similarly, in Wirtschaftsakademie, the processing of personal data through statistics of a visitor fan page enabled both Facebook to improve its advertising system, and the administrator of the fan page to obtain statistics on its promotional activity.[12] In this instance, each entity pursued its own interests, but both parties participated in determining the purposes of processing of the personal data of the visitors to the fan page, which were linked. [13]

However, merely a mutual benefit to processing in itself is insufficient to establish joint controllership. If an entity processes data but does not pursue its own purposes in relation to the processing activity, it will merely be a processor, rather than a joint controller. Similarly, the use of joint infrastructure or a common data processing system will also not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.[14]

Joint Controllership arrangement

Article 26 imposes on the joint controllers an obligation to have an arrangement that clearly allocates the roles of each controller.

This arrangement should reflect the responsibilities of each controller, and in particular, their responsibilities with regards to the rights of data subjects under Article 13 and 14 of the GDPR. The ‘essence’ of this arrangement should be made available to the data subject, in order to provide transparency on processing operations. In particular, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights. However, if the joint controllership arrangement presented to the data subject is flawed or does not represent reality, the factual circumstances will prevail.[15] This may happen, for instance, in situations where the processor goes beyond their contractual obligations to process data on behalf of a controller, and proceeds to determine the means and purposes of processing themselves. In such a situation, even though the arrangement may label the processor as only processing data, the factual circumstances are such that the processor is indeed acting as a controller, and therefore may be liable as a joint controller.

However, there is an exception to the requirement to have a joint controllership arrangement: in instances where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary. [16]

With regards to the content of the joint controllership arrangement, joint controllers may wish to specify their respective responsibilities towards implementing general data protection principles (Article 5), security measures (Article 32), and transfers of data to third countries (Chapter V). Other topics that could also be included, depending on what is at stake with the processing, and what the intention of the parties is with regards to the processed data. However, both controllers always have a duty to ensure that they both have a legal basis for processing[17]. Furthermore, each controller must also ensure respect for the Purpose Limitation principle (Article 5(1)(b) GDPR) and guarantee that data is not further processed in a manner that is incompatible with the purposes for which it was originally collected. [18]

It should be noted, that under Article 26(3), a data subject is not bound by the terms of the joint controller arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject.

Conclusion

The provision on Joint Controllership is one step towards establishing greater transparency over the complex personal data processing ecosystem. Despite being a new provision in scope, Article 26 goes a substantial way towards empowering the data subject by requiring transparency and accountability from controllers, especially in instances where multiple controllers engage in complex processing operations.

---

[1] European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, September 2020, pg. 17.

< https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202007_controllerprocessor_en.pdf>

[2] EDPB, Guidelines 07/2020, pg. 1.

[3] Ibid.

[4] Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, para. 38.

[5] Wirtschaftsakademie, C-210/16, para. 43.

[6] Van Alsenoy 2012, pg. 24

[7] Article 29 Working Party (A29WP), Opinion 1/2010 on the concepts of "controller" and "processor", February 2010, pg. 21. < https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2010/wp169_en.pdf>

[8] Fashion ID, C‑40/17, ECLI:EU:C:2019:629

[9] Hahn I, The Fashion ID judgment and its impact on the rights of data subjects, September 2019,

< https://medium.com/personaldata-io/fashion-id-and-rights-of-data-subjects-60d02ffca17d>

[10] Fashion ID, para. 85. 

[11] Hahn I, The Fashion ID judgment and its impact on the rights of data subjects.

[12] Judgment in Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, paragraph 34.

[13] Judgment in Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, paragraph 39.

[14] EDPB, Guidelines 07/2020, pg. 20.

[15] Kuner C, The EU General Data Protection Regulation (GDPR): A Commentary, Oxford University Press 2020, pg. 587.

[16] Ibid.

[17] EDPB, Guidelines 07/2020, pg. 42.

[18] Ibid.

Decisions

→ You can find all related decisions in Category:Article 26 GDPR