Article 26 GDPR

← Article 26 - Joint controllers →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 26 - Joint controllers

1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

Relevant Recitals

Recital 58: Modalities for Transparent Information Provision

The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.

Recital 79: Clear Allocation of Responsibilities

The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

Commentary

Article 26 GDPR goes a substantial way towards empowering data subjects by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, it requires joint-controllers to determine and allocate their respective responsibilities for the processing by means of an arrangement. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller.

(1) Joint controllership

Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "jointly determine the purposes and means of processing".

Jointly determine purposes and means of processing

The term “jointly” must be interpreted as meaning “together with” or “not alone”. In other words, attention must be paid to whether multiple entities act in a joint manner. This assessment of joint participation should be based on a factual, rather than formal basis.

EDPB: A merely formal criterion would not be sufficient for at least two reasons: in some cases, the formal appointment of a joint controller - laid down for example by law or in a contract - would be absent; in other cases, it may be that the formal appointment does not reflect the reality of the arrangements, by formally entrusting the role of controller to an entity which actually is not in the position to "determine" the purposes and means of the processing. In particular, it is necessary to look at which controllers exercise decisive influence over when and how the processing takes place. Typically, two controllers will be held to be “jointly” controlling where they together determine the purposes and means of processing.

Joint controllership does not arise in all cases of processing involving multiple entities. The key factor for determining joint controllership is the collective involvement of two or more entities in deciding both the purposes and means of processing. If all entities involved have a say in both of these aspects, they should be regarded as joint controllers for that particular processing activity. In practical terms, there are various ways in which joint participation can occur. For instance, it can manifest as a "common decision" made by multiple entities or arise from "converging decisions", which occur when controllers take decisions that complement one another separately.

EDPB: An important criterion to identify converging decisions in this context is whether the processing would not be possible without both parties’ participation in the purposes and means in the sense that the processing by each party is inseparable, i.e. inextricably linked. The situation of joint controllers acting on the basis of converging decisions should however be distinguished from the case of a processor, since the latter – while participating in the performance of a processing – does not process the data for its own purposes but carries out the processing on behalf of the controller.

Joint controllership may also be found in instances where a mutual benefit arises from the same processing operation. The EDPB highlights that "the mere existence of a mutual benefit (for ex. commercial) arising from a processing activity does not give rise to joint controllership. If the entity involved in the processing does not pursue any purpose(s) of its own in relation to the processing activity, but is merely being paid for services rendered, it is acting as a processor rather than as a joint controller." Along the same line, the absence of access to the personal data being processed by one of the parties is not sufficient to exclude joint controllership.

CJEU: In the case of Jehovah's Witnesses, the CJEU determined that a religious community, along with its members engaged in preaching, should be considered joint controllers for the processing of personal data conducted by the members during door-to-door preaching. The CJEU concluded that it was not necessary for the community to have access to the specific data or to provide written guidelines or instructions to its members regarding the data processing.

Jointly determining the purposes and means of processing does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time. Different controllers may be involved at different times and stages of processing, as well as to different degrees. The use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.

EDPB: In broad terms, joint controllership exists with regard to a specific processing activity when different parties determine jointly the purpose and means of this processing activity. Therefore, assessing the existence of joint controllers requires examining whether the determination of purposes and means that characterize a controller are decided by more than one party.

Hence, collaboration between two controllers will not always result in joint controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers. For example, the exchange of the same data or set of data between two entities without jointly determined purposes or jointly determined means of processing should be considered as a transmission of data between separate controllers. Joint controllership "may also be excluded in a situation where several entities use a shared database or a common infrastructure, if each entity independently determines its own purposes."

Example: A group of companies uses the same database for the management of clients and prospects. Such database is hosted on the servers of the mother company who is therefore a processor of the companies with respect to the storage of the data. Each entity of the group enters the data of its own clients and prospects and processes such data for its own purposes only. Also, each entity decides independently on the access, the retention periods, the correction or deletion of their clients and prospects’ data. They cannot access or use each other’s data. The mere fact that these companies use a shared group database does not as such entail joint controllership. Under these circumstances, each company is thus a separate controller.

Furthermore, there are scenarios where different actors sequentially process the same personal data in a chain of operations. Each of these actors has an autonomous purpose and independent means within their respective part of the chain. If there is no joint participation in determining the purposes and means of the same processing operation or set of operations, joint controllership must be ruled out. In such cases, the various actors should be considered successive independent controllers.

One consequence of this approach is that the liability of a controller will be restricted to the processing of the personal data for which it “actually determines the purposes and means of processing”. This implies, prima facie, that a data subject cannot hold a controller to account for data processing beyond that which it is involved with. This means that the responsibility of each controller is limited to the set of operations it carries out. The EDPB suggests that joint controllership is related to a specific processing operation. In other words, joint controllership can exist in relation to a specific activity, such as marketing, while the controllers remain independent for all other "shared" processing activities.

Respective responsibilities

According to Article 26(1) of the GDPR, joint controllers are required to determine and agree on their respective responsibilities for fulfilling the obligations set forth in the Regulation. This process should be transparent, ensuring that it is clear and explicit which tasks each joint controller is responsible for regarding the specific joint processing activity.

The purpose of this provision is to ensure that, in situations where multiple actors are involved, responsibility for GDPR compliance is clearly allocated. To achieve this, the European Data Protection Board (EDPB) clarifies that responsibilities should be assigned taking into account the contractual party's proximity to the specific processing. In other words, once again, the factual circumstances help determine who should be responsible for what.

Example: XXX

The aim of the agreement between the parties, as mentioned, is to ensure compliance with the GDPR. In this regard, the second part of Article 26(1) highlights the importance of paying particular attention to the exercise of data subject rights and the information obligations outlined in Articles 13 and 14 of the GDPR. This makes sense because, in cases involving multiple controllers, these two aspects of compliance (rights and transparency) can be impacted due to potential interactions between the parties. Nevertheless, the inclusion of the phrase "in particular" suggests that the obligations related to the allocation of compliance responsibilities among the involved parties, as mentioned in this provision, are not exhaustive. Therefore, it can be inferred that the distribution of compliance responsibilities among joint controllers is not confined to the specific topics mentioned in Article 26(1), but also encompasses other obligations of controllers under the GDPR.

This extends to various obligations under the GDPR, including but not limited to the implementation of general data protection principles (Article 5), determination of the legal basis for processing (Article 6), implementation of security measures (Article 32), notification of personal data breaches to the supervisory authority and data subjects (Articles 33 and 34), conducting Data Protection Impact Assessments (Articles 35 and 36), engaging a processor (Article 28), ensuring compliance with data transfer requirements for third countries (Chapter V), and organizing communication with data subjects and supervisory authorities. An additional instance is the obligation for each joint controller to maintain a record of processing activities or appoint a Data Protection Officer (DPO) if the conditions outlined in Article 37(1) are met. These requirements are not specifically tied to the joint processing activity but are applicable to each controller individually.

By means of an arrangement

The form of the agreement is not prescribed, and the parties are generally free to decide on it. However, this document defines their responsibilities, so a written or another form ensuring clarity on the agreement's points seems appropriate. This form also facilitates the controller's task of demonstrating compliance with the GDPR. The agreement should be able to describe the "respective responsibilities" in a "transparent manner" meaning it should be written in clear and straightforward language. Additionally, to provide a better framework for the allocation of responsibilities between the parties, the EDPB recommends that the arrangement also includes general information about the joint processing. This can include specifying the subject matter and purpose of the processing, the type of personal data involved, and the categories of data subjects.

Unless Union or Member State law applies

(2) Joint controllership arrangement

Article 26 GDPR requires the joint controllers have an arrangement that clearly allocates the roles of each party.

s

Essence of the arrangement

The "essence" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. The EDPB recommends that the essence cover "at least all the elements of the information referred to in Articles 13 and 14 that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements". Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.

(3) Effects on the rights of data subjects

It should be noted that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA".

Decisions

→ You can find all related decisions in Category:Article 26 GDPR