Article 26 GDPR: Difference between revisions

From GDPRhub
Line 196: Line 196:
{{Recital/58 GDPR}}{{Recital/79 GDPR}}
{{Recital/58 GDPR}}{{Recital/79 GDPR}}


==Commentary on Article 26==
==Commentary==
Article 26 GDPR goes a substantial way towards empowering the data subject by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, Article 26 GDPR requires joint-controllers to determine and allocate their respective data processing and GDPR responsibilities by means of an arrangement. The essence of the arrangement shall be made available to the data subjects. This should make it easier for them to gain awareness about the processing and exercise their rights against each controller.  
Article 26 GDPR goes a substantial way towards empowering data subjects by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, it requires joint-controllers to determine and allocate their respective responsibilities for the processing by means of an arrangement. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller.


===(1) Joint Controllership ===
===(1) Joint Controllership ===
Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "''jointly determine the purposes and means of processing''".
Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "''jointly determine the purposes and means of processing''". The term “jointly” must be interpreted as meaning “''together with''” or “''not alone''”. In other words, when determining the existence of joint controllership, attention must be paid to whether multiple entities act in a joint manner. This assessment of joint participation should be based on a factual, rather than formal basis.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 19 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref>


The term “jointly” must be interpreted as meaning “''together with''” or “''not alone''”. In other words, when determining the existence of joint controllership, attention must be paid to whether or not multiple entities act in a joint manner. This assessment of joint participation should be carried on a factual, rather than formal basis.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-072020-concepts-controller-and_en p. 19].</ref>
In particular, when assessing whether there is joint participation by two or more controllers, it is necessary to look at which controllers exercise decisive influence over when and how the processing takes place. Typically, two controllers will be held to be “''jointly''” controlling where they together determine the purposes and means of processing. The EDPB has highlighted that an important criterion for joint controllership is the notion of an inextricable link between the processing activities of two parties.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), pp. 19-20 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref> This link exists where controllers take a common decision together, or take decisions that complement one another separately. It may also be found in instances where a mutual benefit arises from the same processing operation. For instance, a mutual economic benefit was a determining factor for the court to find the defendants were joint controllers in the Fashion ID case.<ref>In this case, the CJEU found that an operator of a social network and an administrator of a fan page hosted on that network were both jointly responsible for the processing of the personal data of visitors who came to that page, even if the administrator of the fan page did not have access to the personal data in question. Instead, the "''contribution''" of the administrator came from the act of defining the parameters of the fan-page. See, CJEU, Case C-40/17, ''Fashion ID'', 29 July 2019, margin number 85 (available [https://curia.europa.eu/juris/liste.jsf?num=C-40/17 here]).</ref>  


In particular, when assessing whether there is joint participation by two or more controllers, it is necessary to look at whether there is decisive influence by the controllers over when and how processing takes place. Typically, two controllers will be held to be “jointly” controlling in instances where they together determine the purposes and means of processing.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-072020-concepts-controller-and_en p. 19].</ref> The EDPB has highlighted that an important criterion for joint controllership is the notion of an inextricable linkage between the processing activities of two parties.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-072020-concepts-controller-and_en p. 19].</ref> This can take place through acts such as taking a common decision together, or taking decisions separately that complement one another. This may also happen in instances where there is a mutual benefit that arises from the same processing operation, like an economic benefit, which was the case in the Fashion ID decision.<ref>In this case, the CJEU found that an operator of a social network and an administrator of a fan page hosted on that network were both jointly responsible for the processing of the personal data of visitors who came to that page, even if the administrator of the fan page did not have access to the personal data in question. Instead, the "''contribution''" of the administrator came from the act of defining the parameters of the fan-page. See, CJEU, 29 July 2019, Fashion ID, C‑40/17, margin number 85 (available [https://curia.europa.eu/juris/liste.jsf?num=C-40/17 here]).</ref>
Jointly determining the purposes and means of processing does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time.<ref>The CJEU clarified in its Fashion ID decision that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing. See, CJEU, Case C-40/17, ''Fashion ID'', 29 July 2019 (available [https://curia.europa.eu/juris/liste.jsf?num=C-40/17 here]).</ref> Different controllers may be involved at different times and stages of processing,<ref>CJEU, Case C-210/16, ''Wirtschaftsakademie'', 5 June 2018, margin numbers 38, 43 (available [https://curia.europa.eu/juris/liste.jsf?num=C-210/16 here]).</ref> as well as to different degrees. The use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 21 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref>


Jointly determining the purposes and means of processing does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time.<ref>The CJEU clarified in its Fashion ID decision that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing. See, CJEU, 29 July 2019, Fashion ID, C‑40/17 (available [https://curia.europa.eu/juris/liste.jsf?num=C-40/17 here]).</ref> Different controllers may be involved at different times and stages of processing,<ref>CJEU, 5 June 2018, Wirtschaftsakademie, C‑210/16, margin numbers 38, 43 (available [https://curia.europa.eu/juris/liste.jsf?num=C-210/16 here]). </ref> and to different degrees. The use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, p. 19 [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-072020-concepts-controller-and_en p. 20].</ref>
One consequence of this approach is that the liability of a controller will be restricted to the processing of the personal data for which it “''actually determines the purposes and means of processing''”. This implies, ''prima facie'', that a data subject cannot hold a controller to account for data processing beyond that which it is involved with. This means that the responsibility of each controller is limited to the set of operations it carries out. However, this does not mean that collaboration between two controllers will always result in joint controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 24 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref> A mere mutual benefit to processing in itself is insufficient to establish joint controllership. If an entity processes data but does not pursue its own purposes in relation to the processing activity, it will merely be a processor, rather than a joint controller.


One consequence of this approach is that liability of a controller will be restricted to the processing of the personal data for which it “''actually determines the purposes and means of processing''”. This implies, ''prima facie'', that a data subject cannot hold a controller to account for data processing beyond that which the controller is involved with. However, Article 82(4) GDPR clarifies that a data subject may hold any of the joint controllers liable for an infringement of any of the joint controllers. However, this may mean that the responsibility of each controller is limited to the set of operations it decides upon when it comes to administrative fines under Article 83 GDPR. 
Collaboration between two controllers will not always result in join controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, p. 24.</ref> merely a mutual benefit to processing in itself is insufficient to establish joint controllership. If an entity processes data but does not pursue its own purposes in relation to the processing activity, it will merely be a processor, rather than a joint controller.
=== (2) Joint Controllership Arrangement ===
=== (2) Joint Controllership Arrangement ===
Article 26 GDPR imposes on the joint controllers an obligation to have an arrangement that clearly allocates the roles of each controller.<ref>This is not an absolute rule. Where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary.''Millard, Kamarinou'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 26 GDPR, p. 587 (Oxford University Press 2020).</ref> In other words, joint controllers need to set "who does what" according to the factual circumstances of the case.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, pp. 43-44.</ref>
Article 26 GDPR requires the joint controllers have an arrangement that clearly allocates the roles of each controller.<ref>This is not an absolute rule. Where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary. See .''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 26 GDPR, p. 587 (Oxford University Press 2020).</ref> In other words, joint controllers need to set "''who does what''" according to the factual circumstances of the case.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), pp. 43-44 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref>


This arrangement, which in theory does not require any form,<ref>"[F]''or the sake of legal certainty, even if there is no legal requirement in the GDPR for a contract or other legal act, the EDPB recommends that such arrangement be made in the form of a binding document such as a contract or other legal binding act under EU or Member State law to which the controllers are subject''". See, EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, p. 46.</ref> should reflect the responsibilities of each controller, and in particular, their responsibilities with regards to the rights of data subjects and the information provided under [[Article 13 GDPR|Articles 13]] and [[Article 14 GDPR|14 GDPR]]. However, the use of the terms “''in particular''” indicates that the obligations subject to the allocation of responsibilities for compliance by each party involved as referred in this provision are non-exhaustive.  
This arrangement, the form of which is not prescribed,<ref>"[F]''or the sake of legal certainty, even if there is no legal requirement in the GDPR for a contract or other legal act, the EDPB recommends that such arrangement be made in the form of a binding document such as a contract or other legal binding act under EU or Member State law to which the controllers are subject''". See, EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 46 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref> should reflect the responsibilities of each controller, in particular their responsibilities with regards to the rights of data subjects and the information provided under [[Article 13 GDPR|Articles 13]] and [[Article 14 GDPR|14 GDPR]]. However, the use of the terms “''in particular''” indicates that the obligations subject to the allocation of responsibilities for compliance by each party involved as referred in this provision are non-exhaustive.  


It follows that the distribution of the responsibilities for compliance among joint controllers is not limited to the topics referred in Article 26(1) but extends to other controller’s obligations under the GDPR.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 21 July 2021, pp. 43-44.</ref> Joint controllers may therefore wish to specify their respective responsibilities towards implementing general data protection principles ([[Article 5 GDPR]]), security measures ([[Article 32 GDPR]]), and transfers of data to third countries (Chapter V of the GDPR). Other topics that could also be included, depending on what is at stake with the processing, and what the intention of the parties is with regards to the processed data. However, both controllers always have a duty to ensure that they both have a legal basis for processing.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-072020-concepts-controller-and_en p. 44].</ref>
It follows that the distribution of the responsibilities for compliance among joint controllers is not limited to the topics referred in Article 26(1) GDPR, but extends to other controller’s obligations under the GDPR. Joint controllers may therefore wish to specify their respective responsibilities towards implementing general data protection principles ([[Article 5 GDPR]]), security measures ([[Article 32 GDPR]]), and transfers of data to third countries (Chapter V of the GDPR). However, both controllers always have a duty to ensure that they both have a legal basis for processing.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), pp. 43-44 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref>


The "essence" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. The EDPB recommends that the essence cover "''at least all the elements of the information referred to in Articles 13 and 14 that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements''". Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, p. 47.</ref>  
The "''essence''" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. The EDPB recommends that the essence cover "''at least all the elements of the information referred to in Articles 13 and 14 that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements''". Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.<span lang="EN-GB">Article 26 GDPR goes a substantial way towards
empowering data subjects by requiring transparency and accountability where
multiple controllers jointly engage in processing operations. In particular, it
requires joint-controllers to determine and allocate their respective
responsibilities for the processing by means of an arrangement. Data subjects
should be informed of the essence of this arrangement to strengthen their
understanding of the processing and facilitate the exercise of their rights
against each controller. </span><ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 47 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).</ref>  


=== (3) Effects on the Rights of Data Subjects ===
=== (3) Effects on the Rights of Data Subjects ===
It should be noted, that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controller arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "''in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA''".<ref>EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, 2 September 2020, p. 48.</ref>  
It should be noted that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "''in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA''".<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 48 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).
 
</ref>  
==Decisions==
==Decisions==
→ You can find all related decisions in [[:Category:Article 26 GDPR]]
→ You can find all related decisions in [[:Category:Article 26 GDPR]]

Revision as of 16:30, 25 April 2022

Article 26 - Joint controllers
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 26 - Joint controllers

1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

Relevant Recitals

Recital 58: Modalities for Transparent Information Provision
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.

Recital 79: Clear Allocation of Responsibilities
The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

Commentary

Article 26 GDPR goes a substantial way towards empowering data subjects by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, it requires joint-controllers to determine and allocate their respective responsibilities for the processing by means of an arrangement. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller.

(1) Joint Controllership

Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "jointly determine the purposes and means of processing". The term “jointly” must be interpreted as meaning “together with” or “not alone”. In other words, when determining the existence of joint controllership, attention must be paid to whether multiple entities act in a joint manner. This assessment of joint participation should be based on a factual, rather than formal basis.[1]

In particular, when assessing whether there is joint participation by two or more controllers, it is necessary to look at which controllers exercise decisive influence over when and how the processing takes place. Typically, two controllers will be held to be “jointly” controlling where they together determine the purposes and means of processing. The EDPB has highlighted that an important criterion for joint controllership is the notion of an inextricable link between the processing activities of two parties.[2] This link exists where controllers take a common decision together, or take decisions that complement one another separately. It may also be found in instances where a mutual benefit arises from the same processing operation. For instance, a mutual economic benefit was a determining factor for the court to find the defendants were joint controllers in the Fashion ID case.[3]

Jointly determining the purposes and means of processing does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time.[4] Different controllers may be involved at different times and stages of processing,[5] as well as to different degrees. The use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.[6]

One consequence of this approach is that the liability of a controller will be restricted to the processing of the personal data for which it “actually determines the purposes and means of processing”. This implies, prima facie, that a data subject cannot hold a controller to account for data processing beyond that which it is involved with. This means that the responsibility of each controller is limited to the set of operations it carries out. However, this does not mean that collaboration between two controllers will always result in joint controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers.[7] A mere mutual benefit to processing in itself is insufficient to establish joint controllership. If an entity processes data but does not pursue its own purposes in relation to the processing activity, it will merely be a processor, rather than a joint controller.

(2) Joint Controllership Arrangement

Article 26 GDPR requires the joint controllers have an arrangement that clearly allocates the roles of each controller.[8] In other words, joint controllers need to set "who does what" according to the factual circumstances of the case.[9]

This arrangement, the form of which is not prescribed,[10] should reflect the responsibilities of each controller, in particular their responsibilities with regards to the rights of data subjects and the information provided under Articles 13 and 14 GDPR. However, the use of the terms “in particular” indicates that the obligations subject to the allocation of responsibilities for compliance by each party involved as referred in this provision are non-exhaustive.

It follows that the distribution of the responsibilities for compliance among joint controllers is not limited to the topics referred in Article 26(1) GDPR, but extends to other controller’s obligations under the GDPR. Joint controllers may therefore wish to specify their respective responsibilities towards implementing general data protection principles (Article 5 GDPR), security measures (Article 32 GDPR), and transfers of data to third countries (Chapter V of the GDPR). However, both controllers always have a duty to ensure that they both have a legal basis for processing.[11]

The "essence" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. The EDPB recommends that the essence cover "at least all the elements of the information referred to in Articles 13 and 14 that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements". Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.Article 26 GDPR goes a substantial way towards empowering data subjects by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, it requires joint-controllers to determine and allocate their respective responsibilities for the processing by means of an arrangement. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller. [12]

(3) Effects on the Rights of Data Subjects

It should be noted that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA".[13]

Decisions

→ You can find all related decisions in Category:Article 26 GDPR

References

  1. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 19 (available here).
  2. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), pp. 19-20 (available here).
  3. In this case, the CJEU found that an operator of a social network and an administrator of a fan page hosted on that network were both jointly responsible for the processing of the personal data of visitors who came to that page, even if the administrator of the fan page did not have access to the personal data in question. Instead, the "contribution" of the administrator came from the act of defining the parameters of the fan-page. See, CJEU, Case C-40/17, Fashion ID, 29 July 2019, margin number 85 (available here).
  4. The CJEU clarified in its Fashion ID decision that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing. See, CJEU, Case C-40/17, Fashion ID, 29 July 2019 (available here).
  5. CJEU, Case C-210/16, Wirtschaftsakademie, 5 June 2018, margin numbers 38, 43 (available here).
  6. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 21 (available here).
  7. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 24 (available here).
  8. This is not an absolute rule. Where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary. See .Millard, Kamarinou, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 26 GDPR, p. 587 (Oxford University Press 2020).
  9. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), pp. 43-44 (available here).
  10. "[F]or the sake of legal certainty, even if there is no legal requirement in the GDPR for a contract or other legal act, the EDPB recommends that such arrangement be made in the form of a binding document such as a contract or other legal binding act under EU or Member State law to which the controllers are subject". See, EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 46 (available here).
  11. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), pp. 43-44 (available here).
  12. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 47 (available here).
  13. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 48 (available here).