Article 26 GDPR: Difference between revisions

From GDPRhub
 
(20 intermediate revisions by 6 users not shown)
Line 185: Line 185:


==Legal Text==
==Legal Text==
<center>'''Article 26 - Joint controllers'''</center><span id="1">1.  Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.</span>
<br /><center>'''Article 26 - Joint controllers'''</center>
 
<span id="1">1.  Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.</span>


<span id="2">2.  The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.</span>
<span id="2">2.  The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.</span>
Line 192: Line 194:


==Relevant Recitals==
==Relevant Recitals==
{{Recital/58 GDPR}}{{Recital/79 GDPR}}


<span id="r58">
==Commentary==
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 58:''' Transparency</div>
<div class="mw-collapsible-content">
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualization be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.
</div></div>
 
<span id="r79">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 79:''' Allocation of the Responsibilities</div>
<div class="mw-collapsible-content">
The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.
</div></div>
 
==Commentary on Article 26==
Article 26 of the GDPR aims to provide clarity on how responsibility should be allocated in instances where there is more than one data controller. The purpose of this is to ensure that controllers comply with their obligations in a way that is transparent towards the data subject, and in a way that makes it easier for the data subject to exercise their rights against each controller.
 
Although the notion of Joint Controllership did not exist in the Data Protection Directive (95/46/EC), the GDPR’s predecessor, its history can be traced back to the Modernized Convention 108 for the Protection of Individuals with Regard to the Processing of Personal Data, which referred to the notion of ‘joint controllers’ in in Article 2. Historically, Member States have also had varying approaches towards Joint Controllership on a national level: for instance, while the United Kingdom referred to notions of both joint controllers and controllers in section 1(1) of the UK Data Protection Act 1998, Poland on the other hand, did not recognize the concept of Joint Controllership in law, but recognized it in practice by national Data Protection Authorities.
 
The provision on Joint Controllership is one step towards establishing greater transparency over the complex personal data processing ecosystem. Despite being a new provision in scope, Article 26 goes a substantial way towards empowering the data subject by requiring transparency and accountability from controllers, especially in instances where multiple controllers engage in complex processing operations.
 
This commentary will subsequently explore the different elements of Article 26 and seek to provide some clarity on how it is operationalized in practice.
 
===(1) Defining joint controllers  ===
 
====Jointly====
The term “jointly” must be interpreted as meaning “together with” or “not alone”.[[Article 26 GDPR#%20ftn1|[1]]] In other words, when determining the existence of joint controllership, attention must be paid to whether or not multiple entities determine the purposes and means of processing in a joint manner. This assessment of joint participation should be carried on a factual, rather than formal, basis.
 
When assessing whether there is joint participation by two or more controllers, it is necessary to look at whether there is decisive influence by the controllers over when and how processing takes place. Typically, two controllers will be held to be “jointly” controlling in instances where they together determine the purposes and means of processing. [[Article 26 GDPR#%20ftn2|[2]]] This can take place through acts such as taking a common decision together, or taking decisions separately that complement one another. [[Article 26 GDPR#%20ftn3|[3]]] The EDPB has highlighted that an important criterion for joint controllership is the notion of an inextricable linkage between the processing activities of two parties.
 
On a more specific note, the fact that one of the parties may not have access to the personal data that is being processed is not enough to exclude it from joint controllership. This was confirmed in Wirtschaftsakademie[[Article 26 GDPR#%20ftn4|[4]]], where the CJEU found that an operator of a social network and an administrator of a fan page hosted on that network were both jointly responsible for the processing of the personal data of visitors who came to that page, even if the administrator of the fan page didn’t have access to the personal data in question. Instead, the ‘contribution’ of the administrator came from the act of defining the parameters of the fan-page. However, the CJEU did clarify that although the operator of the social network and the administrator of the fan page were joint controllers, it did not necessarily follow that both controllers had equal shares of responsibility, because the two controllers “may be involved at different stages of that processing of personal data and to different degrees”[[Article 26 GDPR#%20ftn5|[5]]].
 
This does not mean, however, that collaboration between two controllers will always result in Joint Controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers.[[Article 26 GDPR#%20ftn6|[6]]] However, from a practical standpoint, it is questionable how clear this distinction is, as it may not always be easy to determine whether a purpose of processing is for unilateral or bilateral purposes.
 
With regards to who can be a joint controller, the Article 29 Working Party has stated that even users of social networking sites can themselves become joint controllers when their purposes of processing personal data are no longer for “purely personal or household activities”. [[Article 26 GDPR#%20ftn7|[7]]] In other words, an individual can too be a joint controller when they engage in processing for a commercial purpose.
 
====Determining the purposes and means of processing====
A second requirement for joint controllership is that the multiple controllers must jointly determine the purposes and means of processing. However, the CJEU clarified in Fashion ID[[Article 26 GDPR#%20ftn8|'''[8]''']] that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing.[[Article 26 GDPR#%20ftn9|[9]]]  This means that the responsibility of each controller is limited to the set of operations it decides upon.
 
Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time. Different controllers may be involved at different times and stages of processing, and to different degrees. However, one consequence of this approach is that liability of a controller will be restricted to the processing of the personal data for which it “actually determines the purposes and means of processing”[[Article 26 GDPR#%20ftn10|[10]]]. This implies, prima facie, that a data subject cannot hold a controller to account for data processing beyond that which the controller is involved with[[Article 26 GDPR#%20ftn11|[11]]].
 
Jointly determining the purposes and means of processing also does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllership may still exist in situations where the purposes pursued are closely linked or complementary, but not identical. This may happen in instances where there is a mutual benefit that arises from the same processing operation, like an economic benefit, which was the case in Fashion ID. Similarly, in Wirtschaftsakademie, the processing of personal data through statistics of a visitor fan page enabled both Facebook to improve its advertising system, and the administrator of the fan page to obtain statistics on its promotional activity.[[Article 26 GDPR#%20ftn12|[12]]] In this instance, each entity pursued its own interests, but both parties participated in determining the purposes of processing of the personal data of the visitors to the fan page, which were linked. [[Article 26 GDPR#%20ftn13|[13]]]
 
However, merely a mutual benefit to processing in itself is insufficient to establish joint controllership. If an entity processes data but does not pursue its own purposes in relation to the processing activity, it will merely be a processor, rather than a joint controller. Similarly, the use of joint infrastructure or a common data processing system will also not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.[[Article 26 GDPR#%20ftn14|[14]]]
 
===(2) Joint Controllership arrangement===
Article 26 imposes on the joint controllers an obligation to have an arrangement that clearly allocates the roles of each controller.
 
This arrangement should reflect the responsibilities of each controller, and in particular, their responsibilities with regards to the rights of data subjects under Article 13 and 14 of the GDPR. The ‘essence’ of this arrangement should be made available to the data subject, in order to provide transparency on processing operations. In particular, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights. However, if the joint controllership arrangement presented to the data subject is flawed or does not represent reality, the factual circumstances will prevail.[[Article 26 GDPR#%20ftn15|[15]]] This may happen, for instance, in situations where the processor goes beyond their contractual obligations to process data on behalf of a controller, and proceeds to determine the means and purposes of processing themselves. In such a situation, even though the arrangement may label the processor as only processing data, the factual circumstances are such that the processor is indeed acting as a controller, and therefore may be liable as a joint controller.
 
However, there is an exception to the requirement to have a joint controllership arrangement: in instances where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary. [[Article 26 GDPR#%20ftn16|[16]]]
 
With regards to the content of the joint controllership arrangement, joint controllers may wish to specify their respective responsibilities towards implementing general data protection principles (Article 5), security measures (Article 32), and transfers of data to third countries (Chapter V). Other topics that could also be included, depending on what is at stake with the processing, and what the intention of the parties is with regards to the processed data. However, both controllers always have a duty to ensure that they both have a legal basis for processing[[Article 26 GDPR#%20ftn17|[17]]]. Furthermore, each controller must also ensure respect for the Purpose Limitation principle (Article 5(1)(b) GDPR) and guarantee that data is not further processed in a manner that is incompatible with the purposes for which it was originally collected. [[Article 26 GDPR#%20ftn18|[18]]]
 
=== (3) Right of data subjects ===
It should be noted, that under Article 26(3), a data subject is not bound by the terms of the joint controller arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject.
----[[Article 26 GDPR#%20ftnref1|[1]]] European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, September 2020, pg. 17.
 
< <nowiki>https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202007_controllerprocessor_en.pdf</nowiki>>
 
[[Article 26 GDPR#%20ftnref2|[2]]] EDPB, Guidelines 07/2020, pg. 1.
 
[[Article 26 GDPR#%20ftnref3|[3]]] Ibid.


[[Article 26 GDPR#%20ftnref4|[4]]] Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, para. 38.
Article 26 GDPR goes a substantial way towards empowering data subjects by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, it requires joint-controllers to determine and allocate their respective responsibilities for the processing by means of an arrangement. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller. 
===(1) Joint controllership ===
Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "''jointly determine the purposes and means of processing''". Joint controllership does not arise in all cases of processing involving multiple entities. The key factor for determining joint controllership is the collective involvement of two or more entities in deciding both the purposes and means of processing.<ref>''Petri'', in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 26 GDPR, margin number 12 (C.H. Beck 2019).</ref> If all entities involved have a say in both of these aspects, they should be regarded as joint controllers for that particular processing activity.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>


[[Article 26 GDPR#%20ftnref5|[5]]] Wirtschaftsakademie, C-210/16, para. 43.
==== Jointly determine purposes and means of processing ====
The term “jointly” must be interpreted as meaning “''together with''” or “''not alone''”. In other words, attention must be paid to whether multiple entities act in a joint manner. This assessment of joint participation should be based on a factual, rather than formal basis.<ref>A purely formal criterion would not be adequate for two main reasons. Firstly, there are situations where the formal appointment of a joint controller, mandated by law or contract, may be missing. Secondly, there are cases where the formal appointment does not accurately reflect the actual arrangements, as it may assign the role of controller to an entity that does not have the authority to "determine" the purposes and means of the processing. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>  <blockquote><u>EDPB</u>: In particular, it is necessary to look at which controllers exercise decisive influence over when and how the processing takes place. Typically, two controllers will be held to be “''jointly''” controlling where they together determine the purposes and means of processing.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref></blockquote>There are various ways in which joint participation can occur. For instance, it can manifest as a "''common decision''"<ref>The EDPB, in the cited guidelines: "''Joint participation through a common decision means deciding together and involves a common intention in accordance with the most common understanding of the term “jointly” referred to in Article 26 of the GDPR.''"</ref> made by multiple entities or arise from "''converging decisions''", which occur when controllers take decisions that complement one another separately.<ref>An important criterion to identify converging decisions in this context is whether the processing would not be possible without both parties’ participation in the purposes and means in the sense that the processing by each party is inseparable, i.e. inextricably linked. The situation of joint controllers acting on the basis of converging decisions should however be distinguished from the case of a processor, since the latter – while participating in the performance of a processing – does not process the data for its own purposes but carries out the processing on behalf of the controller. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), pp. 19-20 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> In practice, it very much depends on the specific case. As the EDPB clarified, joint controllership exists with regard to a specific processing activity (only) when different parties determine jointly the purpose and means of this processing activity. Therefore, "''assessing the existence of joint controllers requires examining whether the determination of purposes and means that characterize a controller are decided by more than one party''."<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>


[[Article 26 GDPR#%20ftnref6|[6]]] Van Alsenoy 2012, pg. 24
For instance, the absence of access to the personal data being processed by one of the parties was not considered enough to exclude joint controllership.<ref>In the case of Jehovah's Witnesses, the CJEU determined that a religious community, along with its members engaged in preaching, should be considered joint controllers for the processing of personal data conducted by the members during door-to-door preaching. The CJEU concluded that it was not necessary for the community to have access to the specific data or to provide written guidelines or instructions to its members regarding the data processing. See, CJEU, C‑25/17, Jehovan todistajat, 10.7.2018 (available [[CJEU - C‑25/17 - Jehovan todistajat|here]]).</ref> The use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 21 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> Jointly determining the purposes and means of processing does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time.<ref>The CJEU clarified in its Fashion ID decision that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing. See, CJEU, Case C-40/17, ''Fashion ID'', 29 July 2019 (available [https://curia.europa.eu/juris/liste.jsf?num=C-40/17 here]).</ref> Furthermore, there are scenarios where different actors sequentially process the same personal data in a chain of operations. Each of these actors has an autonomous purpose and independent means within their respective part of the chain. If there is no joint participation in determining the purposes and means of the same processing operation or set of operations, joint controllership must be ruled out. In such cases, the various actors should be considered successive independent controllers.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 25 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>


[[Article 26 GDPR#%20ftnref7|[7]]] Article 29 Working Party (A29WP), Opinion 1/2010 on the concepts of "controller" and "processor", February 2010, pg. 21. < <nowiki>https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2010/wp169_en.pdf</nowiki>>  
Hence, collaboration between two controllers will not always result in joint controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers. For example, the exchange of the same data or set of data between two entities without jointly determined purposes or jointly determined means of processing should be considered as a transmission of data between separate controllers. Joint controllership "''may also be excluded in a situation where several entities use a shared database or a common infrastructure, if each entity independently determines its own purposes''."<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 24 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref><blockquote><u>Example</u>: A group of companies uses the same database for the management of clients and prospects. Such database is hosted on the servers of the mother company who is therefore a processor of the companies with respect to the storage of the data. Each entity of the group enters the data of its own clients and prospects and processes such data for its own purposes only. Also, each entity decides independently on the access, the retention periods, the correction or deletion of their clients and prospects’ data. They cannot access or use each other’s data. The mere fact that these companies use a shared group database does not as such entail joint controllership. Under these circumstances, each company is thus a separate controller.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 24 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> </blockquote>


[[Article 26 GDPR#%20ftnref8|[8]]] Fashion ID, C‑40/17, ECLI:EU:C:2019:629
===== Factors excluding joint controllership =====
The EDPB has elaborated a list of factors that may help controllers ruling out a joint controllership scenario.<ref>Determining whether a situation falls under joint controllership or not is not always a straightforward task. In addition to the information provided in this commentary, we recommend readers to consult the flowchart presented on pages 49-51 of the EDPB's ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]). The flowchart provides further visual guidance and clarification on the topic.</ref> In the Board's own words, there is not joint controllership but rather a "normal" independent controller when:


[[Article 26 GDPR#%20ftnref9|[9]]] Hahn I, The Fashion ID judgment and its impact on the rights of data subjects, September 2019,  
* You obtain a benefit from, or have an interest in, the processing (other than the mere payment for services received from another controller);<ref>The EDPB highlights that "''the mere existence of a mutual benefit (for ex. commercial) arising from a processing activity does not give rise to joint controllership. If the entity involved in the processing does not pursue any purpose(s) of its own in relation to the processing activity, but is merely being paid for services rendered, it is acting as a processor rather than as a joint controller''." EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 21 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>
* You make decisions about the individuals concerned as part of or as a result of the processing (e.g. the data subjects are your employees);
* The processing activities can be considered as naturally attached to the role or activities of your entity (e.g. due to traditional roles or professional expertise) which entails responsibilities from a data protection point of view;
* The processing refers to your relation with the data subjects as employees, customers, members etc.;
* You have complete autonomy in deciding how the personal data is processed;
* You have entrusted the processing of personal data to an external organisation to process the personal data on your behalf.


< <nowiki>https://medium.com/personaldata-io/fashion-id-and-rights-of-data-subjects-60d02ffca17d</nowiki>>
On the other side, the EDPB also mentions indicators whose occurrence generally excludes joint controllership because they are typical of the processor under Article 28 GDPR. Such factors occur when:


[[Article 26 GDPR#%20ftnref10|[10]]] Fashion ID, para. 85. 
* You process the personal data for another party’s purposes and in accordance with its documented instructions;
* You do not have a purpose of your own for the processing;
* Another party monitors your processing activities in order to ensure that you comply with instructions and terms of contract;
* You do not pursue your own purpose in the processing other than your own business interest to provide services;
* You have been engaged for carrying out specific processing activities by someone who in turn has been engaged to process data on another party’s behalf and on this party’s documented instructions (you are a sub-processor).


[[Article 26 GDPR#%20ftnref11|[11]]] Hahn I, The Fashion ID judgment and its impact on the rights of data subjects.
==== Determine their respective responsibilities ====
According to Article 26(1) of the GDPR, joint controllers are required to determine and agree on their respective responsibilities for fulfilling the obligations set forth in the Regulation. This process should be transparent, ensuring that it is clear and explicit which tasks each joint controller is responsible for regarding the specific joint processing activity. The purpose of this provision is to ensure that, in situations where multiple actors are involved, responsibility for GDPR compliance is clearly allocated. To achieve this, the EDPB clarifies that responsibilities should be assigned taking into account the contractual party's proximity to the specific processing. In other words, once again, the factual circumstances help determine who should be responsible for what.<ref>More precisely: "''Joint controllers can have a certain degree of flexibility in distributing and allocating obligations among them as long as they ensure full compliance with the GDPR with respect of the given processing. The allocation should take into account factors such as, who is competent and in a position to effectively ensure data subject’s rights as well as to comply with the relevant obligations under the GDPR. The EDPB recommends documenting the relevant factors and the internal analysis carried out in order to allocate the different obligations. This analysis is part of the documentation under the accountability principle.''" See, EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 45 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref><blockquote><u>Example</u>: XXX</blockquote>The aim of the agreement between the parties, as mentioned, is to ensure compliance with the GDPR. In this regard, the second part of Article 26(1) highlights the importance of paying particular attention to the exercise of data subject rights and the information obligations outlined in Articles 13 and 14 of the GDPR. This makes sense because, in cases involving multiple controllers, these two aspects of compliance (rights and transparency) can be impacted due to potential interactions between the parties. Nevertheless, the inclusion of the phrase "i''n particular''" suggests that the obligations related to the allocation of compliance responsibilities among the involved parties, as mentioned in this provision, are not exhaustive. Therefore, it can be inferred that the distribution of compliance responsibilities among joint controllers is not confined to the specific topics mentioned in Article 26(1), but also encompasses other obligations of controllers under the GDPR. <blockquote><u>EDPB</u>: This extends to various obligations under the GDPR, including but not limited to the implementation of general data protection principles (Article 5), determination of the legal basis for processing (Article 6), implementation of security measures (Article 32), notification of personal data breaches to the supervisory authority and data subjects (Articles 33 and 34), conducting Data Protection Impact Assessments (Articles 35 and 36), engaging a processor (Article 28), ensuring compliance with data transfer requirements for third countries (Chapter V), and organizing communication with data subjects and supervisory authorities. An additional instance is the obligation for each joint controller to maintain a record of processing activities or appoint a Data Protection Officer (DPO) if the conditions outlined in Article 37(1) are met. These requirements are not specifically tied to the joint processing activity but are applicable to each controller individually.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), pp. 44-46 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_enhttps://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref></blockquote>


[[Article 26 GDPR#%20ftnref12|[12]]] Judgment in Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, paragraph 34.
==== By means of an arrangement ====
The form of the agreement is not prescribed, and the parties are generally free to decide on it. However, this document defines their responsibilities, so a written or another form ensuring clarity on the agreement's points seems appropriate.<ref>"[F]''or the sake of legal certainty, even if there is no legal requirement in the GDPR for a contract or other legal act, the EDPB recommends that such arrangement be made in the form of a binding document such as a contract or other legal binding act under EU or Member State law to which the controllers are subject''". See, EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 46 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref> This form also facilitates the controller's task of demonstrating compliance with the GDPR. The agreement should be able to describe the "''respective responsibilities''" in a "''transparent manner''" meaning it should be written in clear and straightforward language. Additionally, to provide a better framework for the allocation of responsibilities between the parties, the EDPB recommends that the arrangement also includes general information about the joint processing. This can include specifying the subject matter and purpose of the processing, the type of personal data involved, and the categories of data subjects.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 46 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>


[[Article 26 GDPR#%20ftnref13|[13]]] Judgment in Wirtschaftsakademie, C-210/16, ECLI:EU:C:2018:388, paragraph 39.
==== Which may designate a contact point for the data subjects ====
Providing data subjects with a single point of contact for multiple joint controllers serves two important purposes. Firstly, it enables data subjects to know whom to approach for any matters related to the processing of their personal data. Secondly, it allows the joint controllers to coordinate their interactions and communications with data subjects more efficiently. In order to facilitate the exercise of data subjects' rights as per the GDPR, the EDPB recommends that joint controllers designate a contact point for this purpose. This contact point can be the Data Protection Officer (DPO), if available, the representative in the Union (for joint controllers not established in the Union), or any other designated contact point where relevant information can be obtained.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref>


[[Article 26 GDPR#%20ftnref14|[14]]] EDPB, Guidelines 07/2020, pg. 20.  
==== Unless Union or Member State law applies ====
Article 26 GDPR requires the joint controllers have an arrangement that clearly allocates the roles of each party. This is not an absolute rule. Where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary.<ref>''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 26 GDPR, p. 587 (Oxford University Press 2020).</ref>


[[Article 26 GDPR#%20ftnref15|[15]]] Kuner C, The EU General Data Protection Regulation (GDPR): A Commentary, Oxford University Press 2020, pg. 587.
=== (2) Joint controllership arrangement ===
Joint controllers must clarify their respective roles in the arrangement, particularly concerning the exercise of data subject rights and their obligations to provide information as outlined in Articles 13 and 14 of the GDPR (see above). Article 26(2) of the GDPR emphasizes the significance of these specific obligations.  


[[Article 26 GDPR#%20ftnref16|[16]]] Ibid.
==== Duly reflect respective roles and relationships vis-à-vis the data subject ====
Joint controllers must establish how and by whom the required information will be provided to data subjects and how and by whom responses to data subject requests will be handled. The organization of these obligations in the arrangement should accurately reflect the reality of the joint processing. For instance, if only one of the joint controllers is responsible for communicating with data subjects regarding the joint processing, that controller may be better positioned to inform data subjects and address their requests effectively.


[[Article 26 GDPR#%20ftnref17|[17]]] EDPB, Guidelines 07/2020, pg. 42.
==== Essence of the arrangement ====
The "''essence''" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. What should be covered by the notion of “essence of the arrangement” is not specified by the GDPR.<blockquote><u>EDPB</u>: The EDPB recommends that the essence cover at least all the elements of the information referred to in Articles 13 and 14 that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements. Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref></blockquote>The GDPR does not specify how the information regarding the joint arrangement should be made available to the data subject. Unlike other provisions such as Article 30(4) for the record of processing or Article 40(11) for the register of approved codes of conduct, Article 26 does not explicitly require the information to be made available "upon request" or "publicly available by way of appropriate means". As a result, it is the responsibility of the joint controllers to determine the most effective approach for providing the essence of the arrangement to data subjects.<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en here]).</ref><blockquote><u>Example</u>: This can be done, for example, by including it alongside the information outlined in Article 13 or 14, within the privacy policy, or upon request to the designated data protection officer or contact point, if applicable. It is important for the joint controllers to ensure that the information is consistently provided in a coherent manner.</blockquote>


[[Article 26 GDPR#%20ftnref18|[18]]] Ibid.  
=== (3) Effects on the rights of data subjects ===
It should be noted that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "''in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA''".<ref>EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 48 (available [https://edpb.europa.eu/system/files/2021-07/eppb_guidelines_202007_controllerprocessor_final_en.pdf here]).
</ref>


One consequence of this approach is that the liability of a controller will be restricted to the processing of the personal data for which it “''actually determines the purposes and means of processing''”. This implies, ''prima facie'', that a data subject cannot hold a controller to account for data processing beyond that which it is involved with. This means that the responsibility of each controller is limited to the set of operations it carries out. The EDPB suggests that joint controllership is related to a specific processing operation. In other words, joint controllership can exist in relation to a specific activity, such as marketing, while the controllers remain independent for all other "shared" processing activities.
==Decisions==
==Decisions==
→ You can find all related decisions in [[:Category:Article 26 GDPR]]
→ You can find all related decisions in [[:Category:Article 26 GDPR]]

Latest revision as of 12:49, 24 May 2023

Article 26 - Joint controllers
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 26 - Joint controllers

1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

2. The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

3. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

Relevant Recitals

Recital 58: Modalities for Transparent Information Provision
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.

Recital 79: Clear Allocation of Responsibilities
The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

Commentary

Article 26 GDPR goes a substantial way towards empowering data subjects by requiring transparency and accountability where multiple controllers jointly engage in processing operations. In particular, it requires joint-controllers to determine and allocate their respective responsibilities for the processing by means of an arrangement. Data subjects should be informed of the essence of this arrangement to strengthen their understanding of the processing and facilitate the exercise of their rights against each controller.

(1) Joint controllership

Under Article 26(1) GDPR, joint controllership takes place when two or more controllers "jointly determine the purposes and means of processing". Joint controllership does not arise in all cases of processing involving multiple entities. The key factor for determining joint controllership is the collective involvement of two or more entities in deciding both the purposes and means of processing.[1] If all entities involved have a say in both of these aspects, they should be regarded as joint controllers for that particular processing activity.[2]

Jointly determine purposes and means of processing

The term “jointly” must be interpreted as meaning “together with” or “not alone”. In other words, attention must be paid to whether multiple entities act in a joint manner. This assessment of joint participation should be based on a factual, rather than formal basis.[3]

EDPB: In particular, it is necessary to look at which controllers exercise decisive influence over when and how the processing takes place. Typically, two controllers will be held to be “jointly” controlling where they together determine the purposes and means of processing.[4]

There are various ways in which joint participation can occur. For instance, it can manifest as a "common decision"[5] made by multiple entities or arise from "converging decisions", which occur when controllers take decisions that complement one another separately.[6] In practice, it very much depends on the specific case. As the EDPB clarified, joint controllership exists with regard to a specific processing activity (only) when different parties determine jointly the purpose and means of this processing activity. Therefore, "assessing the existence of joint controllers requires examining whether the determination of purposes and means that characterize a controller are decided by more than one party."[7]

For instance, the absence of access to the personal data being processed by one of the parties was not considered enough to exclude joint controllership.[8] The use of joint infrastructure or a common data processing system will not automatically result in joint controllership, especially in instances where the processing is carried out separately and the operations of the parties do not necessarily overlap.[9] Jointly determining the purposes and means of processing does not necessarily mean that two controllers must have the same purpose for the processing. Joint controllers are also not required to exert influence over the purposes and means of processing at the same point in time.[10] Furthermore, there are scenarios where different actors sequentially process the same personal data in a chain of operations. Each of these actors has an autonomous purpose and independent means within their respective part of the chain. If there is no joint participation in determining the purposes and means of the same processing operation or set of operations, joint controllership must be ruled out. In such cases, the various actors should be considered successive independent controllers.[11]

Hence, collaboration between two controllers will not always result in joint controllership. In instances where controllers process data independently of each other and for their own purposes, they will not be held to be joint controllers. For example, the exchange of the same data or set of data between two entities without jointly determined purposes or jointly determined means of processing should be considered as a transmission of data between separate controllers. Joint controllership "may also be excluded in a situation where several entities use a shared database or a common infrastructure, if each entity independently determines its own purposes."[12]

Example: A group of companies uses the same database for the management of clients and prospects. Such database is hosted on the servers of the mother company who is therefore a processor of the companies with respect to the storage of the data. Each entity of the group enters the data of its own clients and prospects and processes such data for its own purposes only. Also, each entity decides independently on the access, the retention periods, the correction or deletion of their clients and prospects’ data. They cannot access or use each other’s data. The mere fact that these companies use a shared group database does not as such entail joint controllership. Under these circumstances, each company is thus a separate controller.[13]

Factors excluding joint controllership

The EDPB has elaborated a list of factors that may help controllers ruling out a joint controllership scenario.[14] In the Board's own words, there is not joint controllership but rather a "normal" independent controller when:

  • You obtain a benefit from, or have an interest in, the processing (other than the mere payment for services received from another controller);[15]
  • You make decisions about the individuals concerned as part of or as a result of the processing (e.g. the data subjects are your employees);
  • The processing activities can be considered as naturally attached to the role or activities of your entity (e.g. due to traditional roles or professional expertise) which entails responsibilities from a data protection point of view;
  • The processing refers to your relation with the data subjects as employees, customers, members etc.;
  • You have complete autonomy in deciding how the personal data is processed;
  • You have entrusted the processing of personal data to an external organisation to process the personal data on your behalf.

On the other side, the EDPB also mentions indicators whose occurrence generally excludes joint controllership because they are typical of the processor under Article 28 GDPR. Such factors occur when:

  • You process the personal data for another party’s purposes and in accordance with its documented instructions;
  • You do not have a purpose of your own for the processing;
  • Another party monitors your processing activities in order to ensure that you comply with instructions and terms of contract;
  • You do not pursue your own purpose in the processing other than your own business interest to provide services;
  • You have been engaged for carrying out specific processing activities by someone who in turn has been engaged to process data on another party’s behalf and on this party’s documented instructions (you are a sub-processor).

Determine their respective responsibilities

According to Article 26(1) of the GDPR, joint controllers are required to determine and agree on their respective responsibilities for fulfilling the obligations set forth in the Regulation. This process should be transparent, ensuring that it is clear and explicit which tasks each joint controller is responsible for regarding the specific joint processing activity. The purpose of this provision is to ensure that, in situations where multiple actors are involved, responsibility for GDPR compliance is clearly allocated. To achieve this, the EDPB clarifies that responsibilities should be assigned taking into account the contractual party's proximity to the specific processing. In other words, once again, the factual circumstances help determine who should be responsible for what.[16]

Example: XXX

The aim of the agreement between the parties, as mentioned, is to ensure compliance with the GDPR. In this regard, the second part of Article 26(1) highlights the importance of paying particular attention to the exercise of data subject rights and the information obligations outlined in Articles 13 and 14 of the GDPR. This makes sense because, in cases involving multiple controllers, these two aspects of compliance (rights and transparency) can be impacted due to potential interactions between the parties. Nevertheless, the inclusion of the phrase "in particular" suggests that the obligations related to the allocation of compliance responsibilities among the involved parties, as mentioned in this provision, are not exhaustive. Therefore, it can be inferred that the distribution of compliance responsibilities among joint controllers is not confined to the specific topics mentioned in Article 26(1), but also encompasses other obligations of controllers under the GDPR.

EDPB: This extends to various obligations under the GDPR, including but not limited to the implementation of general data protection principles (Article 5), determination of the legal basis for processing (Article 6), implementation of security measures (Article 32), notification of personal data breaches to the supervisory authority and data subjects (Articles 33 and 34), conducting Data Protection Impact Assessments (Articles 35 and 36), engaging a processor (Article 28), ensuring compliance with data transfer requirements for third countries (Chapter V), and organizing communication with data subjects and supervisory authorities. An additional instance is the obligation for each joint controller to maintain a record of processing activities or appoint a Data Protection Officer (DPO) if the conditions outlined in Article 37(1) are met. These requirements are not specifically tied to the joint processing activity but are applicable to each controller individually.[17]

By means of an arrangement

The form of the agreement is not prescribed, and the parties are generally free to decide on it. However, this document defines their responsibilities, so a written or another form ensuring clarity on the agreement's points seems appropriate.[18] This form also facilitates the controller's task of demonstrating compliance with the GDPR. The agreement should be able to describe the "respective responsibilities" in a "transparent manner" meaning it should be written in clear and straightforward language. Additionally, to provide a better framework for the allocation of responsibilities between the parties, the EDPB recommends that the arrangement also includes general information about the joint processing. This can include specifying the subject matter and purpose of the processing, the type of personal data involved, and the categories of data subjects.[19]

Which may designate a contact point for the data subjects

Providing data subjects with a single point of contact for multiple joint controllers serves two important purposes. Firstly, it enables data subjects to know whom to approach for any matters related to the processing of their personal data. Secondly, it allows the joint controllers to coordinate their interactions and communications with data subjects more efficiently. In order to facilitate the exercise of data subjects' rights as per the GDPR, the EDPB recommends that joint controllers designate a contact point for this purpose. This contact point can be the Data Protection Officer (DPO), if available, the representative in the Union (for joint controllers not established in the Union), or any other designated contact point where relevant information can be obtained.[20]

Unless Union or Member State law applies

Article 26 GDPR requires the joint controllers have an arrangement that clearly allocates the roles of each party. This is not an absolute rule. Where the responsibilities of the controller are determined by Union or Member State law, an arrangement between the controllers is not necessary.[21]

(2) Joint controllership arrangement

Joint controllers must clarify their respective roles in the arrangement, particularly concerning the exercise of data subject rights and their obligations to provide information as outlined in Articles 13 and 14 of the GDPR (see above). Article 26(2) of the GDPR emphasizes the significance of these specific obligations.

Duly reflect respective roles and relationships vis-à-vis the data subject

Joint controllers must establish how and by whom the required information will be provided to data subjects and how and by whom responses to data subject requests will be handled. The organization of these obligations in the arrangement should accurately reflect the reality of the joint processing. For instance, if only one of the joint controllers is responsible for communicating with data subjects regarding the joint processing, that controller may be better positioned to inform data subjects and address their requests effectively.

Essence of the arrangement

The "essence" of the arrangement should be made available to the data subject, in order to provide transparency on processing operations. What should be covered by the notion of “essence of the arrangement” is not specified by the GDPR.

EDPB: The EDPB recommends that the essence cover at least all the elements of the information referred to in Articles 13 and 14 that should already be accessible to the data subject, and for each of these elements, the arrangement should specify which joint controller is responsible for ensuring compliance with these elements. Moreover, the data subject should be able to understand which data controller serves as a point of contact for the exercise of their data subject rights.[22]

The GDPR does not specify how the information regarding the joint arrangement should be made available to the data subject. Unlike other provisions such as Article 30(4) for the record of processing or Article 40(11) for the register of approved codes of conduct, Article 26 does not explicitly require the information to be made available "upon request" or "publicly available by way of appropriate means". As a result, it is the responsibility of the joint controllers to determine the most effective approach for providing the essence of the arrangement to data subjects.[23]

Example: This can be done, for example, by including it alongside the information outlined in Article 13 or 14, within the privacy policy, or upon request to the designated data protection officer or contact point, if applicable. It is important for the joint controllers to ensure that the information is consistently provided in a coherent manner.

(3) Effects on the rights of data subjects

It should be noted that under Article 26(3) GDPR, a data subject is not bound by the terms of the joint controllers’ arrangement, and may actually exercise their rights against each of the joint data controllers. This allows for further empowerment of the data subject. For example, "in case of joint controllers established in different Member States, or if only one of the joint controllers is established in the Union, the data subject may contact, at his or her choice, either the controller established in the Member State of his or her habitual residence or place of work, or the controller established elsewhere in the EU or in the EEA".[24]

One consequence of this approach is that the liability of a controller will be restricted to the processing of the personal data for which it “actually determines the purposes and means of processing”. This implies, prima facie, that a data subject cannot hold a controller to account for data processing beyond that which it is involved with. This means that the responsibility of each controller is limited to the set of operations it carries out. The EDPB suggests that joint controllership is related to a specific processing operation. In other words, joint controllership can exist in relation to a specific activity, such as marketing, while the controllers remain independent for all other "shared" processing activities.

Decisions

→ You can find all related decisions in Category:Article 26 GDPR

References

  1. Petri, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 26 GDPR, margin number 12 (C.H. Beck 2019).
  2. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available here).
  3. A purely formal criterion would not be adequate for two main reasons. Firstly, there are situations where the formal appointment of a joint controller, mandated by law or contract, may be missing. Secondly, there are cases where the formal appointment does not accurately reflect the actual arrangements, as it may assign the role of controller to an entity that does not have the authority to "determine" the purposes and means of the processing. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available here).
  4. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available here).
  5. The EDPB, in the cited guidelines: "Joint participation through a common decision means deciding together and involves a common intention in accordance with the most common understanding of the term “jointly” referred to in Article 26 of the GDPR."
  6. An important criterion to identify converging decisions in this context is whether the processing would not be possible without both parties’ participation in the purposes and means in the sense that the processing by each party is inseparable, i.e. inextricably linked. The situation of joint controllers acting on the basis of converging decisions should however be distinguished from the case of a processor, since the latter – while participating in the performance of a processing – does not process the data for its own purposes but carries out the processing on behalf of the controller. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), pp. 19-20 (available here).
  7. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available here).
  8. In the case of Jehovah's Witnesses, the CJEU determined that a religious community, along with its members engaged in preaching, should be considered joint controllers for the processing of personal data conducted by the members during door-to-door preaching. The CJEU concluded that it was not necessary for the community to have access to the specific data or to provide written guidelines or instructions to its members regarding the data processing. See, CJEU, C‑25/17, Jehovan todistajat, 10.7.2018 (available here).
  9. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 21 (available here).
  10. The CJEU clarified in its Fashion ID decision that an entity will be considered as a joint controller only with respect to the operations for which it determines, together with others, the purposes and means of processing. See, CJEU, Case C-40/17, Fashion ID, 29 July 2019 (available here).
  11. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 25 (available here).
  12. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 24 (available here).
  13. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 24 (available here).
  14. Determining whether a situation falls under joint controllership or not is not always a straightforward task. In addition to the information provided in this commentary, we recommend readers to consult the flowchart presented on pages 49-51 of the EDPB's ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 19 (available here). The flowchart provides further visual guidance and clarification on the topic.
  15. The EDPB highlights that "the mere existence of a mutual benefit (for ex. commercial) arising from a processing activity does not give rise to joint controllership. If the entity involved in the processing does not pursue any purpose(s) of its own in relation to the processing activity, but is merely being paid for services rendered, it is acting as a processor rather than as a joint controller." EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 21 (available here).
  16. More precisely: "Joint controllers can have a certain degree of flexibility in distributing and allocating obligations among them as long as they ensure full compliance with the GDPR with respect of the given processing. The allocation should take into account factors such as, who is competent and in a position to effectively ensure data subject’s rights as well as to comply with the relevant obligations under the GDPR. The EDPB recommends documenting the relevant factors and the internal analysis carried out in order to allocate the different obligations. This analysis is part of the documentation under the accountability principle." See, EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 45 (available here).
  17. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), pp. 44-46 (available here).
  18. "[F]or the sake of legal certainty, even if there is no legal requirement in the GDPR for a contract or other legal act, the EDPB recommends that such arrangement be made in the form of a binding document such as a contract or other legal binding act under EU or Member State law to which the controllers are subject". See, EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.0), p. 46 (available here).
  19. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 46 (available here).
  20. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available here).
  21. Millard, Kamarinou, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 26 GDPR, p. 587 (Oxford University Press 2020).
  22. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available here).
  23. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 47 (available here).
  24. EDPB, ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’, 07 July 2021 (Version 2.1), p. 48 (available here).