Joint Controllers under GDPR
Article 26 addresses situations where two or more controllers jointly determine the purposes and means of processing. This creates a joint controller relationship with specific obligations.
When are Organizations Joint Controllers?
Organizations are joint controllers when they:
- Jointly determine the purposes of processing (why the processing takes place)
- Jointly determine the means of processing (how the processing takes place)
The Court of Justice of the European Union (CJEU) has clarified that:
- Joint control doesn't require equal responsibility
- Controllers may be involved in different stages of processing
- Shared or converging purposes can indicate joint control
Examples of Joint Controller Relationships
- Multiple companies operating a shared website
- Companies sharing customer databases for marketing
- Businesses using third-party plugins that collect data (e.g., Facebook Like button)
- Research collaborations where institutions jointly determine research methodology
Joint Controller Agreement
Article 26 requires joint controllers to determine, in a transparent manner through an arrangement between them:
- Their respective responsibilities for compliance with GDPR
- Particularly regarding:
- Exercising data subject rights
- Providing information to data subjects (Articles 13-14)
- The essence of the arrangement must be made available to data subjects
Key Elements of the Agreement
The joint controller agreement should specify:
- Who is the contact point for data subjects
- Who responds to data subject requests (or how responsibility is divided)
- Who provides privacy notices
- How data breaches are handled
- Security responsibilities
- How controllers will cooperate
Liability
Article 26(3) states that:
- Data subjects can exercise their rights against each joint controller
- Each controller is liable for the entire damage (joint and several liability)
- Controllers may seek compensation from other controllers for their share of liability
Transparency Requirements
The essence of the joint controller arrangement must be made available to data subjects. This should include:
- Who the joint controllers are
- How to contact each controller
- The respective roles and responsibilities
- How individuals can exercise their rights
Relationship with Processors
Joint controllers should be distinguished from:
- Controllers and processors: Where one party determines purposes and means (controller) and another processes on their behalf (processor)
- Separate controllers: Where organizations process data for different purposes independently