YTYK You think you know

Card 5 of 18 Controller and processor ●●● Sharp edge

Joint control starts earlier than you think

Two parties are joint controllers when they jointly determine purposes and means. That does not require equal involvement, access to the data, or a shared system — the CJEU has found joint control where one party merely embedded the other's tool.

Why it is like this

The court was closing an accountability gap: if only the party running the servers counted, the party choosing to collect could always point elsewhere.

Not to be confused with

Shared liability in equal parts. Joint controllers must agree in a transparent arrangement who does what, but the data subject may exercise their rights against either of them regardless of that arrangement.

In practice

A site operator adding a social plugin was held a joint controller for the collection and transmission, though not for what the platform did afterwards (Fashion ID).

Source: Regulation (EU) 2016/679 (GDPR) — Article 26. Read on .

Predict Check yourself

Joint controllers sign an arrangement allocating all rights handling to party A. A data subject sends an erasure request to party B. What must B do?

  1. Handle it — the arrangement binds the two parties, not the data subject, who may act against either.
  2. Forward it to A and consider its own duty discharged.
  3. Reject it, since A is the designated point of contact.
  4. Handle it only if it holds the data itself.
Show the answer

Handle it — the arrangement binds the two parties, not the data subject, who may act against either.

Article 26(3) is explicit: the data subject may exercise their rights against each controller, irrespective of the terms of the arrangement.