#13.1 Introduction
An organisation usually acts as a controller (using data for its own purposes) or a processor (a contractor that processes data for the controller’s purposes).
Article 26 GDPR acknowledges situations in which two organisations are joint controllers, i.e. use the data for shared purposes and jointly decide how the data will be processed.
#13.2 Examples of Situations in Which There Are Joint Controllers
Organisations might act as joint controllers in capital groups, where companies manage talent jointly (this might give rise to certain challenges in terms of employment law) or where they are practically unified despite being separate legal entities, sharing staff and processes, where a business operates through number of special purpose vehicles (e.g., developers setting up separate companies for separate projects (socalled SPVs from ‘special purpose vehicle’) but operating them through single headquarters); in a relationship between insurance agencies and insurance companies, in which an agent has its own customer/marketing database; where a number of organisations enter into a joint venture at least for the period before it becomes a capital company; and also in the case of bancassurance, i.e. when banks sell insurance products, in procurement procedures where two or more entities enter into a consortium to bid together.
In 2010, the Article 29 Working Party adopted an opinion on the subject of the terms ‘controller’ and ‘processor’, in which there were also examples of joint controller situations. The opinion is, however, questionable, and especially examples given may be qualified differently. An example of video surveillance of a building in which the owner of the building is the controller and the security firm is only the processor. If the security firm provides services for multiple organisations and its emergency response centre has a view of various premises, it might act either as a processor for a number of controllers or as a separate controller, if, for example, it uses personal data obtained from one customer to assist another customer, for example having at its disposal face recognition software.
Another example given by the Working Party is cooperation between a bank and a ‘financial messaging provider’ (something like a clearing chamber). The Article 29 Working Party stated that those entities are joint controllers with regard to the personal data in the messages (money transfers) which is not necessarily in line with regulations and views on outsourcing in the financial sector and on regulations on bank secrecy and other types of financial secrecy.
The opinion issued by the Article 29 Working Party also mentions a social networking site as an example of a situation in which the site operator and site user (except for ‘household’ use) are joint controllers. Caution is also advised with respect to this example. There are probably many people who would like to decide jointly, for example with Facebook, the purposes and means of data processing. For this reason, a company operating a fan page on Facebook, or even Maciej Gawronski, maintaining the profile of Gawron´ski & Partners S.K.A. on LinkedIn, are not joint controllers with Mark Zuckerberg (CEO of Facebook) or Satya Nadella (CEO of Microsoft). These are simply independent controllers to the extent made possible by social networking services, which in turn make use of data for their own purposes. Even in the case of social networking sites within a group, there are distinct controllers. This is because in reality, situations in which there are joint controllers are quite rare. They require a balance in bargaining power or co-dependency.
Parallel controlling. The European Court of Justice in a judgment in Case C-210/16 Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein vs. Wirtschaftsakademie Schleswig-Holstein GmbH pronounced that an operator of a Facebook fan page is a controller of personal data of users visiting that fan page. ECJ considers fan page operators as jointly responsible with Facebook (Ireland) for processing personal data of the personal data of Facebook users and persons visiting the fan pages hosted on Facebook. The judgment concerns a situation before 25 May 2018; therefore, it relates to the Data Protection Directive and not GDPR. In our opinion that judgment should not be interpreted under GDPR as ‘enforcing’ joint controllership between Facebook and every organisation operating a Facebook fan page. Facebook has different purposes and means of processing users and other fan page visitors data than an operator of a fan page. Calling their relation joint controlling is like claiming that riding on a bicycle alongside a tank is like co-controlling the road.
At the same time, under GDPR there is no need to search for joint controllership to find joint liability. First sentence of Article 82(2) GDPR states that: ‘any controller involved in processing shall be liable for the damage caused by processing which infringes’ GDPR. In the case of a fan page, both Facebook and a fan page operator are involved in processing, so they may be directly liable to a data subject. Each of them may be also fined by a supervisory body based on Article 83 GDPR.
Therefore we prefer to describe situations when two or more entities in a same situation/‘in the same data processing’ separately and differently profit of that processing for their own separate purposes as ‘parallel controlling’.
#13.3 Should You Avoid Being a Joint Controller?
Usually, for practical reasons, it is better not to classify relationships between two or more organisations as a situation in which there are joint controllers. It is better to seek separate areas in which some parties are controllers and others are processors. There are however exceptions from that rule.
When organisations share data but each of them wants to keep control over them – e.g., if an agent shares his contact base with a principal (e.g., an insurance company). Though, another option for such situation is just consider it a ‘parallel controlling’. In highly integrated capital groups joint controllership may be a better option for processing than multiplying information obligations and other procedures and duties required by GDPR. Sometimes joint controllership may result directly from the law, for example, if the law requires employee’s representatives in a supervisory board of a holding company to be chosen by employees of the whole group. An in-company social networking site in a capital group, where personnel can discuss a free range of subjects, is an interesting example. This can be classified both as a joint controller situation and mutual ‘controller-to-controller’ disclosure on the basis of legitimate interest.
#13.4 Joint Controller Obligations
Article 26(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC states that joint controllers [1] ‘jointly determine’[2] ‘in a transparent manner’, ‘their respective’ [3] ‘responsibilities for compliance with the obligations under this regulation’, [4] ‘in particular as regards the exercising of the rights of the data subject’.
#13.5 Joint Controller Agreement
This therefore means that an agreement has to be concluded and must be documented. Oral consultation to agree on the joint controller rules is not possible in light of the principle of accountability.
The joint controller agreement has to state how obligations are allocated and who is responsible for the notification of collection of data, who ensures execution of an individual’s rights, how the level of security is established, etc. Responsibility towards data subjects cannot be limited in the agreement, however, because each of the joint controllers can be held responsible without limitation (joint and several responsibility).
#13.6 Wording of the Agreement: Comparison with the Entrusting of Data
The GDPR does not state the specific wording of the joint controller agreement. In general, the requirements regarding the agreement between the controller and processor which are provided for in Article 28 GDPR may be referred to, taking into account that at least two joint decision-makers are parties to the agreement. These requirements include specifying the purpose, scope, and duration of the joint controller situation, the categories of the persons whose data are processed, and categories of data, the allocation of responsibility for the controller’s obligations, the fact that arrangements are reached in writing, non-disclosure obligations, arrangements reached regarding processors, arrangements reached regarding security, procedures for working together to ensure execution of an individual’s rights and to give notification of breach of personal data, arrangements reached regarding ending the joint controller situation, arrangements reached regarding recourse for responsibility and cooperation in the event of claims and inspection, the content of information about collection of data, and the scope and content of information as to the fundamental wording of the joint controller agreement to be disclosed to third parties, with information about the means of disclosure (as a rule at the moment of collection of data or moment of transfer of data between joint controllers).
#13.7 Disclosure to Data Subjects
The fundamental nature of the arrangements reached concerning a joint controller situation has to be disclosed to data subjects for which there are joint controllers. The GDPR does not directly state when this has to be done. In line with Article 13 and Article 14 GDPR, this should occur when data are obtained for joint controller purposes and when data are shared that were previously in the possession of one of the controllers.
#13.8 Cross-Border Joint Controller Situation
If processing in a joint controller situation is cross-border processing (i.e., it affects more than one country in the EEA (EU + Norway, Iceland, and Liechtenstein), the joint controller agreement should also state the lead joint controller (in order to designate the lead supervisory authority).
#13.9 Conclusions
A joint controller situation is similar to the joint management of a project or joint running of a company or a country. It gives rise in practice to a number of risks relating to transfer of responsibility. For this reason, these situations should be avoided unless it is really the case. At the same time, a joint controller situation could be a solution serving such needs as: to avoid forfeiting the right to a company’s own data while sharing them for business purposes (e.g., the relationship between an agent and insurance company), to limit formal duties and deduplicate procedures, to respond to requirements of law, when a group of companies truly operates as one operation, when you are setting up a number of SPV (special purpose vehicle) unstaffed companies.
In real life, there is usually some room for a decision whether a situation should be qualified as joint controlling, ‘parallel’ controlling or a mix of parallel controlling and data processing, as these things might be quite elusive.