Artikkel 26
Joint controllers

Offisielle tekster Retningslinjer
og beslutninger
Vurderinger
EU-regulering
Vurderinger
nasj. regulering
Vis forordningens fortaletekst relatert til art. 26 keyboard_arrow_down Skjul forordningens fortaletekst relatert til art. 26 keyboard_arrow_up

(79) The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

Det finnes ingen fortaletekst i direktivet relatert til art. 26.

GDPR

Article 26 of the Regulation provides a specific legal regime in relation to joint controllers.

First, the article clarifies - by repeating what was already provided for in the controller definition (see Article 4 (7)) - the conditions for the application of this qualification:  joint controllers are where two or more controllers jointly determine the purposes and means of processing (see G29, opinion of 16 February 2010 on the terms of “controller” and “processor”, p. 19 et seq.).

These joint controllers must enter into an arrangement to determine in a transparent manner their respective responsibilities and roles in the performance of the obligations imposed in application of the Regulation (such as the allocation of tasks in the case of the exercise by the data subjects of the rights provided for by the Regulation) or also the provision of information under Articles 13 and 14). A single point of contact should be determined to enable facilitating the exercise of rights of the data subject (access, rectification, etc.).

The second paragraph specifies that the agreement shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. . An obligation of transparency is imposed to the controllers who have to inform the data subjects of the "basic lines" of their agreement, their respective roles and the relationship with them.

The joint controllers are however exempted from entering into such an arrangement if their respective obligations are defined by the law of the Union or by the law of the Member State to which the controllers are subject.

Of course, the data subject may exercise his or her rights in respect of and against each of the controllers, whatever the terms of the arrangement between them are.

Direktivet

The definitions of the controller allowed, as the Directive did, to qualify as "joint controllers" several people who jointly define the purposes and the means of the processing (see Article 2, d)) of the Directive.

Norway

Ingen tilsvarende bestemmelse.

Utfordringer

The Regulation will not give an answer to the identification of the existence of two or more joint controllers, which in practice is difficult, particularly with regard to the relations with certain technical processors. The boundary between the two concepts is, as we know, sometimes very tenuous (see the Swift case).

It also remains very vague as to the content of the arrangement between the joint controllers. This imprecision is most marked in the division of responsibilities between the controllers, which does not indicate how far they can go in this one.

Also, a question may arise whether a controller can completely waive its responsibility with regard to the other (being understood that he could not do so with regard to the data subject). The answer may depend on the liability regimes of national laws that can impose a more accurate allocation. In this regard, the provision takes into account only the assumption that the joint controllers are subject to the same national law, which in practice often will not be the case.

Forordning
1e 2e

Art. 26

1.   Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.

2.   The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

3.   Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

1. forslag close

Art. 24

Where a controller determines the purposes, conditions and means of the processing of personal data jointly with others, the joint controllers shall determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the procedures and mechanisms for exercising the rights of the data subject, by means of an arrangement between them.

2. forslag close

Art. 24

1. Where two or more controllers jointly determine the purposes and means of the processing of personal data, they are joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the (...) exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 14 and 14a, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement shall designate which of the joint controllers shall act as single point of contact for data subjects to exercise their rights.

2. Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the (...) controllers.

3. The arrangement shall duly reflect the joint controllers’ respective effective roles and relationships vis-à-vis data subjects, and the essence of the arrangement shall be made available for the data subject. Paragraph 2 does not apply where the data subject has been informed in a transparent and unequivocal manner which of the joint controllers is responsible, unless such arrangement other than one determined by Union or Member State law is unfair with regard to his or her rights (...)

.

 

Direktiv close

No specific provision

Art. 26

Felles behandlingsansvarlige

1. Dersom to eller flere behandlingsansvarlige i fellesskap fastsetter formålene med og midlene for behandlingen, skal de være felles behandlingsansvarlige. De skal på en åpen måte fastsette sitt respektive ansvar for å overholde forpliktelsene i denne forordning, særlig med hensyn til utøvelse av den registrertes rettigheter og den plikt de har til å framlegge informasjonen nevnt i artikkel 13 og 14, ved hjelp av en ordning seg imellom, med mindre og i den grad de behandlingsansvarliges respektive ansvar er fastsatt i unionsretten eller medlemsstatenes nasjonale rett som de behandlingsansvarlige er underlagt. I ordningen kan det utpekes et kontaktpunkt for registrerte.

2. Ordningen nevnt i nr. 1 skal på behørig måte gjenspeile de felles behandlingsansvarliges respektive roller og forhold til de registrerte. Det vesentligste innholdet i ordningen skal gjøres tilgjengelig for den registrerte.

3. Uavhengig av vilkårene for ordningen nevnt i nr. 1 kan den registrerte utøve sine rettigheter i henhold til denne forordning med hensyn til og overfor hver av de behandlingsansvarlige.

close