Is An App Builder A Data Controller And Is Fault Required For A GDPR Fine?

On 4 May 2023 Advocate General of the Court of Justice of the European Union Emiliou delivered an Opinion in the case C-683/21 Nacionalinis visuomenes sveikatos centras. In his Opinion, Advocate General discussed the concepts of controller, joint controller, and processor under the GDPR. In addition, he clarified the topic of the administrative fines' imposition for the GDPR infringement.

Introduction

During the coronavirus crisis, COVID-19 apps became popular. These apps allowed users to be notified when they had (potentially) been in contact with corona patients. Due to their nature, the COVID-19 apps encountered many (privacy) concerns. In Lithuania, the Ministry of Health had commissioned a party to develop a corona app after a public tender. Importantly, the Ministry decided not to buy the application in the end. Nevertheless, both the app builder and the Ministry were fined by the Lithuanian Data Protection Authority for violating several articles of the