The Privacy and Data Protection Journal has published an article
by Duc Tran (Senior Associate) and Laura Adde (Associate) of our
Digital TMT, Sourcing & Data and Cyber Security teams. The
article examines the concept of "joint controllership" in
light of recent case law and existing legislative guidance. Please
click here to access the full article for further
details.
Since the General Data Protection Regulation
("GDPR") has been in effect,
organisations have tended to characterise their data relationships
with other parties as either controller-processor, or independent
controller-controller, avoiding the joint controller
construct.
Article 26 of the GDPR states "where two or more
controllers jointly determine the purposes and means of processing,
they shall be joint controllers". Market practice to date
has seen organisations interpreting this contract in a relatively
narrow fashion. However, recent judgement by the Court of Justice
of the EU ("CJEU") in the
