Joint Controller

What is a joint controller?

A controller is the company that decides why and how personal data is used. The GDPR's Article 4(7) says a controller decides "alone or jointly with others". When two or more companies decide together, Article 26 makes them joint controllers.

The EDPB's guidelines on controllers and processors explain the test. Joint control needs joint participation in deciding both the purposes and the means. That can be one common decision, or separate decisions that complement each other, where the processing would not be possible without both parties.

Some points from the guidelines:

• Not equal: joint responsibility does not mean equal responsibility. Each party's share depends on how and when it is involved.
• No access needed: a party can be a joint controller without ever seeing the data.
• Only the shared part: companies are joint controllers only for the operations they decide together. Each is the sole controller of what it does alone before or after.
• More than mutual benefit: a vendor that is simply paid for a service and has no purpose of its own is a processor, not a joint controller.

Joint controllers also differ from independent controllers, who each use the same data for their own separate purposes. The EDPB's example is a travel agency that sends customer data to an airline and a hotel chain. They are three separate controllers, until they build a shared booking platform and run joint marketing together.

Where it shows up with vendors

The leading cases involve tools a company puts on its own site or page. In Fashion ID, decided in 2019, the EU Court of Justice held that a website that embedded Facebook's Like button can be a joint controller with Facebook for collecting visitors' data and sending it to Facebook. In Wirtschaftsakademie, decided in 2018, it held that the administrator of a Facebook fan page took part in deciding how visitors' data was processed.

The same question arises with a tracking pixel, a social plugin or an analytics tag when the vendor also uses what it collects for its own ads. If you place the code and the vendor pursues its own purposes with the data, you may share decisions about it.

What it looks like in a vendor's terms

Vendors put this in a joint controller addendum or a section of their business terms. A typical clause reads:

For the processing of Event Data collected through the Pixel, you and we are joint controllers under Article 26 of the GDPR. You are responsible for informing users and obtaining any required consent on your website. We are responsible for responding to data subject requests about the data we hold, and we are the point of contact for data subjects.

• "Joint controllers": both companies carry controller duties for that processing.
• "You are responsible for informing users and obtaining any required consent": the clause puts the notice and consent work on you, because you run the site.
• "We are responsible for responding": the vendor takes on requests about the data it holds.
• "Point of contact": Article 26(1) allows one. It does not stop people from coming to you.

Why it matters to you

The arrangement splits the work, not your exposure. Under Article 26(3), a person can exercise their rights against each joint controller, whatever the arrangement says. Under Article 82(4), where more than one controller is involved in the same processing and responsible for the damage, each can be held liable for the entire damage. The EDPB adds that regulators are not bound by the arrangement.

Article 26(2) also requires the essence of the arrangement to be made available to people, so your privacy policy may need to say who does what.

What to check

• Role labels: whether the vendor's terms call it a processor, an independent controller or a joint controller for each feature you use, especially ads, analytics and pixels.
• The arrangement: if joint, whether a written addendum says who gives notice, who collects consent and who answers requests. The EDPB recommends a binding document such as a contract.
• Your notice: whether your privacy policy names the vendor and the essence of the arrangement.
• Breach duties: whether the arrangement says who handles notice of a data breach, as the EDPB recommends.
• Changes: whether a new version of the vendor's terms moves it from processor to controller for some data.

How Venpo helps

A vendor's role can change through its documents: a new controller addendum, a rewritten DPA or a privacy policy that claims new uses of data collected on your site. Venpo watches your vendors' public legal documents and emails you a plain-English alert when one changes. The change history shows which role the vendor claimed, and when.