Shared decisions about data.
WHAT MAKES PARTIES JOINT CONTROLLERS
They jointly determine the purposes and means.
WHERE IT ARISES
Joint marketing campaigns Shared platforms Research collaborations Social media pages, in some interpretations Group companies sharing systems
WHY THAT LAST POINT SURPRISES PEOPLE
Companies in one group are separate controllers unless arrangements say otherwise.
WHAT IS REQUIRED
An arrangement setting out respective responsibilities.
WHAT IT SHOULD COVER
Who provides information to individuals Who handles rights requests Who is responsible for security Who notifies breaches A contact point
WHAT INDIVIDUALS ARE ENTITLED TO
The essence of that arrangement.
WHY
They need to know who to approach.
WHAT INDIVIDUALS CAN DO REGARDLESS
Exercise rights against either party.
WHY THAT MATTERS
You cannot deflect a request by pointing at the other party.
WHAT TO DO ON RECEIVING ONE
Handle it, or ensure the other does, within the deadline.
WHAT TO AVOID
Assuming a contract labelling someone a processor settles it.
WHY
The actual decision-making determines the role.
WHAT TO ASSESS
Who genuinely decides what.
WHAT TO DOCUMENT
The analysis, and the arrangement.
