Who is responsible – and who merely carries out
Controller, processor, joint controllers: three roles that decide who is liable, who has to answer requests, and which contract is needed. The classification follows the facts, not the agreement.
The classification turns on a single question: who decides the purposes and means of the processing? Whoever does is the controller – regardless of who runs the technology, who owns the servers, or what the contract says.
Who decides what
Joint controllership arises faster than expected
The Court of Justice has read the term broadly. For joint controllership it is enough to decide the purposes together – full equality is not required, and neither is access to the data.
The best-known ruling concerned a fan page on a social network: running such a page enables the collection of data and helps set the purpose through the choice of audience criteria. That was enough for the court to find joint controllership.
What each role brings with it
- ControllerNeeds a legal basis, informs, answers requests, reports breaches, is liable externally.
- Joint controllersNeed an arrangement dividing the duties. Its essence has to be made available to data subjects.
- ProcessorNeeds no legal basis of its own, but a contract under Article 28 – and may act only on instructions.
What this means for an ordinary website
- The hosting provider is a processor. An Article 28 contract is needed; a legal basis of its own is not.
- An analytics service can be either. What decides it is whether it also uses the data for itself.
- An embedded advertising network regularly leads to joint controllership for the act of collection.