Information on joint controllership pursuant to Article 26 (2) 2 of the General Data Protection Regulation (LfDI) In addition to shared responsibility, the RGPD primarily distinguishes order processing and individual responsibility. In addition, for German companies, the question also arises as to how they should in the future classify transfers of functions under the RGPD. The Legal Institute for the Transmission of Functions has consisted of the old German data protection legislation and has designated the outsourcing of certain data processing operations with a certain margin of decision of the recipient with regard to specific tasks. With the application of the RGPD, there is no longer a legal institute comparable to the transmission of functions. The German data protection authorities believe that a shared responsibility is not in itself an authorisation to process data. Each common manager therefore needs a legal basis of its own for the common treatment of personal data. In addition, joint managers are also recipients of data. Therefore, according to the DSK, the transfer of personal data between common managers is also a processing operation of its own which, as such, also requires a legal basis on a case-by-case basis. One of these possibilities is joint controllership.
This is a constellation provided for in Article 26 of the RGPD, which allows several companies to share and share their customer or other data. At the same time, the Institute of Common Responsibility provides clients with details of who they can contact for data protection issues. Whether there is a shared responsibility depends on the parties` joint determination of the purposes (and means) of data processing. Dr. Data Protection, I dare again: Example No. 6 («headhunters») postulated in the WP169 link — too little for me — a joint control between the client and the headhunters, apparently because the headhunter can have matching enhancen by accessing his own contact database. Wouldn`t it be possible to argue that B, if file B does not contain the number of people A wants with the criteria of A, could expand its own file through free search (cold acquisition) in order to find the number of participants desired by A? And does the relationship between A and B change if B is supposed to interview the identified participants immediately after receiving an A questionnaire and send to A only the recorded interview and not the contact details of the participants? Thank you very much.