Data Controller, Processor, or Joint Controller

Abstract

This chapter aims to examine critically the existing legal provisions on the concepts of controller, processor, and joint controller, as interpreted by the relevant non-binding guidelines and case law, and to propose a new “value chain” method for allocating responsibilities among joint controllers that is more effective and appropriate for the technology- and data-driven world. It also examines the corresponding data protection responsibilities of different data processing actors, in particular through the prism of the new accountability principle, which arguably includes not only obligations for means but also result-oriented obligations for compliance in terms of data subjects' effective and complete protection.