In short. Article 26 requires joint controllers to allocate GDPR responsibilities transparently and make the essence of their arrangement available to individuals.
Definition: Website partners need an Article 26 arrangement when they jointly determine why and how personal data are processed. Under the General Data Protection Regulation (GDPR), the arrangement allocates their responsibilities for that joint processing, except insofar as applicable EU or Member State law already determines them.
Key facts
- GDPR Article 26(2) requires the essence of the arrangement to be available to the people whose data are processed.
- The European Data Protection Board (EDPB), in its controller and processor guidelines, recognises both common decisions and converging decisions as routes to joint control.
- The Court of Justice's Fashion ID summary illustrates joint control over collection and transmission of website visitor data.
What counts as jointly determining processing?
The EDPB's Guidelines 07/2020 assess actual decisions about purposes, meaning why processing occurs, and essential means, meaning key decisions about how it occurs. Converging decisions complement each other and are necessary for processing, with a tangible effect on its purposes and means.
The same guidelines recognise joint control without access to personal data. It can cover particular operations in a longer processing chain, with responsibility varying by involvement.
How does this apply to a website plugin?
In its press release on Fashion ID, the Court of Justice describes an online clothing retailer embedding Facebook's Like button. Its judgment of 29 July 2019 in Case C-40/17 interprets the earlier Data Protection Directive.
The Court explains that the retailer can jointly control visitor-data collection and transmission to Facebook Ireland, subject to the national court's investigations. Subsequent processing by Facebook alone falls outside the retailer's control in principle. For collection and transmission, the retailer must give visitors information including its identity and processing purposes when collecting the data.
What must the arrangement allocate?
GDPR Article 26(1) requires transparent allocation of compliance duties, particularly handling individuals' rights and providing the information required by Articles 13 and 14. Article 26(2) requires the arrangement to reflect the partners' roles and relationships with those individuals.
The EDPB guidelines extend the allocation to applicable duties such as security and breach notification. They recommend identifying the processing's purpose, data types and categories of people affected, and recording the arrangement in a binding document. Article 26 leaves the legal form open.
Related terms
FAQ
Does every website service provider need this arrangement?
A processor processes personal data on your behalf under GDPR Article 4(8). Article 28(3) governs that processing through a contract or other binding legal act.
Can visitors contact either partner?
Yes. Under Article 26(3) of the same regulation, visitors can exercise their rights against each controller, even if your arrangement designates a contact point.
Must responsibilities be divided equally?
The EDPB guidelines allow unequal allocation according to the circumstances and each partner's ability to fulfil the duties. They recommend documenting the allocation analysis.
Sources
- EUR-Lex, "General Data Protection Regulation", 27 April 2016
- European Data Protection Board, "Guidelines 07/2020 on the concepts of controller and processor in the GDPR", 7 July 2021, corrected 20 September 2022
- Court of Justice of the European Union, "Press release No 99/19: Fashion ID", 29 July 2019
Check how a page reads to answer engines. Open the GEO score analyzer