The Court of Justice of the European Union has been busy interpreting EU General Data Protection Regulation provisions in recent cases. One of these is C-683/21, where the court held a controller can be liable for processing carried out by its processor. There are limits to this. A controller will not be liable if a processor processes personal data for its own purposes, if a processor acts in a manner that is incompatible with the arrangements set by the controller, or if it's reasonable to conclude the controller didn't agree to the processing. The implication is that controllers must be careful when engaging processors. They should have oversight of their processors' actions and, ideally, ensure there are clear instructions. If arrangements are unclear or not properly documented, a controller may struggle to show that a processor acted in a way that was incompatible with the controller's instructions. 

Background

The case concerns a COVID-19 app commissioned by the National Public Health Centre of the Lithuanian Ministry of Health. The NVSC selected UAB "IT sprendimai sėkmei," an IT service provider, to build the app and provided it with some design information and the questions to be asked within the app. The app was eventually made available on Google Play, and its privacy policy referenced NVSC and the service provider as controllers. However, the NVSC and service provider had not entered into a contract: the NVSC terminated the procurement of the app due to a lack of funds. 

The Lithuanian data protection authority imposed administrative fines on the NVSC and the service provider as joint controllers. The NVSC challenged the decision, arguing it was not a controller for the processing in question: The service provider built the app, there was no contract between the parties and the NVSC had not consented to or authorized it to make the app available to the public. 

The IT service provider argued that it was merely a processor.  

The broad scope of controllership

The CJEU reaffirmed the broad scope of controllership: The key question is whether a person exerts influence over the data processing for their own purposes and determines the purposes and means of processing. The court further confirmed that: 

• A person can be a controller even if there is no contract designating them as one if they have not provided written guidelines or instructions regarding the processing and don't process any personal data.
• In this case, the NVSC commissioned the app for its own objectives — i.e., the management of COVID-19. The NVSC had foreseen the data processing that would be carried out and had participated in determining the parameters of that app. Therefore, NVSC should be regarded as a controller. 
• The fact the NVSC did not acquire the app and did not authorize its dissemination to the public wasn't material: the conclusion would only be different if the NVSC had expressly objected to the app being made available to the public. 
• The fact that a person is referenced as a controller in a privacy notice is not in itself sufficient to make that person a controller unless that person had consented — explicitly or implicitly — to this. 

Joint controller arrangement not a pre-condition for joint control

The CJEU reiterated previous case law — joint control does not necessarily mean equal responsibility. The level of responsibility of each party will depend on the circumstances of a particular case. A party can also be a joint controller even if it does not have access to the personal data. 

Where parties are joint controllers, they must put a joint control "arrangement" in place to comply with Article 26(1). The court confirmed that parties can be joint controllers even if this "arrangement" is not documented; in other words, this arrangement is a consequence of the parties being joint controllers, not a pre-condition for the existence of joint control.  

Controllers can only be fined for wrongful behavior 

The CJEU went on to look at the responsibility of a controller for GDPR infringements and its responsibility for the acts of its processor. 

The court concluded a controller can only receive an administrative fine for an intentional or negligent infringement of the GDPR,  i.e., only for wrongful behavior. The GDPR does not allow administrative fines unless there is some fault (Article 83 GDPR refers to the "intentional or negligent character of the infringement" as one of the factors for imposing a fine). 

However, the court also confirmed there is no requirement for the GDPR infringement to have been committed by or with the knowledge of the controller's management team. 

Liability of a controller for acts of the processor

One of the most interesting points of the decision is the CJEU's finding that a controller may be fined for unlawful processing carried out by its processor. This conclusion is on the basis that, as supported by Recital 74 GDPR, the controller is responsible for processing carried out on its behalf. 

The court clarified the controller would not be liable in situations where the processor has acted for its own purposes, where the processor has processed data in a manner that is incompatible with the arrangements for the processing set by the controller, or where it cannot be reasonably considered that the controller consented to such processing. In these situations, the processor would become a controller, in accordance with Article 28(10) GDPR.