{"id":9043,"date":"2022-02-01T17:40:42","date_gmt":"2022-02-01T16:40:42","guid":{"rendered":"https:\/\/www.cabinetbouchara.com\/responsables-conjoints\/"},"modified":"2026-02-10T08:57:16","modified_gmt":"2026-02-10T07:57:16","slug":"jointly-responsible","status":"publish","type":"page","link":"https:\/\/www.cabinetbouchara.com\/en\/lexicon\/jointly-responsible\/","title":{"rendered":"Jointly responsible"},"content":{"rendered":"

Lexicon<\/a> > Jointly responsible<\/b><\/span><\/span><\/p>\n

IT Glossary<\/p>\n

Joint controllers of a personal data processing<\/a> operation shall mean two or more controllers<\/a> who jointly determine the purposes<\/a> and essential means of the processing operation.<\/p>\n

Joint controllers must transparently define their respective obligations, taking into account the different stages at which they operate, in order to ensure compliance with the requirements of the GDPR<\/a>, including the rights of data subjects and the use of processors<\/a>.<\/p>\n

This division of obligations between the joint managers must be formalized in an agreement that properly reflects their respective roles and obligations to the individuals concerned. In addition, the outline of the agreement must be made available to them.<\/p>\n

They are a prerequisite<\/em> for the protection of the rights and freedoms of the persons concerned.<\/p>\n

In any event, data subjects may exercise their rights against each of the data controllers, regardless of the agreement reached between the joint controllers.<\/p>\n

Finally, it is specified as necessary that the fact that a party has access only to information that does not concern an identified or identifiable natural person, or to personal data<\/a> anonymized in such a way that the data subject is not or is no longer identifiable, does not affect the situation of joint responsibility for the processing.<\/p>\n

However, this may be important in establishing the degree of responsibility of the parties involved<\/p>\n

RGPD Point<\/h2>\n

<\/span>” <\/span>The responsibility of the controller should be established for any processing of personal data that he carries out himself or that is carried out on his behalf. In particular, it is important that the controller is required to implement appropriate and effective measures and is able to demonstrate the compliance of the processing activities with this Regulation, including the effectiveness of the measures. These measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. <\/span><\/i>“<\/span><\/p>\n

Recital 74 of the GDPR<\/span><\/p>\n

Point of jurisprudence<\/h2>\n

The Court of Justice of the European Union has recalled that ” <\/span>the existence of joint responsibility does not necessarily translate into equivalent responsibility for the same processing of personal data on the part of the different actors. On the contrary, these actors may be involved at different stages of this treatment and to different degrees, so that the level of responsibility of each of them must be assessed taking into account all relevant circumstances of the case<\/span><\/i> […] “.<\/span><\/p>\n

Court of Justice of the European Union, July 10, 2018, No. C 25\/17<\/span><\/p>\n

The Bouchara firm assists you in particular in :<\/p>\n