Yhteisrekisterinpitäjyys

Yhteisrekisterinpitäjyys, or joint controllership, is a concept within data protection law, primarily stemming from the European Union's General Data Protection Regulation (GDPR). It describes a situation where two or more entities jointly determine the purposes and means of processing personal data. In such cases, these entities are not acting independently but are collectively responsible for ensuring that the data processing activities comply with data protection principles and regulations.

When yhteisrekisterinpitäjyys exists, the controllers share responsibility for the processing. This shared responsibility typically extends to fulfilling data subjects' rights, such as the right to access, rectification, and erasure of their data. It also includes the obligation to implement appropriate technical and organizational measures to ensure data security and to notify supervisory authorities and data subjects in the event of a personal data breach.

The GDPR requires that in cases of joint controllership, the respective roles and responsibilities of each controller concerning compliance with the regulation must be clearly defined. This is often established through an arrangement, typically a contract, that outlines how each party will fulfill their obligations. This arrangement should be made available to the data subject upon request. The primary point of contact for data subjects is usually designated within this agreement, allowing them to exercise their rights effectively. In essence, yhteisrekisterinpitäjyys emphasizes shared accountability for personal data processing.