Yhteisrekisterinpitäjyyttä

Yhteisrekisterinpitäjyys refers to a situation in data protection law where two or more entities jointly determine the purposes and means of processing personal data. This concept, primarily found in the General Data Protection Regulation (GDPR) of the European Union, means that these entities share responsibility for ensuring the lawful processing of personal data.

In a joint controller arrangement, each controller remains responsible for fulfilling their obligations under data protection laws. However, they also have specific responsibilities towards data subjects and each other. The GDPR mandates that joint controllers must establish the extent of their respective responsibilities for compliance with the obligations imposed by the regulation. This is typically done through a transparent agreement, often referred to as a joint controller agreement.

This agreement should clearly define who is responsible for handling data subject rights requests, conducting Data Protection Impact Assessments (DPIAs), notifying supervisory authorities of data breaches, and other compliance-related tasks. While they jointly determine the processing, the agreement can allocate specific tasks to one controller or the other.

Data subjects have the right to exercise their rights against any of the joint controllers, and they can pursue their rights against each controller individually. The agreement also outlines how the controllers will cooperate and share information to ensure effective compliance. The core principle is that both parties are accountable for the processing, even if they divide the practical responsibilities.