Yhteisrekisterinpitäjä

Yhteisrekisterinpitäjä refers to a situation in data protection law where two or more controllers jointly determine the purposes and means of processing personal data. This concept is central to the General Data Protection Regulation (GDPR) in the European Union, where it is addressed in Article 26. When organizations act as joint controllers, they share responsibility for ensuring that data processing activities comply with GDPR requirements.

The key aspect of being a yhteisrekisterinpitäjä is the shared decision-making power regarding the processing of personal data. This means that both parties must agree on why the data is being processed and how it will be handled. They are jointly accountable for the lawfulness of the processing, including the legal bases for processing, data subject rights, and data security.

To clarify their respective responsibilities and liabilities, joint controllers are required to have an arrangement between themselves. This internal agreement should specify the roles and responsibilities of each party concerning GDPR compliance. It should also detail how data subject rights will be facilitated and how information will be provided to data subjects. Without such an arrangement, both parties can be held liable for any infringements.

Data subjects have the right to address their requests to any of the joint controllers. The agreement should also outline which controller is the primary point of contact for data subjects. The essence of yhteisrekisterinpitäjä is shared control and shared responsibility for personal data processing.