yhteisrekisterinpitäjien

Yhteisrekisterinpitäjät is a Finnish term that translates to "joint data controllers" or "joint controllers" in English. It refers to a situation in data protection law where two or more entities jointly determine the purposes and means of processing personal data. This concept is primarily relevant under the General Data Protection Regulation (GDPR) of the European Union.

When entities act as joint controllers, they share responsibility for complying with data protection obligations regarding the data they process together. This means they must agree on how the processing will be carried out and how the rights of data subjects will be facilitated. They are jointly and severally liable for any infringements of data protection law, meaning that a data subject can pursue a claim against any one of the joint controllers for the entire damage.

The GDPR requires joint controllers to define their respective responsibilities for compliance with the regulation by means of an arrangement. This arrangement should, in a transparent manner, determine their essential elements, such as the designated contact point for data subjects, the exercise of data subjects' rights, and the obligations relating to information provision, data security, and data breach notification.

Determining whether a joint controller relationship exists involves assessing the degree of influence and control each entity has over the processing. Key factors include whether they jointly decide on the necessity of processing, the types of data processed, the purposes of processing, and the technical and organizational measures implemented. The mere fact that multiple entities are involved in a processing activity does not automatically make them joint controllers; their roles in determining the key aspects of the processing are crucial.