# Standards and Regulatory References

## Primary Legislation

### GDPR Article 26 — Joint Controllers
- **Art. 26(1)**: Where two or more controllers jointly determine the purposes and means of processing, they shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject.
- **Art. 26(2)**: The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-a-vis the data subjects. The essence of the arrangement shall be made available to the data subject.
- **Art. 26(3)**: Irrespective of the terms of the arrangement, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.

### GDPR Article 82 — Right to Compensation and Liability
- **Art. 82(4)**: Where more than one controller is involved in the same processing, each controller shall be held liable for the entire damage.
- **Art. 82(5)**: Where a controller has paid full compensation for the damage suffered, that controller shall be entitled to claim back from the other controllers involved in the same processing that part of the compensation corresponding to their part of responsibility.

### GDPR Article 13-14 — Transparency
Joint controllers must ensure that privacy notices are provided to data subjects disclosing the joint controllership and the respective responsibilities. The designated contact point must be identified.

## Regulatory Guidance

### EDPB Guidelines 07/2020 on the Concepts of Controller and Processor in the GDPR
Adopted 7 July 2021. Key guidance on joint controllership:
- Joint determination of purposes and means does not require equal determination — it can be asymmetric.
- Joint controllership may arise from a common decision or from converging decisions.
- The existence of a shared platform does not automatically create joint controllership; the analysis depends on whether both parties determine purposes and means.
- An arrangement under Art. 26(1) is required whenever joint controllership exists.
- The arrangement must be a real, substantive allocation of responsibilities, not a formality.

### CJEU Case Law

- **Wirtschaftsakademie (C-210/16, 5 June 2018)**: Fan page administrator is joint controller with Facebook. The admin enables and benefits from the processing of visitor statistics. Joint controllership does not require equal responsibility or access to the data.
- **Jehovah's Witnesses (C-25/17, 10 July 2018)**: Organising entity is joint controller with door-to-door preachers collecting personal data, because the entity determines purposes and certain means (forms, topics, organisation of visits).
- **Fashion ID (C-40/17, 29 July 2019)**: Website embedding Facebook Like button is joint controller with Facebook for collection and transmission of data, but only for those specific processing operations the website operator has influence over — not for subsequent processing by Facebook.
- **Google Spain (C-131/12, 13 May 2014)**: While not explicitly an Art. 26 case, established that a search engine operator determines purposes and means independently of website publishers, relevant to distinguishing separate vs joint controllership.

## National Supervisory Authority Guidance

- **ICO (UK) — Controllers and Processors Guidance (2025)**: Provides practical examples of joint controllership scenarios including shared databases, collaborative research, and platform-based processing.
- **CNIL (France) — Joint Controller Guidance**: Emphasises that the arrangement must be documented before joint processing begins and that the essence must be proactively communicated to data subjects.
- **Hamburg DPA — Facebook Fan Pages Decision**: Held that fan page administrators must ensure a valid Art. 26 arrangement is in place with Meta Platforms, leading to the widespread adoption of Meta's Page Insights Controller Addendum.