The concept of Joint Control under the Data Protection Law Enforcement Directive 2016/680 in contrast to the GDPR

9

Due to its legal act specifics, a Directive takes a different approach than a Regulation. [21] The Directive is addressed to the Member States (Art. 288(3) TFEU) and leaves it up to them – at least in theory – to choose the form and methods to achieve a result. This choice with respect to the LED has been criticized [22] as it may impair the degree of harmonization. [23] This may be not only the case when Member States adopt provisions on the basis of an opening clause in the LED but also when they provide for an even stronger protection in general as allowed pursuant to Art. 1(3) LED. [24]

10

The flexibility of the Member States under the Directive affects the provisions on Joint Control as well as other provisions. For example, Art. 21(2) LED allows the Member States to choose whether the data subject should be able to exercise his or her rights in respect of and against each of the Joint Controllers. In contrast, a similar provision is mandatory under the GDPR. In addition, each Member State may take into account specifics of its LED relevant data processing activities and may provide for additional safeguards for Joint Control constellations, e.g., with respect to information obligations and to align Art. 21 LED with Art. 26 GDPR.

11

While under the GDPR any public or non-public body can be considered a controller (Art. 4(7) GDPR), under the LED only competent authorities [25] are controllers (Art. 3(8) LED). Insofar the circumstances are similar to those under the Regulation (EU) 2018/1725 [26] stipulating data processing activities carried out by the Union institutions, bodies, offices and agencies. Accordingly, a comparison of the Joint Control concept under the LED and the Regulation might be useful for the interpretation of Art. 21 LED and will therefore be made in the following (see below 3.4., 5.) Reem Ahmed RA .

12

Pursuant to Art. 3(7)(b) LED “any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes” set out in Art. 1(1) LED may be considered a competent authority too. [27] Thus private bodies may be controllers under the LED. However, taking into account the police purposes as classical governmental tasks, the majority of controllers will still be public authorities.

13

In most cases, only the authorities within a Member State will cooperate in data processing activities under the LED as each Member State would like to uphold its national sovereignty in the fields of data processing for police purposes. [28] In such a case, only the authorities of one Member State and its bodies are Joint Controllers. Thus, the data subject is faced with data controllers as liability subjects of equal solvency. Therefore, it is of less importance to the data subject whether he or she can exercise his or her rights in respect of and against each of the Joint Controllers and whether they are each held liable for the entire damage. Nevertheless, (personal) data transfers between Member States or even to third countries could be admissible, as Art. 35 et seqq. as well as Art. 50 LED demonstrate.

14

In addition, each Member State will most likely regulate the processing activities of its authorities – as Art. 8(1) LED with Union or Member State law as only legal base demonstrates [29] and as already required for example by the German constitution. [30] Even possible constellations of Joint Control might be already governed by the respective law. There is less need for an additional transparent agreement if the legislator itself has already regulated the responsibilities in detail and by means of mostly public accessible law.

15

With respect to (iii), transparency is a leading principle of the GDPR and not of such great importance under the LED. [31] Even when comparing the occurrence of the words “transparency” and “transparent” in both legal acts, the GDPR prevails with 14 against 2 occurrences. This might be justified because of the specific character of the data processing purposes within the scope of the LED. [32] Consequentially the LED does not explicitly require controllers to process personal data “in a transparent manner in relation to the data subject” (cf. Art. 5(1)(a) GDPR). The principle of “lawfulness, fairness and transparency” (Art. 5(1)(a) GDPR) has been narrowed down to a principle of lawfulness and fairness (Art. 4(1)(a) LED). [33] The information to the data subject has to be provided not in a “concise, transparent, intelligible and easily accessible form” (Art. 12(1) GDPR) but in a “concise, intelligible and easily accessible form” (Art. 12(1) LED). Therefore, the LED gives the impression that public data processing activities related to criminal offences require less transparency in general. As covert investigations, video surveillance or other forms of covert data processing activities are more likely under the circumstances covered by the LED, this might be an explanation for such an adaption [34] – whether this can be criticized or not.

16

In addition, there are several specific exemptions from the right of access in Art. 15 LED, e.g., to “avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties” (Art. 15(1)(b) LED). However, transparency still has to be taken into account by controllers under the LED. [35]

19

When it comes to responsibilities of Joint Controllers determined by the legislator there are virtually no differences between the GDPR and the LED. To the extent “the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject” there is no need for determining such in an arrangement between the Joint Controllers (Art. 21(1)(2) LED). As described above (see 2.2.), Reem Ahmed RA the constellations of Joint Control within the scope of the LED will mostly be governed by Union or Member State law when assigning tasks to their authorities and bodies. Therefore, a provision such as Art. 21(1)(2) GDPR is of much higher importance under the LED and there will be fewer Joint Control Agreements compared to constellations to which the GDPR applies.

20

In Germany, for instance, there is a central anti-terrorism file, which is fed by the data transferred by several public authorities and might be considered a Joint Control constellation. However, the legislator probably takes a different view as the respective Act (‘Antiterrordateigesetz’) does not provide for an explicit allocation of responsibilities within the meaning of Art. 21(1)(2) LED.

21

Both the GDPR and the LED stipulate that the Joint Controllers have to determine the responsibilities for compliance with central data protection obligations by means of a Joint Control Agreement. The determination of the responsibilities regarding the exercise of data subject rights, including the information obligation(s), is emphasized as essential for the protection of data subjects. In addition, according to Art. 26(2)(1) GDPR, Joint Controllers shall ensure that the roles and relationships between them are duly reflected. This requires inter alia the description of the parties involved and information on different stages of the processing activity. [38] By requiring Joint Controllers to get an overview of their cooperation, transparency vis-à-vis data subjects is not only facilitated by preparing the provision of information to data subjects, but it also encourages Joint Controllers to assess whether the envisaged data processing activities meet essential requirements of data protection law (cf. Art. 24(1) GDPR).

22

Such a requirement regarding the reflection of the roles is completely missing in Art. 21 LED. This can again be explained by the fact that most controllers under the LED are public authorities and the legislator at least reflected the roles in the respective legal act. There is no need to reflect the roles and relationships in a JCA if this is already done by law. In addition, public authorities are particularly sensitive to the assessment of the lawfulness and admissibility of their (data processing) activities, as they are already constitutionally obliged to do so. For example, the German constitution and the principle of the rule of law enshrined therein require the authorities to always act in accordance with the law (“Gesetzmäßigkeit der Verwaltung”) and provides for even stricter requirements in the (LED) area of the prosecution of criminal offences. Nevertheless, such an obligation of Joint Controllers would also have been suitable under the LED. There are similar controller obligations in general under the LED, even though controllers might be mostly public controllers (cf. Art. 19(1) LED). Particularly with respect to fundamental rights, which are of crucial relevance for data processing activities within the scope of the LED, [39] such a provision can sensitize public authorities, encourage them to self-control, and may therefore reduce the risk of unclear and non-transparent data processing activities which violate principles of data protection law. Accordingly, the German legislator, for example, requires that the roles and responsibilities shall be reflected in the Joint Control Agreement (Section 63 of the German Federal Data Protection Act ("BDSG")).

23

According to Art. 26(1)(3) GDPR, Joint Controllers are free to designate a contact point. Such a designation may avoid the administrative effort necessary to forward data subjects’ requests to the other Joint Controllers. At the same time, it may also allow for a request from a data subject being processed more quickly, which is of direct benefit to the data subject. [40] Ultimately, the provision is thus a manifestation of Art. 12(2)(1) GDPR (cf. Art. 12(2) LED), which requires controllers to facilitate the exercise of data subject rights. However, its material impact under the GDPR is limited, since the data subject may exercise his or her rights in respect of and against each of the Joint Controllers (Art. 26(3) GDPR).

24

In contrast, the designation of a contact point under the LED is mandatory pursuant to Art. 21(1)(3) LED – similar to Art. 24(1)(3) of the GDPR Draft of the Council. [41] This allows the data subject to contact a single person with regard to all data subject rights, so that the effective enforcement of data subject rights can be ensured. Due to the specific issue that the data subject is usually confronted with solvent public authorities as Joint Controllers and as a contact point (see above 2.2.), Reem Ahmed RA this can therefore contribute almost as effectively to the protection of the data subject as the joint and several liability, the implementation of which is at the discretion of the Member States according to Art. 21(2) LED. This background completely changes the role of the contact point: While under the GDPR it is the icing on the cake for the data subjects, under the LED, in the absence of mandatory joint and several liability of the Joint Controllers, it is crucial for the effective protection of the data subjects and their rights. [42] Even though, the concept of Joint Control and the requirement for the determination of responsibilities is not redundant. The mandatory contact point cannot contribute to the same extent to the effectiveness of data protection compliance, in particular with respect to data subject rights. Whether there is a contact point or not, the internal allocation of responsibilities by the (Joint) Controllers or the legislator ensures that each (Joint) Controller is aware of its specific obligations. Additionally, the allocation of responsibilities encourages each Joint Controller to implement appropriate measures and procedures necessary for data protection compliance when processing the personal data “of” the data subject within the scope of his responsibility.

25

The importance of the contact point under the LED indicates the necessity of further requirements in connection with the obligation of the Joint Controllers to designate a contact point. It already follows from the concept and aim of a contact point that it must actually be (easily) accessible for the data subject. Therefore, in particular, the data subject must be able to obtain information on whether a contact point exists and how to reach out for such a contact point, otherwise the objective pursued by this contact point will be counteracted. The obligation to designate a contact point thus implies an obligation to provide information on the contact point in accordance with Art. 12, 13 LED. In addition, the contact point must be a body which is also able to enforce the rights of the data subjects as effectively as possible. The designation of a person other than the public authorities involved as (Joint) Controllers is therefore not admissible, cf. Art. 21(1)(4) LED.

26

At this point, the Member States can fill in their regulatory leeway and thus not only ensure clarity, but also provide more details on the function of the contact person. Since a Directive requires the transposition by the Member States anyway, the prohibition of repetition [43] under European law such as for Regulations does not apply. Furthermore, pursuant to Art. 1(3) LED even stricter provisions of the Member States are permissible. Therefore, clarifications in the transposed provisions are all the more permissible. The national legislator should make use of such leeway and should explicitly stipulate the information obligations regarding the contact point. In addition, for example, national law could provide for the admissibility of the designation of an external (public) body as a contact point, provided that it (i) can process requests for data subjects at least as effectively as one of the Joint Controllers, and (ii) is an independent subject of liability, so that the Member State provides higher safeguards in accordance with Art. 1(3) LED with the implementation of an additional liability subject. However, as an example for reducing clarity as national legislator, the German transposition in Section 63 BDSG does not provide explicitly even for the requirement of the designation of a contact point in general.

27

In contrast to the GDPR (Art. 26(2)(2) GDPR), there is no obligation to provide data subjects with the essence of the Joint Control Agreement. One explanation might be that the obligation to reflect the respective roles and relationships (Art. 26(2)(1) GDPR) has not been adapted as well (see above 3.2.). Reem Ahmed RA Therefore, the legislator might have been of the opinion there has been no necessity to implement Art. 26(2) GDPR as a whole. However, even under the GDPR, such essence of the Joint Control Agreement may also include information on the determination regarding the rights of the data subjects under Art. 26(1)(2) GDPR, in turn, adopted under the LED. [44] Therefore, the absence of a provision such as Art. 26(2)(1) GDPR alone cannot explain this.

28

Instead, a possible reason might be the greater relevance of the determination by the legislator as already elaborated (see above 3.1.). In such a case, the legal regulation contains the information relevant to the data subject. Incidentally, this is also a manifestation of the lower transparency requirements (see above 2.3.). Here, however, what is said about the mandatory designation of a contact point (see above 3.3.) Reem Ahmed RA becomes particularly relevant. Since under the LED a contact point for data subjects must be designated in any case (Art. 21(1)(3) LED), additional information is of less importance for the exercise of the other data subject rights. Finally, the data subject is faced with a solvent contact point mostly (see above 2.2.) Reem Ahmed RA against whom he or she can exercise all his or her data subject rights.

29

Insofar as the Member States implement the joint and several liability regarding data subject rights according to Art. 21(2) LED, such as the German legislator, such a national provision becomes more similar to Art. 26 GDPR. Nevertheless, there is no obligation under Art. 21 LED to provide data subjects with the essence of the agreement. Such information is still necessary to enable the data subject to choose the best addressee instead of the contact point in order to exercise the data subject rights as effectively as possible. Thus, it might be possible for the addressed Joint Controller to act on the request more quickly, due to the distribution of tasks. The sense of such a duty to provide information on the responsibilities is therefore not completely eliminated under the LED. This is also confirmed by the Regulation (EU) 2018/1725: Although controllers in the meaning of this Regulation are (Union) public authorities (Art. 3(8) Regulation (EU) 2018/1725), Art. 28(2)(2) Regulation (EU) 2018/1725 obliges Joint Controllers to make the essence of the JCA available to the data subject and Art. 28(3) Regulation (EU) 2018/1725 stipulates a joint and several liability. Therefore, the fact that controllers under the LED are mostly public authorities may not justify such an omission of Art. 26(2)(2) GDPR.

30

Member States can fill in their regulatory leeway in this respect. Insofar as the Directive (EU) 2018/1725 provides as well as the GDPR for a Joint Control information obligation, this does not mean that the reverse conclusion can be drawn that a corresponding provision in the context of the LED would be inadmissible due to Art. 21 LED being conclusive in this regard. Such an information obligation would be an example par excellence for a higher safeguard in the meaning of Art. 1(3) LED. It is therefore once again up to the Member States to provide for an information obligation when transposing the LED and thus ensure more transparency vis-à-vis data subjects. Such a provision could at the same time include the obligation to inform the contact point (see 3.3. above Reem Ahmed RA ) implementing a coherent overall Joint Control concept.

32

Considering the differences between the implementation of the Joint Control concept under the GDPR and the LED, it could become particularly challenging if both the GDPR and the – Member State transpositions of the – LED would be applicable to such cooperation.

33

The material scope of the GDPR and the LED are mutually exclusive based on the processing purposes (Art. 2(2)(d) GDPR, Art. 2(1),1(1) LED). As the GDPR covers all data processing purposes except for the purposes covered by the LED, the LED is considered the lex specialis. [46] Nevertheless, in some constellations it may not be entirely clear whether the purpose falls within the scope of the LED, as for example in the case of migration and border control and potential criminal offences. [47] However, there is no combined applicability of the Joint Control concepts of the GDPR and LED – i.e. controllers under the GDPR and LED being considered together as Joint Controllers – for two reasons.

34

First, in practical terms, whenever personal data are processed by the competent authorities for the purposes covered by the LED with particular relevance to fundamental rights, the legislator will not want to provide for the right of other (GDPR) bodies to determine purposes and means of such processing activities, especially when personal data are or should be transferred to private bodies. [48] This would be in line with the Council of Europe's recommendation that data transfers from the police sector to recipients for non-police purposes should be limited to the absolute minimum necessary. [49] If one thinks for example of a private body providing retained personal data to a competent public authority for the purpose of investigation detection or prosecution of criminal offences, [50] the private body and the public authority do not determine such purpose jointly and are therefore not Joint Controllers. [51]

35

Second, Art. 26(1)(1) GDPR as well as Art. 21(1)(1) LED require “two or more controllers” in the meaning of the GDPR and the LED, respectively, as a condition for Joint Control. In contrast, Art. 28(1)(1) Regulation (EU) 2018/1725 stipulates explicitly “controllers other than Union institutions and bodies” and includes therefore controllers, which are not controllers in the sense of the Regulation (EU) 2018/1725. Thus, as long as there is only one GDPR and one LED controller only the relevant act will apply in each case. Provided that there are at the same time two or more (Joint) Controllers under the GDPR or LED for connected data processing activities, the respective Joint Control provisions will apply for the data processing activities covered by the scope of either the GDPR or the LED. It might be theoretically conceivable that the identical processing activity serves a purpose in terms of both the GDPR and the LED. In practice, however, it will be possible to split up such processing activity and separate the processing activities clearly, for example if the personal data already collected under the LED are processed further for statistical purposes in accordance with the GDPR at a later time. The (Joint) Control under the LED/GDPR thus ends with the corresponding processing activity such as a transmission – and the (Joint) Control under the GDPR/LED begins with the corresponding subsequent processing activity such as a collection. As such a constellation may happen only when the LED and GDPR purposes are pursued for connected data processing activities, the function of the LED as a lex specialis with regard to the LED purposes does not prevent such a consecutive Joint Control according to two legal acts. Such a constellation may take place when a LED controller works together with a GDPR controller for GDPR purposes and is therefore a GDPR controller when processing the same data. For example, personal data might be processed for purposes within the meaning of Art. 1(1) LED and later as part of different processing activities for internal administrative purposes, such as in cases of theft and lost property, [52] or scientific research purposes and statistical purposes (cf. Art. 9(2) LED). [53] However, this will also take place regularly within one authority and the processing activities will be strictly separated.

36

Therefore, a real collision of both provisions is unlikely. When the same public authority is considered a controller under both the GDPR and LED for related data processing activities and there are two controllers under the GDPR and/or LED, then each provision will apply separately and only to the data processing activities covered by the respective legal act. As there are different processing activities, separated inter alia by the different purposes, such a consecutive application and e.g., two Joint Control Agreements can be handled in practice.