The concept of Joint Control under the Data Protection Law Enforcement Directive 2016/680 in contrast to the GDPR

Abstract

While the EU General Data Protection Regulation 2016/679 (hereinafter the GDPR) is on everyone's lips, the EU Data Protection Law Enforcement Directive 2016/680 (hereinafter the LED) exhibits a rather shadowy existence. This also applies with regard to the concept of multiple controllers determining purposes and means of data processing activities (Joint Control). The LED requires the Member States to implement a Joint Control concept similar to the concept set out under the GDPR. Differences between the Joint Control concepts under the GDPR and LED lie in the details, but at the same time they are significant and representative of the specifics and particular aims of the LED compared to the GDPR. The following article discusses the objectives of the LED and the Joint Control concept and explains them on the basis of the differences between the provisions related to Joint Control (Art. 26 GDPR and Art. 21 LED). In addition, collisions of application of GDPR and LED and its impact on Joint Controllers are discussed.*