A vendor contract calls both parties “joint owners of the data.” Which GDPR role analysis is correct?
Select an answer to reveal the explanation.
Short Explanation
Ignore the contract’s poetry about “owning” data. GDPR asks who picks the why and how of processing—that party is the controller—and who just processes on instructions—that’s the processor. Fancy ownership wording does not rewrite those roles.
Full Explanation
Roles turn on who determines the purposes and means of processing: a controller decides those, while a processor processes personal data on behalf of the controller—labels like “joint owners” do not control the legal classification. Vendor contracts that market joint ownership cannot override factual decision-making authority under Article 4. Whoever hosts the servers is not always the sole controller. “Joint owners” is not a GDPR-defined role replacing controller and processor. Processors do not determine purposes and means while controllers only provide disk space. Exam caveat: substance-over-label role analysis is a core CIPP/E skill. Operational check: rewrite civic vendor templates to state controller/processor (or joint-controller) roles based on who sets purposes and essential means, and attach Article 28 terms where a true processor relationship exists. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.