Two cities jointly design a shared resident portal and each decides the purposes and essential means for how resident data will be used in that portal. At a basic GDPR concepts level, how should their relationship be understood?
Select an answer to reveal the explanation.
Short Explanation
If both cities are steering what the portal is for and how it basically works, they are sharing the controller’s wheel—not one driving and one just washing the car. Joint controllers show up when more than one party decides purposes and means. Hosting alone does not settle that question.
Full Explanation
Under Article 26 GDPR, where two or more controllers jointly determine the purposes and means of processing, they are joint controllers. A shared resident portal in which each city sets purposes and essential means fits that concept at a high level. Technical hosting location or public-body status does not by itself convert one party into a processor or remove the processing from the GDPR.