Two separate apps jointly decide the purposes and means of processing for a shared login identity service. Which accountability step is required under GDPR joint-controller rules?
Select an answer to reveal the explanation.
Short Explanation
If two shops co-write the rules for a shared membership card, they both own the privacy homework and must post who does what. That is the joint-controller arrangement idea. Pretending only the bigger logo counts, or calling everyone a processor, ducks the duty.
Full Explanation
Where two or more controllers jointly determine purposes and means, Article 26 requires a transparent arrangement allocating GDPR responsibilities—especially regarding rights exercise and transparency duties—and making the essence of the arrangement available to data subjects. Two apps that co-decide a shared login identity service are joint controllers for that processing and must not leave people guessing who answers. Civic platforms and private app ecosystems both owe clear accountability maps.
Treating co-deciders as unrelated controllers with no allocation fails Article 26. Naming only the larger brand while ignoring the co-deciding partner misleads users. Re-labelling both as processors for each other does not avoid accountability when they jointly determine purposes and means.
Exam caveat: joint controllership is about factual decision-sharing, not contract labels alone. Processor relationships remain available where one party only processes on documented instructions without joint purpose determination.
Operational check: execute an Article 26 arrangement, publish a short essence statement in both apps’ notices, define a single front door for rights requests, and test that requests reaching either party are handled per the allocation.