Two companies act as joint controllers but never tell data subjects which party handles access requests or how responsibilities are split. What transparency duty are they most clearly missing?
Select an answer to reveal the explanation.
Short Explanation
Joint controllers are like two co-owners of a shop—customers still need a clear door to knock on. GDPR expects the essence of who does what, and a contact point, to be available to people—not a black box.
Full Explanation
Joint controllers that never tell data subjects which party handles access requests or how responsibilities are split most clearly miss the duty to make the essence of the joint-controller arrangement available to people, including a contact point. Citizens and customers should not have to guess which door to knock on when two organisations jointly decide purposes and means; Article 26 transparency is a civic accessibility rule, not optional corporate paperwork. Appointing the European Data Protection Supervisor as a shared marketing lead fails by confusing the EDPS’s role supervising Union institutions with private joint-controller marketing governance. Publishing each joint controller’s full employee directory in every Member State fails by oversharing irrelevant staff lists instead of providing the essence of respective responsibilities and a usable contact point. Converting both companies into processors so joint-controller rules no longer apply fails conceptually: you cannot escape joint-controller transparency by relabelling entities that still jointly determine purposes. Exam caveat: the arrangement’s essence must be available to data subjects; the full contract need not always be published verbatim, but opacity about who does what—especially rights handling—is non-compliant. Operational check: document the Article 26 allocation (who answers access, erasure, and breach notice), publish a clear contact point in notices, align operational playbooks, and test a sample access request end-to-end across both parties.