Companies will be jointly responsible for the personal data processed as part of the draw, as they have both decided on the purpose and means of processing. A real estate management company manages university residences for the owner, the university. The company enters into lease agreements with students on behalf of the university and chases all rent arrears. She collects the rent and hands it to the university after a commission. Article 26 of the RGPD stipulates that joint treatment managers “transparently” define their respective responsibilities for compliance, including the provision of information to the persons concerned and the exercise of the rights of the person concerned. An exception is made where EU law or the national law of an EU member state defines the respective powers. Similarly, if, as a processing manager, you share personal data with an independent data manager (i.e. no common managers) I recommend reaching an agreement (especially where data sharing is systematic, large-scale or risky), even if the RGPD does not explicitly require it. The agreement helps you justify data sharing and demonstrate compliance issues and explains how the parties agree to resolve them. Although Article 26 of the RGPD requires agreement between common treatment officials, it does not require a written agreement between joint treatment officials, but a written agreement attesting to the agreement is a proven method and helps to demonstrate accountability. In addition, joint controllers are fully accountable to the supervisory authorities (for example. B.dem ICO) for not respecting their responsibilities.
Accurate evaluation of data transfer to a processor, common controller or other independent controller is essential, as the type of agreement you need to make varies depending on the nature of the other party. If in doubt, seek legal advice. Yes, yes. Individuals can seek redress from common controllers, just like any chief. Each common manager is responsible for all the damage caused by the treatment, unless he can prove that he is in no way responsible for the event that caused the damage. The intermediate regime is not relevant to these purposes.