1. 兩個或兩個以上控管者共同決定處理之目的及方式時，其應為共 同控管者。共同控管者應以透明之方式，彼此間安排，確定其各自履 行本規則所定義務之責任，尤其是關於資料主體行使其權利及其各自 對於第 13 條及第 14 條所定提供資訊所負之責任，但控管者受拘束之 歐盟法或會員國法已就控管者各自之責任定有明文者不在此限。該安 排得指定資料主體之聯絡對口。
1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects.
Source: https://www.ndc.gov.tw/Content_List.aspx?n=F98A8C27A0F54C30
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
ISO/IEC 27701, принятый в 2019, добавил дополнительное руководство к ISO/IEC 27002 для контролеров персональных данных (ПИИ).
Приводим соответствующий параграф к статье 26 GDPR:
7.2.7 Управление со-контролёрами ПИИ
Средство управления
Организация должна определить соответствующие роли и обязанности по обработке ПИИ (включая требования защиты и безопасности ПИИ) с любым со-контролёром.
Руководство по внедрению
Роли и обязанности по обработке ПИИ должны быть определены прозрачным образом.
…
Войти
для доступа к полному тексту
(79) 資料主體之權利與自由保護與控管者及處理者之責任與義務 （此也均與監管機關之監控與其手段有關）應依本規則予以明確分配， 包括於控管者與其他控管者共同決定資料處理之目的與手段時，或是 由控管者之代表進行處理活動時。
(79) The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.
(EN)
Article 29 Working Party, Opinion 1/2010 on the concepts of «controller» and «processor» (2010).
EDPS, Guidelines on the Concepts of Controller, Processor and Joint Controllership Under Regulation (EU) 2018/1725 (2019).
EDPB, Guidelines 7/2020 on the Concepts of Controller and Processor in the GDPR (2021).
EDPB, Guidelines 8/2020 on the targeting of social media users (2020).
ICO, Right of Access (2020).
ICO, Data sharing: a code of practice (2020).
EDPB, Guidelines 02/2021 on Virtual Voice Assistants (2021).
CJEU, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein/Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16 (2018).
CJEU, Tietosuojavaltuutettu v Jehovan todistajat, C-25/17 (2018):
The existence of joint responsibility does not necessarily imply equal responsibility of the various operators involved in the processing of personal data. On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, so that the level of responsibility of each of them must be assessed with regard to all the relevant circumstances of the particular case. Actual access to personal data is not a prerequisite for joint responsibility (p. 68-72).
CJEU, Fashion ID GmbH & Co. KG/Verbraucherzentrale NRW eV, C-40/17 (2019).
(EN) The expression “joint controller” is one of the most difficult to grasp in practice. It is nonetheless essential to delimit the role of the parties involved in the processing of personal data to determine their responsibilities under the General Data Protection Regulation (GDPR).
…
Войти
для доступа к полному тексту