A joint controller is defined within the GDPR as “two or more controllers” that “jointly determine the purposes and means of processing.”[1]

There is considerable ambiguity surrounding what it means to “jointly determine” the purpose and means of processing. While regulatory authorities have not offered guidance as to whether the term does, or does not, apply to attorneys/solicitors/barristers when they perform services on behalf of a client, the Article 29 Working Party has suggested in the context of barristers that they may view a joint controller relationship as unlikely, referring to them as “independent” controllers.[2] Similarly the UK ICO – the supervisory authority for the United Kingdom – also implied as part of a discussion of data subject rights that attorney solicitors may not be joint controllers by stating that a client and a solicitor “each have their own data controller responsibilities.”[3]

One of the defining practical characteristics of joint controllers is that they allocate “their respective responsibilities for compliance” with the GDPR between and among themselves.[4] Put differently, when two companies are separate controllers, each company is responsible for independently fulfilling all of the requirements imposed by the GDPR. When two companies are joint controllers, the companies can agree by contract to allocate and distribute those responsibilities so that the entities when viewed together address all of the GDPR obligations, but if the entities were viewed in isolation one, or both, might be out-of-compliance. As a practical matter, therefore, whether a law firm and its client are separate controllers or joint controllers may be determined by whether the law firm is relying upon its client to satisfy an obligation of the GDPR on the law firm’s behalf, or whether the client is relying upon the law firm to satisfy an obligation of the GDPR on its behalf. As an example, if the law firm’s processing of personal information is premised upon the client having a lawful purpose, or the law firm intends to rely upon a record of processing kept by a client (e.g., the law firm does not intend to keep its own record of processing), the law firm and client may be acting as joint controllers. Conversely if the law firm’s processing of personal information is premised upon its own lawful purpose (e.g., the law firm’s legitimate interest in representing its client), and the law firm has processes in place to comply in its own regard to the obligations of the GDPR (e.g., maintaining its own record of processing) its actions would be consistent with those of a separate controller.

[1] GDPR, Art. 26(1).

[2] Article 29 Data Protection Working Party, WP169: Opinion 1/2010 on the concepts of ‘controller’ and ‘processor” at 28 (Feb. 16, 2010) (emphasis added).

[3] UK ICO, “Data Controllers and Data Processors: What the Difference Is and What the Governance Implications Are” at 13.

[4] GDPR, Art. 26(1).