The Liechtenstein data protection authority has issued guidance on joint controllership under GDPR:
Examples of joint controllers:
- If two companies jointly organize a competition in which the name and address are collected by the participants for the subsequent delivery of the prizes.
- If a website operator integrates a Facebook “Like” button on his website in order to improve his marketing, both the website operator and Facebook are jointly responsible, even if the website operator has no access to the data collected.
- If a company uses a Facebook fan page for its social media presence, there is common responsibility between the company and Facebook, although the company itself has no access to the actual data and the survey and evaluation of personal data only takes place on Facebook.
Examples where not joint controllers:
- A company forwards personal data from employees to a travel agency for the purpose of booking a business trip (controller to controller).
- An association produces and sends a member newspaper from a printing company and transmits plus addresses of the members of the association for the dispatch of the paper (controller – processor).