Can the concept of “controller” set out in Article 4(7) of the GDPR be interpreted as meaning that a person who is planning to acquire a data collection tool (mobile application) by way of public procurement, irrespective of the fact that a public procurement contract has not been concluded and that the created product (mobile application), for the acquisition of which a public procurement procedure had been used, has not been transferred, is also to be regarded as a controller?

An entity can be a controller if it influences the purposes and means of processing, even without a contract or actual data processing.

Can joint control of data in accordance with Article 4(7) and Article 26(1) of the GDPR be interpreted exclusively as involving deliberately coordinated actions in respect of the determination of the purpose and means of data processing, or can that concept also be interpreted as meaning that joint control also covers situations in which there is no clear “arrangement” in respect of the purpose and means of data processing and/or actions are not coordinated between the entities?

Joint control does not require a formal arrangement; it suffices if entities jointly determine purposes and means of processing.

If the determination of actual data processing operations is relevant for the interpretation of the concept of “controller”, is the definition of “processing” of personal data under Article 4(2) of the GDPR to be interpreted as also covering situations in which copies of personal data have been used for the testing of IT systems in the process for the acquisition of a mobile application?

Using personal data for IT testing is 'processing' unless data is anonymized or fictitious.

Is the provision in Article 83(1) of the GDPR to the effect that “administrative fines… shall… be effective, proportionate and dissuasive” to be interpreted as also covering cases of imposition of liability on the “controller” when, in the process of the creation of an IT product, the developer also performs personal data processing actions, and do the improper personal data processing actions carried out by the processor always give rise automatically to legal liability on the part of the controller?

Fines require intentional or negligent infringement by a controller, and controllers can be liable for processors' actions on their behalf.

Entities can be controllers without performing data processing if they influence processing purposes and means.

European Court of Justice (Grand Chamber) · 5 december 2023 · Judgment · Preliminary ruling

(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Article 83 – Imposition of administrative fines – Conditions – Requirement that the infringement be intentional or negligent – Responsibility and liability of the controller for the processing of personal data carried out by a processor)

Rechtsvraag

Whether the NVSC can be considered a 'controller' under Article 4(7) of the GDPR for the processing of personal data through a mobile IT application, despite not having performed any data processing operations, expressly agreed to such processing, or acquired the application.

Regel

Article 4(7), GDPR (Defines 'controller' as a person or entity that determines the purposes and means of processing personal data)
Article 26(1), GDPR (Joint controllers are those who jointly determine the purposes and means of processing)
Article 4(2), GDPR (Defines 'processing' as any operation on personal data)
Article 83, GDPR (Conditions for imposing administrative fines, requiring intentional or negligent infringement)

Conclusie

The court concluded that NVSC could be considered a controller under the GDPR, as it participated in determining the purposes and means of processing the data, even though it did not directly process data or acquire the application. NVSC and ITSS are joint controllers, and NVSC can be subject to fines if it intentionally or negligently infringed the GDPR. Processing includes IT testing with personal data unless anonymized or fictitious.

Tijdlijn

24-03-2020 The Minister for Health of the Republic of Lithuania instructed the Director of the NVSC to organize the immediate acquisition of an IT system for the registration and monitoring of data of persons exposed to COVID-19 for epidemiological follow-up.
27-03-2020 A representative of the NVSC informed UAB 'IT sprendimai sėkmei' (ITSS) by email that the NVSC had selected it to create a mobile application for monitoring COVID-19 exposure.
04-04-2020 The mobile application was made available for download in the Google Play Store.
06-04-2020 The mobile application was made available for download in the Apple App Store.
10-04-2020 The Minister for Health decided to entrust the Director of the NVSC with the task of organizing the acquisition of the mobile application from ITSS, using Article 72(2) of the Law on Public Procurement.
15-05-2020 The NVSC asked ITSS not to make any reference to the NVSC in the mobile application.
18-05-2020 The State Data Protection Inspectorate (VDAI) initiated an investigation relating to the processing of personal data through the mobile application.
26-05-2020 The mobile application was operational until this date.
04-06-2020 The NVSC informed ITSS that it had terminated the procedure for acquiring the application due to a lack of funding.
24-02-2021 The VDAI imposed an administrative fine of EUR 12,000 on the NVSC and EUR 3,000 on ITSS for infringement of GDPR articles.
22-10-2021 The NVSC challenged the VDAI's decision before the Regional Administrative Court, Vilnius, Lithuania.
12-11-2021 The Court of Justice of the European Union received a request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.