Skip to content
Case Law
EN

Jehovah’s Witnesses

Jehovah’s Witnesses

C-25/17 Case
CJEU
Joint controllership

Case Excerpts (3)

summary
Access: Exercise of the right to access cannot be systematically denied on the basis of privacy violations without analyzing the specific circumstances. (¶¶ 89-94)
excerpt
71. As to the question whether the data controller must necessarily have access to that data, I note once more that such a requirement is not included in the definition given by Directive 95/46. That is also the view of the ‘Article 29’ Working Party, according to which inability to fulfil directly all the obligations of a controller, such as right of access, does not exclude the possibility of being a controller(66) It is even precisely for that type of situation that Directive 95/46 expressly provides that control may be exercised jointly. (67) I therefore fully concur here with the view expressed by Advocate General Bot that ‘any interpretation which focuses on the existence of complete control over all aspects of data processing is likely to result in serious lacunae in the protection of personal data’. (68)
excerpt
72. I shall therefore conclude the analysis by stating that, in the context of the case in the main proceedings, any finding of control by the religious community in no way excludes a parallel finding of shared control by the members of that community, since ‘the assessment of this joint control should mirror the assessment of “single” control, by taking a substantive and functional approach and focusing on whether the purposes and the essential elements of the means are determined by more than one party. The participation of parties in the determination of purposes and means of processing in the context of joint control may take different forms and does not need to be equally shared.’ (69) However, it seems apparent from the facts as presented to the Court by the referring court that members of the religious community can have a practical effect on the means of processing (in targeting the persons who will be visited, deciding whether to take notes, choosing the medium for those notes, determining the extent of the data collected, etc.).

GDPR Articles Cited (1)