Separate and Joint Controllership in Data Protection Law: Conditions, Consequences, Evolution

The controller is a key concept of the General Data Protection Regulation. He is responsible for the processing of personal data in all its aspects, from the information to be provided to data subjects to his liability for an infringement of the GDPR. The general concept of a controller has been in existence since the first data protection laws of the seventies. However, after several decades of EU data protection laws his conditions are still nebulous. This manifests clearly in processing scenarios with multiple actors. This thesis examines the relevance of the controller within the framework of the GDPR, his history and analyzes the different elements of his definition. The main focus of this analysis is the concept of joint controllers. The thesis also covers selected consequences of separate and joint controllership and reviews different proposals for further evolution of the concept.