GDPR practice question 6 of 15

Scenario 4: Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want…

Full set: 80 questions
Scenario 4: Berc is a pharmaceutical company headquartered in Paris, France, known for developing inexpensive improved healthcare products. They want to expand to developing life-saving treatments. Berc has been engaged in many medical researches and clinical trials over the years. These projects required the processing of large amounts of data, including personal information. Since 2019, Berc has pursued GDPR compliance to regulate data processing activities and ensure data protection. Berc aims to positively impact human health through the use of technology and the power of collaboration. They recently have created an innovative solution in participation with Unty, a pharmaceutical company located in Switzerland. They want to enable patients to identify signs of strokes or other health-related issues themselves. They wanted to create a medical wrist device that continuously monitors patients' heart rate and notifies them about irregular heartbeats. The first step of the project was to collect information from individuals aged between 50 and 65. The purpose and means of processing were determined by both companies. The information collected included age, sex, ethnicity, medical history, and current medical status. Other information included names, dates of birth, and contact details. However, the individuals, who were mostly Berc's and Unty's customers, were not aware that there was an arrangement between Berc and Unty and that both companies have access to their personal data and share it between them. Berc outsourced the marketing of their new product to an international marketing company located in a country that had not adopted the adequacy decision from the EU commission. However, since they offered a good marketing campaign, following the DPO's advice, Berc contracted it. The marketing campaign included advertisement through telephone, emails, and social medi a. Berc requested that Berc’s and Unty's clients be first informed about the product. They shared the contact details of clients with the marketing company. Based on this scenario, answer the following Questio n: Questio n: Based on scenario 4, to which of the companies can data subjects exercise their rights under GDPR?
Answer options
A: Data subjects may exercise their rights against both Berc and Unty, regardless of the terms of the arrangement. Correct answer
B: Data subjects may exercise their rights against only one of the controllers, as specified in the arrangement.
C: Data subjects may exercise their rights against Berc only because it decided to implement GDPR for data processing activities.
D: None of the above.
Correct Answer:
A. Data subjects may exercise their rights against both Berc and Unty, regardless of the terms of the arrangement.
Explanation

The scenario establishes that Berc (France) and Unty (Switzerland) are joint controllers because they "jointly determined the purpose and means of processing" for the medical wrist device project. According to Article 26(1) of the GDPR, this defines a joint controller relationship. Article 26(3) of the GDPR explicitly states: "Irrespective of the terms of the arrangement... the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers." This provision ensures that data subjects are not burdened with understanding the internal allocation of responsibilities between joint controllers. They have the unequivocal right to approach either company to exercise their GDPR rights, such as the right of access, rectification, or erasure.

Why Incorrect

B. This is incorrect. It directly contradicts Article 26(3) of the GDPR, which grants data subjects the right to exercise their rights against each controller, regardless of what their internal arrangement specifies.
C. This is incorrect. Both companies are joint controllers. Unty's location in Switzerland (an adequate country) does not absolve it of its responsibilities under the joint controllership for this specific processing activity involving EU data subjects.
D. This is incorrect because option A provides the accurate answer based on the legal framework established by the GDPR for joint controllers.

References

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, L 119/1.

Article 26, Paragraph 1: "Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers."

Article 26, Paragraph 3: "Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers."

2. European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1, Adopted on 7 July 2021.

Paragraph 63 (Page 22): "Article 26(3) GDPR specifies that, irrespective of the terms of the arrangement, the data subject may exercise his or her rights under the GDPR in respect of and against each of the controllers. This is an important safeguard to ensure that the data subject can get an effective remedy."

3. De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals? Computer Law & Security Review, 32(2), 179-194.

Section 3.2 (Controllers, processors and their obligations): This section discusses the clarified roles under GDPR, including joint controllership, emphasizing that the framework holds all parties involved in determining the 'why' and 'how' of processing accountable to the data subject. (DOI: https://doi.org/10.1016/j.clsr.2016.02.006)

Keep practicing

Take the free GDPR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other GDPR practice questions

Scroll to Top