EU Court of Justice · 5 December 2023
Nacionalinis visuomenės sveikatos centras
In plain English
Lithuania's public health centre, which had a COVID-19 app developed, could be a controller although it processed no data itself. Joint control needs no formal agreement between the parties, and fines require intent or negligence.
What the court ruled
the classification of two entities as joint controllers does not require that there be an arrangement between those entities regarding the determination of the purposes and means of the processing of personal data in question; nor does it require that there be an arrangement laying down the terms of the joint control.
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the court’s own records is authoritative. The plain-English line is Fino’s own summary, not legal advice.