On Joint Controllerships
The fact that two controllers share the same data does not automatically mean that they are ‘joint controllers’. To be considered as such, they must jointly determine the purpose and means of the processing of personal data. A person who books a holiday via a travel agent, and the travel agent forwards the person’s data details to their chosen airline and hotel does not make the airline and hotel joint controllers. They are holding the same data but for separate and distinct purposes.
A good example of joint controllers are intercorporate groups. A parent company may provide centralized IT services to its subsidiaries, including a centralized database for employee or customer records. If the parent company conducts its own independent operations on the data, for example, to compare the rates of employee turnover across the group, it may become a joint controller with its subsidiaries.