Certified Information Privacy Professional – Europe (CIPP/E) — Question 105

If two controllers act as joint controllers pursuant to Article 26 of the GDPR, which of the following may NOT be validly determined by said controllers?

Answer options

• A. The definition of a central contact point for data subjects.
• B. The rules regarding the exercising of data subjects' rights.
• C. The rules to provide information to data subjects in Articles 13 and 14.
• D. The non-disclosure of the essence of their arrangement to data subjects.

Correct answer: D

Explanation

The correct answer is D because joint controllers are required to be transparent with data subjects about their arrangements, including the essence of their agreements. Options A, B, and C can be validly determined by joint controllers as they relate to operational aspects of data management and rights exercise.