Certified Information Privacy Professional – Europe (CIPP/E) — Question 218

Two companies, Gellcoat and Freifish, make plans to launch a co-branded product, the prototype of which is called Gellifish 5337. The companies want to organize an event to introduce the new product, so they decide to share data from their client databases and come up with a list of people to invite. They agree on the content of the invitations and together build an app to gather feedback at the event.

In this scenario, Gellcoat and Freifish are considered to be?

Answer options

• A. Joint controllers with respect to the personal data related to the event and separate controllers for their other purposes.
• B. Joint controllers for all purposes because they have merged their databases and their data is now jointly owned.
• C. Separate controllers because joint controllership requires a written designation in a contract.
• D. Separate controllers and processors since they are each providing services to the other.

Correct answer: A

Explanation

The correct answer is A because Gellcoat and Freifish are collaborating specifically for the event, which makes them joint controllers for that data. However, they maintain separate control over their other data processing activities, which is not shared in this instance. Options B, C, and D do not accurately reflect the nature of their relationship regarding the shared data for the event.