ABSTRACT
The current understanding of ‘controllership’ in the GDPR typically excludes manufacturers from this role where processing of personal data occurs locally only, ie, on the produced device without processing by the manufacturer. The ‘user’ of such a device is deemed to be the only possible controller, regardless of whether the processing falls under the household exemption or not. This is because the concept is understood more narrowly than its actual definition permits. However, in particular the development of ‘smart’ devices with ‘local’ or ‘edge’ computing upends the assumption that device manufacturers automatically fall outside the scope of the GDPR. Device manufacturers may often have sufficient influence on the processing to be deemed ‘controllers’, even where personal data is processed on-device only without any processing by the manufacturer. This expanded understanding of the concept of controllership is supported by CJEU and Supervisory Authority case law and an interpretation of the GDPR.
Dahi, Alan and Corrales Compagnucci, Marcelo, Device Manufacturers as Controllers – Expanding the Concept of ‘Controllership’ in the GDPR.
First posted 2022-04-22 17:30:50
Leave a Reply