Court decision · 5 December 2023
Nacionalinis visuomenės sveikatos centras v Valstybinė duomenų apsaugos inspekcija
Case C-683/21, ECLI:EU:C:2023:949 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
Commissioning an app makes you a controller for what it does in testing as well as in production; agree responsibilities with the developer in writing before the first build ships to real users.
What happened
A public health centre commissioned a COVID contact-tracing app from a developer. The app collected data from users during testing, and the centre argued it was not a controller because it had never taken delivery of the app or handled the data itself.
What was decided
An organisation that determines why and broadly how an app processes data is a controller even if it never itself processed any data and even if it never formally approved the release. Joint control can arise without any agreement between the parties.
The legal test applied
- An entity that determines purposes and essential means is a controller even without carrying out any processing itself
- Joint control does not require an agreement between the parties
- Processing during testing with real data is processing like any other
- A fine requires the infringement to be intentional or negligent, judged by what the entity could not have been unaware of
What would have changed the outcome
- A commissioner that neither set the purpose nor allowed real-data testing is not a controller for that stage
- Synthetic test data takes the testing phase outside the regime
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.