Joint Controller Agreement: What Is the Function of the Joint Controller Agreement in Sharing Personal Data with a Large Research Consortium or Biobank Infrastructures?

The governance of a research project by a consortium or biobank infrastructure raises the question of contracts for data management. The case in which personal data are shared with a large research consortium or biobank infrastructure commonly arises. According to the GDPR, organisations are obliged to demonstrate that their processing activities are compliant with the data protection principles, and an arrangement between joint controllers can help organisations to demonstrate compliance with all the principles of the Regulation: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality. In the case of a biobank, two or more public bodies are the controllers of the personal data, and the processing of the data takes place in an intra-group context. A joint controller agreement is strongly recommended because its core contractual clauses are able to clarify the distribution of control and the responsibility and liability of the controllers.