Understanding Your Role
This guide explains the obligations you have as a joint controller under the GDPR, focusing on verifying consent for processing special category data. We'll look at the Norwegian supervisory authority's EUR 8,600,000 fine against Xandr for processing Grindr users' data without valid consent.
If your organization receives personal data from another party and you jointly determine processing purposes or means, you're likely a joint controller. Here's what that means for your consent obligations.
Key Concepts
Joint controller: Two or more controllers that jointly determine the purposes and means of processing personal data (Article 26 GDPR). You don't need identical purposes or equal influence. If you help decide the "why" or "how," you're involved.
Special category data: Article 9(1) prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, or sexual orientation. The Xandr case involved sexual orientation data (the fact that individuals used Grindr).
Explicit consent: Article 9(2)(a) requires explicit consent for special category data. This means a clear, specific statement, not just an action. Pre-ticked boxes and bundled consent don't qualify.
Accountability principle: Article 5(2) requires you to demonstrate compliance. The Norwegian supervisory authority stated, "accountability cannot be outsourced."
Requirements Breakdown
Article 26: Joint Controllership Arrangement
You must establish an arrangement that clearly outlines:
- Each party's responsibilities for GDPR compliance
- Who handles data subject rights requests
- Who provides transparency information to data subjects
The arrangement must reflect your actual roles. A contract saying "Party A is solely responsible" doesn't override the reality of joint determination.
Article 6(1): Lawful Basis Requirement
Each joint controller must independently verify it has a lawful basis for its processing. You can't assume another party has sorted this out.
In the Xandr case, Xandr relied on Grindr's consent without independently verifying its validity. The supervisory authority found this violated Article 6(1) because Xandr processed personal data without establishing its own lawful basis.
Article 9(1) and 9(2)(a): Special Category Data
If you're processing special category data, you need both:
- A lawful basis under Article 6
- An Article 9(2) exception
For explicit consent under Article 9(2)(a), verify:
- The consent statement clearly identifies the special category data
- The data subject took a deliberate action
- The consent covers your specific processing activities
- The consent wasn't bundled with acceptance of terms or other consents
Articles 4(11) and 7: Valid Consent Criteria
Your verification checklist:
- Freely given: No imbalance of power, no conditional service access for non-necessary processing
- Specific: Separate consent for distinct purposes
- Informed: Data subject understood what they consented to
- Unambiguous: Clear affirmative action required
- Withdrawable: Easy mechanism to withdraw, clearly communicated
- Documented: You can demonstrate when and how consent was obtained
Implementation Guidance
Step 1: Map Your Joint Controller Relationships
List every scenario where you receive personal data from another organization and both of you make decisions about processing. Common examples:
- Advertising technology platforms receiving data from publishers
- Analytics providers receiving data from website operators
- Marketing platforms receiving customer lists from clients
- API integrations where both parties use the data
For each relationship, document who determines what purposes and means.
Step 2: Draft Your Article 26 Arrangement
Don't treat this as a checkbox exercise. Your arrangement should specify:
- Which party verifies consent validity (spoiler: you both do, independently)
- How you'll share evidence of valid consent
- Your process for handling consent withdrawal
- Who responds to DSARs and how you'll coordinate
- How you'll communicate your respective roles to data subjects
Make the essence of this arrangement available to data subjects. A simple "Who's responsible for what" table on your privacy notice works.
Step 3: Build Your Consent Verification Process
Create a procedure for every instance where you rely on another party's consent:
Pre-processing verification:
- Request copies of the consent mechanism (exact wording, interface design)
- Review against Articles 4(11) and 7 requirements
- For special category data, confirm explicit consent was obtained
- Verify the consent covers your specific processing activities
- Check the consent wasn't bundled or conditional
Ongoing verification:
- Set review intervals (at least annually)
- Monitor for changes to the other party's consent mechanism
- Track consent withdrawal rates (high rates signal problems)
- Audit consent records periodically
Evidence retention:
- Keep records of your verification activities
- Document your assessment of consent validity
- Store copies of the consent mechanisms you reviewed
If you can't verify consent validity, don't process the data. Find an alternative lawful basis or don't proceed.
Step 4: Handle Special Category Data with Extra Scrutiny
When the data reveals sexual orientation, health status, religious beliefs, or other Article 9(1) categories:
- Require written confirmation that explicit consent was obtained
- Review the exact consent language (it must name the special category)
- Verify the data subject took deliberate action
- Confirm no bundling with other consents or service terms
- Document your verification more thoroughly than for regular personal data
The Norwegian supervisory authority considered the Xandr infringements "of high seriousness" partly because they involved sensitive data. Supervisory authorities scrutinize special category processing more closely.
Common Pitfalls
Contractual liability shifting: Your joint controllership arrangement might say the other party is "responsible for obtaining consent," but that doesn't discharge your Article 6(1) obligation. You still need to verify.
Assuming technical controls equal consent: Receiving data through an API with authentication doesn't mean consent exists. Technical access control and legal authorization are separate questions.
Relying on "consent" that's really contractual necessity: If the other party tells users "we need this data to provide the service," that's Article 6(1)(b), not consent. You can't process for incompatible purposes (like advertising) on that basis.
Failing to update verification: Consent mechanisms change. A valid consent process in January might be invalid by June if the other party modified their interface or terms.
Not documenting your verification: When a supervisory authority investigates, "we trusted them" isn't accountability. You need records showing what you verified and when.
Quick Reference Table
| Requirement | Your Obligation | Evidence to Keep |
|---|---|---|
| Article 26 arrangement | Document respective responsibilities, make essence available to data subjects | Signed arrangement, public summary |
| Lawful basis verification | Independently confirm valid consent or alternative basis exists | Verification records, consent mechanism copies |
| Special category exception | Verify explicit consent naming the specific category | Consent language review, confirmation of deliberate action |
| Consent validity (Article 7) | Check freely given, specific, informed, unambiguous, withdrawable | Consent interface screenshots, withdrawal mechanism testing |
| Accountability (Article 5(2)) | Demonstrate your verification process | Audit logs, review schedules, assessment documentation |
| Data subject transparency | Inform subjects of joint controllership and how to exercise rights | Privacy notice updates, contact mechanisms |
The Xandr case establishes a clear principle: when you're a joint controller, you own your compliance obligations independently. No contract, technical integration, or business relationship structure changes that. If you can't verify consent validity, you can't process the data lawfully.
