Art. 12 Joint controllership in AGORA | Information sharing system | DSA

This article establishes the joint controller relationships between Digital Services Coordinators when personal data is processed in AGORA.

It builds directly on the controller and processor roles defined in earlier articles, specifically extending those data protection responsibilities to two collaborative scenarios: Board activities and joint investigations.

In both cases, the relevant Digital Services Coordinators collectively share responsibility for how personal data is handled.

The Commission, meanwhile, sits in a processor role for these same activities, acting on behalf of the Digital Services Coordinators rather than as an independent controller.

Important points:

Digital Services Coordinators are joint controllers for personal data processed in AGORA in connection with Board activities and any joint investigations conducted under Regulation (EU) 2022/2065.
The allocation of responsibilities between those joint controllers is governed by Annex I of this Regulation.
The Commission acts as a processor, not a controller, for the personal data processing it carries out on behalf of the Digital Services Coordinators in these contexts.

1. The Digital Services Coordinators shall be joint controllers pursuant to Article 26(1) of Regulation (EU) 2016/679 for the transmission, storage and other processing of personal data in AGORA in respect of the activities of the Board carried out in the context of the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065.
1. When joint investigations are carried out pursuant to Article 60 of Regulation (EU) 2022/2065 in the context of the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065, the concerned Digital Services Coordinators shall be joint controllers, within the meaning of Article 26(1) of Regulation (EU) 2016/679, for the transmission, storage and other processing of personal data in AGORA in the context of a particular joint investigation.
1. For the purposes of paragraphs 1 and 2, responsibilities shall be allocated among joint controllers in accordance with Annex I.
1. The Commission shall be a processor within the meaning of Article 3, point (12), of Regulation (EU) 2018/1725 for the processing of personal data carried out on behalf of the Digital Services Coordinators for the purpose of the activities of the Board, and for joint investigations pursuant to Article 60 of Regulation (EU) 2022/2065 carried out in the context of the supervision, investigation, enforcement and monitoring under Regulation (EU) 2022/2065.