# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 3 GDPR Implications
### Data Controllers' and Data Processors' Compliance
On the contrary, those operators may be involved at different stages of that processing of personal data and to different degrees, with the result that the level of liability of each of them must be assessed with regard to all the relevant circumstances of the particular case\". With these two decisions, the CJEU has validated a broad scope of joint controllers and has taken a clear position on the level of involvement in the data processing, the extent of responsibilities of joint controllers at every processing stage, and the degree of their liability. The analysis of the joint controllers is relevant to the ACS because many service providers may qualify as joint controllers, as Figure 3 shows. The public transport operators (PTOs), the OEMs, and cloud service providers may determine the means and data processing purposes of data collection and usage by the ACS. In actuality, in the light of the Facebook ID case, it was held that the notion of joint controllership exists even if the data are not personal. This statement extends the possibilities of joint controllers to other actors who process even anonymized data in the ACS. As far as the obligations and responsibilities, a clear arrangement among the data controllers should arrange the compliance to the regulation and the data subject's rights. It should be noted that the decision about joint controllership may reveal that the very same of the above stakeholders may act as joint controllers in the event of commonly determining the means and purposes of processing. In other cases, though, this interaction concerns a party that processes personal information on behalf of another while both parties may have been involved in joint operations that precede or are subsequent in the overall chain of processing [41]. When the data processing is carried out on behalf of the data controller, the entity performing the processing acts as a data processor. Under Article 4, a data processor can be a natural or legal person, public authority, agency, or other body. Article 28(1) of the GDPR necessitates that only processors providing sufficient guarantees to implement appropriate technical and organizational measures should be engaged by a controller. Although the definitions of the data controllers and data processors are clear by law, there is perplexity around the identification of the data controllers and the data processors in the ACS ecosystem [42]. This perplexity can be justified due to the fact that the roles of data controllers and data processors change rapidly. This may also mean that when a processor acts in a way that infringes the contract or another legal act or makes decisions in an autonomous way about the purpose and the the means of a specific processing operation, it may qualify as a controller (or a joint controller). When a processor acts as a delegate of the data controller with a mandate to perform specific tasks following specific instructions, this entity remains a processor as long as the duties do not deviate from these responsibilities. It is noted that data processors can engage in the data processing of other entities. The latter entities qualify as sub-processors. Pursuant to Article 29 Section 2, the data controller should provide a prior specific or general written authorization. The GDPR has a detailed description of the legal relationship among controllers and processors. The basis is a contract or other legal act under Union or Member State law that is binding. This legal document sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. Article 28 Section 3 of the GDPR enlists the specific processing duties that this legal act describes [7]. Inter alia, data processors should take all security measures required under Article 32, such as a data pseudonymization and encryption that will be reviewed in the section hereafter.