# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 3 GDPR Implications
### Data Controllers' and Data Processors' Compliance  
The data controllers play a crucial role in the course of processing as they decide its purposes and means. A data controller can be a natural or legal person, a public authority, an agency, or other bodies. The core responsibilities of the data controllers involve [7]:  
* The implementation of the data processing principles (Articles 5-11). * To inform data subjects as elaborated in Section 3.1 and secure their rights (Articles 12-23). * The implementation of security measures such as the deployment of privacy-preserving techniques discussed in Section 4 (Articles 5, 25, and 32). * The arrangements with the joint controller (if any) (Article 26). * The engagement of processors (Article 28). * The notification of personal data breach to the relevant data protection authority (Article 33). * The communication of personal data breach to the data subjects (Article 34). * The realization of DPIA (Article 35). * The designation of the Data Protection Officer (Article 37). * The transfer of data to third countries (Chapter V, Articles 44-50). * The communication with the DPAs (Articles 31, 36, and 37). * The compliance with specific processing situations (Articles 85-91). * Retain all the necessary documentation and records (as listed throughout GDPR articles). The existence of two or more data controllers makes the involved parties \"joint controllers\" by virtue of Article 26 of the GDPR. Based on this article, two entities meet the requirements of joint controllers when they \"jointly\" determine the purposes and means of processing. If the criterion of joint decision is missing, then the stakeholders are not \"joint\" but sole data controllers. The EDPB with its recent guidelines on data controllers and data processors shed light on the ambiguity regarding the respective roles of joint controllers. Under Article 26, the joint controllers need to clearly define their respective compliance obligations, especially with regard to the exercising of data subjects' rights and the provision of information under Articles 13 and 14 of the GDPR. With regards to the legal relationship among the joint data controllers, the GDPR does not require a specific legal binding act. Nevertheless, for reasons of legal certainty, the EDPB recommends a contract or other legal act under EU law to identify the specific obligations that (joint) controllers have. In general, the principles of transparency and accountability of the data controller are applicable to all the joint controllers. Therefore, the responsibilities enlisted above extend to them. This practically means that joint controllers are responsible for demonstrating compliance to the GDPR based on their specific obligations as described in the contract or any other legal act, and noncompliance may result in administrative fines under Article 83 [36]. The Court of Justice of the European Union (CJEU) has adopted a broad definition regarding the notion of joint controllers and the allocation of their responsibilities. In a 2019 decision, in the Facebook Fan Pages case, the Court held that the administrators of Facebook fan pages are joint controllers together with Facebook. Although they had access only to anonymized statistical data and not to any personal data by creating the fan webpage, the administrators allowed to Facebook to collect data and made it joint controller. This judgment also stated that \"the existence of joint responsibility does not necessarily imply equal responsibility of the various operators involved in the processing of personal data\" [39]. Further, in another notable case, the Facebook Fashion ID case [40] it was held that the \"existence of joint liability does not necessarily imply equal responsibility of the various operators engaged in the processing of personal data.