GDPR Brief: are university-employed scientific researchers “Data Controllers” for the purposes of the GDPR?

4 May 2020

The individual or entity that determines the purposes and means of processing personal data are ‘Controllers’ under the GDPR. However, in the author’s personal experience, a claim is sometimes made, in relation to Universities and Research Institutions (herein “University”), that there is only one Data Controller, and that is the [President, University Board, etc.]. This is an understandable position insofar as it applies to, for example, the maintenance of student records. Where scientific research is at issue, however, the principal investigator (PI) often “determines the purposes and means of such processing”, and thus would seem to be a Data Controller.

The individual or entity that determines the purposes and means of processing personal data are ‘Controllers’ under the GDPR. However, in the author’s personal experience, a claim is sometimes made, in relation to Universities and Research Institutions (herein “University”), that there is only one Data Controller, and that is the [President, University Board, etc.]. This is an understandable position insofar as it applies to, for example, the maintenance of student records. Where scientific research is at issue, however, the principal investigator (PI) often “determines the purposes and means of such processing”, and thus would seem to be a Data Controller. 

This argument is founded on the premise that a Data Subject would sue the University and not the PI if there is a data protection violation.  This line is strengthened by appeals to the relationship between the PI and the University: the University, as research sponsor, might sign the contract for the work with external funders , or require certain data security measures. Does this determine that the University is, alone, the Data Controller? 

It must be noted first, that there is a great range across Universities and jurisdictions as to how far PIs are independent. For example, it is not always the case that a University signs a contract with a funder, sometimes it is the PI.  It is not helped that there is often a tension in  law as to where liability ends between what the employee does for the employer and what she does in her own right. Universities are vicariously liable for employees, but PIs are employed  for their ability to independently devise and run novel research; devising the purpose and means of the processing of personal data is often left to PIs’ academic skill and integrity. Further, academic freedom requires this independence: it is a matter of public interest that PIs have freedom and control in determining the purpose and means of processing personal data in their research, beyond mere professional integrity.  It is not satisfactory to say that in all cases the University is necessarily the Data Controller.

This position is justified on at least three grounds. First, the GDPR does not require only one Data Controller. The GDPR’s text expressly allows for more than one Data Controller, and Article 26 operationalises this requiring shared, defined responsibility where there is more than one Controller. 

Second, the determination of “who” is a Data Controller is a matter for data protection law alone. The applicable concept is contained in the GDPR and, according to the Article 29 Working Group Opinion 01/2010 at p. 3,  is “related to activities reflecting the life cycle of information from its collection to its destruction, and this needed to be looked at both in detail and in its entirety”.   Determining who is the Data Controller is essential because the Controller’s role is defined in relation to the Data Subject’s rights, ensuring that the Controller’s obligations protect the Data Subject’s interests.

Third, it is not a matter of organisational convenience, but of fact: when one determines the purposes of processing, and supervises that processing, then one owes duties to the Data Subject. That relationship has to be defined clearly, but the duties remain. Applying this to the specific scenario of the PI researcher in the University, it is a matter of professional duty that must be observed, and the responsibilities have to be determined between the Controllers. 

To summarise then: the University is still one of the Joint Controllers, but by acknowledging that the PI is also the Joint Controller, the spirit of the GDPR is operationalised effectively and the rights of the Data Subject respected.

Postscript: This could strike terror into PIs, as the fines for breach of the GDPR are very large. The argument is not that the University could use this argument to escape liability; where a PI-employee is asked or required to determine the purpose and means of the processing of personal data as part of their employment, that is part of exercising the duties of that employment. However, that is a matter for employment law beyond the scope of the GDPR brief.

Further Reading

• EDPS Guidelines on the concepts of controller, processor and joint controllership under Regulation (EU) 2018/1725. 7 November 2019.
• Article 29 Data Protection Working Party Opinion 01/2010 on the concepts of “controller” and “processor”. 00264/10/EN WP 169. 16 February 2010.
• Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. Case C131/12. ECLI identifier: ECLI:EU:C:2014:317, in particular paragrpah 34.

Relevant GDPR Provisions

• Article 4(7) – definition of controller
• Article 4(8) – definition of processor
• Article 26 – joint controllers

David Townend is Professor of Law and Legal Philosophy in Health, Medicine and Life Sciences at Maastricht University.

Acknowledgment: I am very grateful to my colleagues. Their comments helped me to refine this piece. The errors remain mine alone. 

See all previous briefs.

Please note that GDPR Briefs neither constitute nor should be relied upon as legal advice. Briefs represent a consensus position among Forum Members regarding the current understanding of the GDPR and its implications for genomic and health-related research. As such, they are no substitute for legal advice from a licensed practitioner in your jurisdiction.