Go back to the main page of the Data Protection Guidance for the organisers
Data Protection Guidance - Question 1
Central online collection system - what are the obligations of the Commission and the representative of the group of organisers as joint controllers?
Applies to Case Scenario 1
As a group of organisers, you must use the Commission’s central online collection system for the online collection of statements of support and the file exchange service for submission of the collected statements of support to Member States for verification.
In such case, the representative of the group of organisers and the European Commission act as joint data controllers, based on a standard joint controllership agreement, which details the obligations of both controllers. The Commission services are provided free of charge.
Under the joint controllership agreement, the Commission takes on the most of the obligations of controllers, among which:
- It operates and maintains the relevant IT systems allowing the collection and storage of statements of support and (optionally) signatories’ emails
- It may send email messages to those signatories who have subscribed to receive information on the initiative progress
- It provides a data protection impact assessment and a record of the processing activities
- It ensures that the signatories are presented with the appropriate privacy statement and that their questions and requests under GDPR/EUDPR are given a proper follow-up
- It ensures the submission of the collected statements of support to Member States for verification and destroys the collected data in line with the applicable data retention periods.
With regard to the processing operations for which the Commission is responsible under the joint controllership agreement, the Data Protection Officer of the Commission monitors the implementation by the Commission of its obligations under EUDPR.
The representative/organisers’ tasks are typically limited to the following:
- They decide the start date and the end date of the collection of statements of support, as well as the date of submission of the collected statements of support to Member State authorities;
- They may send email messages to those signatories who have subscribed to receive information on the initiative progress;
- They refer to the Commission the data subjects' requests for further handling;
- They inform the Commission in case standard data retention time limits need to be adjusted in accordance with Article 19 of the Regulation on the European citizens’ initiative.
References:
- Articles 10, 12, 18 and 19 of the Regulation on the European citizens' initiative
- Articles 24 and 26 of the GDPR, Articles 26 and 28 of the EUDPR
