Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various nationwide medical centers collecting survey data. This server is automated to receive and transmit data to/from servers at certain times using crontab jobs. If you're no computer expert, you can think of this like an alarm-trigger which will run a certain job without any human intervention at certain times in a day/month, provided that the device is powered on and is not blocked off from hardware resources. So in theory, this server could continue to run the same jobs for decades to come, with no human ever interacting with the device itself.

Now, a number of studies are conducted using data collected by this server, over the course of the next few years, with scrupulous adherence to any and all red tape. Ethics committees, patient concerns, you name it! Such was the case until about 2016 when the researchers who were using the system diverted their attention to other projects for a time. Unfortunately for those researchers, this was also around the time that the GDPR was passed, bringing a lot of new requirements that data owners/controllers have to adhere to.

The year is now 2021, and the researchers find themselves under investigation for allegedly having breached data regulations. But interestingly there has been no action on the part of these researchers for years! The machine-scheduled data collection/transmission jobs have continued to run all this time, but there has not been any update to this data in years. If anything, a good portion of the code has been commented out; so the network requests aren't really doing anything besides establishing connections. The data did follow an anonymization rule.

But the biggest issue this research group now faces, is that they are not able to determine who controls the data. Remember, this system has been self-automated in the confines of a university room for ages. And since it was a collaborative project, the person heading the data was designated only informally, from time to time. And without having ever appointed an official data controller, they find themselves in a difficult position, unable to point to an authority or entity responsible for the data.

I understand that these researchers are (likely) immune from retroactive prosecution, but can anyone here tell me how the researchers can hope to build a case in their defense, when the prosecution expects of them to fulfill roles which had never been appointed?

1 Answer 1


There are a number of misconceptions in this question.

Firstly, the regulatory environment did not drastically change when the GDPR came into force in 2018. Previously, each EU member state had its own laws implementing the 95/46/EC Data Protection Directive. The GDPR harmonizes these laws, and replaces them with a single EU-wide law. However, the GDPR is largely identical with the DPD. In particular, both laws have the same definition of a controller.

Secondly, the data controller is not a position to be designated, like a Data Protection Officer would be. A controller is whoever – alone or jointly with others – determines the purposes and means of processing of personal data. Whether someone can decide the purposes of processing is a matter of fact, not a matter of formalities. There can be more than one controller.

Most likely, the institution hosting the research group is the controller. For individual researchers, the important aspect would be to demonstrate that they've fully complied with their institution's procedures at all times – that they acted as agents of the controller, not as controllers of their own.

The institution might have a more difficult time mounting the defense if its technical and organizational measures were inadequate. For example, keeping an unattended server running for five years without security updates borders on gross negligence – so there should have been a procedure so that each system has a clear point of contact who is responsible for administrating the system. The controller should also have inventoried its systems and processing activities at the latest in preparation of GDPR, e.g. for an Art 30 record of processing activities.

Your question suggests that no one could be at fault because no one did anything, but inaction and failure to fulfil responsibilities can also be a violation of law. If the institution wasn't convinced that this server was GDPR-compliant, the correct approach would have been to shut the server down, not to continue the processing of personal data. Of course, the controller may be able to demonstrate that this breach of GDPR was very minor, for example because the personal data was pseudonymized and because other technical measures (like firewalls) would have prevented unauthorized access.

  • 1
    Well said - the law in general prescribes both acts and omissions
    – Dale M
    Jun 21, 2021 at 12:03
  • Since I am not a part of the actual investigation I am referencing here, I did butcher quite a few details (most notably there being international data transfers inside and outside the EU). That being said I would really like to thank you for picking up my slack to provide such a detailed answer. Jun 21, 2021 at 16:13
  • Having the research institution as the data controller WOULD make the most sense, but the funny thing is that this is an internal investigation, initiated by newer management not really up to date with past projects. So what happens if the "de facto" Data Controller doesn't want to assume its responsibility, and pushes the burden on the research group who never "officially" claimed control and ownership of the data in the first place? I mean the logical thing would be to just shut it down without taking people to court, but let's just say that there is a bit of casemongering here. Jun 21, 2021 at 16:19
  • 1
    @madprogramer If this is an internal issue then GDPR doesn't really matter, and the institution can do and demand anything within the bounds of employment law, including suing researchers for skirting their duties. It may have internal rules for who is supposed to be responsible for these servers, and that internal responsibility is likely distinct from the GDPR data controller. It's hard to believe there wouldn't be a clear person to “blame”. Sounds like the server was clearly set up by one research group, and that group's principal investigator is probably on the hook for this oversight.
    – amon
    Jun 21, 2021 at 17:12
  • > keeping an unattended server running for five years without security updates borders on gross negligence This can depends very much, having that server airgapped (no internet, or only restricted outbound, which is very common in industrial equipement) for ex. can pass compliance, even if the server is 10-15y outdated Dec 4, 2021 at 21:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .