The Data ownership for an automated server running for years prior to GDPR Regulations

Question

Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various nationwide medical centers collecting survey data. This server is automated to receive and transmit data to/from servers at certain times using crontab jobs. If you're no computer expert, you can think of this like an alarm-trigger which will run a certain job without any human intervention at certain times in a day/month, provided that the device is powered on and is not blocked off from hardware resources. So in theory, this server could continue to run the same jobs for decades to come, with no human ever interacting with the device itself.

Now, a number of studies are conducted using data collected by this server, over the course of the next few years, with scrupulous adherence to any and all red tape. Ethics committees, patient concerns, you name it! Such was the case until about 2016 when the researchers who were using the system diverted their attention to other projects for a time. Unfortunately for those researchers, this was also around the time that the GDPR was passed, bringing a lot of new requirements that data owners/controllers have to adhere to.

The year is now 2021, and the researchers find themselves under investigation for allegedly having breached data regulations. But interestingly there has been no action on the part of these researchers for years! The machine-scheduled data collection/transmission jobs have continued to run all this time, but there has not been any update to this data in years. If anything, a good portion of the code has been commented out; so the network requests aren't really doing anything besides establishing connections. The data did follow an anonymization rule.

But the biggest issue this research group now faces, is that they are not able to determine who controls the data. Remember, this system has been self-automated in the confines of a university room for ages. And since it was a collaborative project, the person heading the data was designated only informally, from time to time. And without having ever appointed an official data controller, they find themselves in a difficult position, unable to point to an authority or entity responsible for the data.

I understand that these researchers are (likely) immune from retroactive prosecution, but can anyone here tell me how the researchers can hope to build a case in their defense, when the prosecution expects of them to fulfill roles which had never been appointed?

Answer 1

There are a number of misconceptions in this question.

Firstly, the regulatory environment did not drastically change when the GDPR came into force in 2018. Previously, each EU member state had its own laws implementing the 95/46/EC Data Protection Directive. The GDPR harmonizes these laws, and replaces them with a single EU-wide law. However, the GDPR is largely identical with the DPD. In particular, both laws have the same definition of a controller.

Secondly, the data controller is not a position to be designated, like a Data Protection Officer would be. A controller is whoever – alone or jointly with others – determines the purposes and means of processing of personal data. Whether someone can decide the purposes of processing is a matter of fact, not a matter of formalities. There can be more than one controller.

Most likely, the institution hosting the research group is the controller. For individual researchers, the important aspect would be to demonstrate that they've fully complied with their institution's procedures at all times – that they acted as agents of the controller, not as controllers of their own.

The institution might have a more difficult time mounting the defense if its technical and organizational measures were inadequate. For example, keeping an unattended server running for five years without security updates borders on gross negligence – so there should have been a procedure so that each system has a clear point of contact who is responsible for administrating the system. The controller should also have inventoried its systems and processing activities at the latest in preparation of GDPR, e.g. for an Art 30 record of processing activities.

Your question suggests that no one could be at fault because no one did anything, but inaction and failure to fulfil responsibilities can also be a violation of law. If the institution wasn't convinced that this server was GDPR-compliant, the correct approach would have been to shut the server down, not to continue the processing of personal data. Of course, the controller may be able to demonstrate that this breach of GDPR was very minor, for example because the personal data was pseudonymized and because other technical measures (like firewalls) would have prevented unauthorized access.