Let's go back to the early 2010's. A group of researchers get together to build a collaborative data repository. A server is set up to receive data for aggregation and processing from various nationwide medical centers collecting survey data. This server is automated to receive and transmit data to/from servers at certain times using crontab jobs. If you're no computer expert, you can think of this like an alarm-trigger which will run a certain job without any human intervention at certain times in a day/month, provided that the device is powered on and is not blocked off from hardware resources. So in theory, this server could continue to run the same jobs for decades to come, with no human ever interacting with the device itself.
Now, a number of studies are conducted using data collected by this server, over the course of the next few years, with scrupulous adherence to any and all red tape. Ethics committees, patient concerns, you name it! Such was the case until about 2016 when the researchers who were using the system diverted their attention to other projects for a time. Unfortunately for those researchers, this was also around the time that the GDPR was passed, bringing a lot of new requirements that data owners/controllers have to adhere to.
The year is now 2021, and the researchers find themselves under investigation for allegedly having breached data regulations. But interestingly there has been no action on the part of these researchers for years! The machine-scheduled data collection/transmission jobs have continued to run all this time, but there has not been any update to this data in years. If anything, a good portion of the code has been commented out; so the network requests aren't really doing anything besides establishing connections. The data did follow an anonymization rule.
But the biggest issue this research group now faces, is that they are not able to determine who controls the data. Remember, this system has been self-automated in the confines of a university room for ages. And since it was a collaborative project, the person heading the data was designated only informally, from time to time. And without having ever appointed an official data controller, they find themselves in a difficult position, unable to point to an authority or entity responsible for the data.
I understand that these researchers are (likely) immune from retroactive prosecution, but can anyone here tell me how the researchers can hope to build a case in their defense, when the prosecution expects of them to fulfill roles which had never been appointed?