Hello, I'm James, and I'm Richard, and we are both tech and data specialists from

fieldfisher, Silicon Valley. For today's bite-size legal update, we're talking about the definition

of controllership under the GDPR. So, just before, we of the year, the CJAE released their decision in the case, C-683-21, which also has a complicated

Lithuanian name, but for simplicity, we are going to call the Lithuanian Ministry of Health case.

Today, we're looking at what happened, how the court came to their decision, and what this means you need to do

for your business and its data protection needs. So, Richard, happy New Year. Happy New Year.

Welcome back to a new season of our bite-sized legal update.

It's good to be here.

So I think before we dig into this decision and what it means for the definition of

controllership, Richard, could you maybe just give us a quick summary of what happened and how

we got here?

Yeah, absolutely.

It's definitely worth explaining the background to this case, not only because it's helpful to understand the CJAEU's findings, but also because the facts are quite interesting.

So, Cast your mind's back in March 2020, COVID-19 had gripped the world at that point, and Lithuania's Ministry of Health directed its National Public Health Center to organize a mobile app to help

track and monitor COVID-19 exposure. So the public health center went on to procure this app from an

IT service provider. Again, with a complicated Lithuanian name, I'm not going to try and say it. I'll

probably butcher it. But in any event, they

procured the app from this IT provider and the two parties signed a confidentiality agreement.

However, they didn't yet enter into a procurement contract. The app went on to be developed and

it was published in the Apple App Store and the Google Play Store in May 2020 and made

available for download. The app went on to collect personal data from almost 4,000 users,

including information like name, ID number, contact information and geographic location.

...