gdpr data-ownership data
Can two or more different entities simultaneously be data controllers for the same data?
<p>Suppose Alice is a customer of a business ACME who holds data on her like email correspondence. ACME uses a third party to manage their email, suppose Fastmail.fm. Fastmail.fm in turn delegates their data storage to a fourth party like Amazon’s AWS or Microsoft’s Azure, or to make it even more fun, perhaps Snowflake stands in between Fastmail and Azure.</p>
<p>Can Alice SAR any of those entities for her correspondence with ACME, or only one or some of them?</p>

<h2>Not in the example</h2>
<p>Alice is a customer of ACME. ACME is the Data Controller. ACME contracts Fastmail as a <em>Data Processor</em>.</p>
<p>Data Processors are different from Data controllers.</p>
<h2>Yes in general</h2>
<p>Let's say Alice is a customer of Amazon Prime and watches Twitch. The accounts are linked. Twitch and Amazon are joint Data Controllers on some data (though one is a subsidiary of the other).</p>
<p>Now, Alice links her account for a game. Both Amazon/Twitch and the game now are both data controllers on <em>some</em> data (usually: user name on both platforms and some kind of ID are shared), but they don't share <em>all</em> data either has.</p>
<p>The game and Amazon as well as Twitch are Data Controllers, each with different data amounts and in some cases, jointly administring <em>some</em> data.</p>
