Public Announcement on the Notification of Personal Data Processed within Joint Ventures, Consortia and Ordinary Partnerships to VERBIS

In its recent public announcement, the Personal Data Protection Authority (Authority) has clarified certain ambiguities encountered in practice regarding the notification of personal data processed within the scope of activities carried out under structures such as joint ventures, consortia, and ordinary partnerships to the Data Controllers’ Registry Information System (VERBIS). The announcement emphasizes that, as these structures do not have separate legal personality, they should not be registered in VERBIS in their own name; instead, the registration obligation must be assessed with respect to the parties constituting the partnership.

The key points are summarized below:

• Natural and legal person data controllers that process personal data and do not fall within the scope of exemptions are required to fulfil their VERBIS registration and notification obligations. Data controllers that became subject to this obligation after 31 December 2021 are expected to complete their registration and notification within thirty days following the date on which the obligation arises.
• Pursuant to the Personal Data Protection Board’s (Board) decision dated 9 June 2021 and numbered 2021/569, notifications regarding personal data processed within joint ventures, consortia, and ordinary partnerships must be made by the partners forming such structures, if they are already subject to VERBIS registration obligations.
• Partners subject to VERBIS registration must include, in their VERBIS entries, not only the personal data processed within the scope of their own activities but also the personal data processed within the scope of the partnership’s activities.
• In the Board’s examinations, it has been observed that certain joint ventures, consortia, and ordinary partnerships have applied for registration in VERBIS in their own name; it has therefore been deemed necessary to reiterate that such practice is not in compliance with the Board’s decision.
• Accordingly, joint ventures, consortia, and ordinary partnerships must first determine whether their partners are subject to VERBIS registration obligations; where such obligation exists, the relevant partners must also include personal data processed within the scope of the partnership’s activities in their VERBIS notifications.