Device Manufacturers as Controllers: Expanding the Concept of ‘Controllership’ in the GDPR

Research output: Contribution to journalJournal articleResearchpeer-review


In the past, AI-devices offloaded their processing to the cloud, clearly implicating the provider of the cloud as either a controller or a processor under the General Data Protection Regulation (GDPR). Increasingly, however, AI-driven processing is moving away from the cloud. Dedicated AI chipsets embedded in mobile clients and various edge devices now provide on-device predictions. A smart phone can screen for skin melanomas without sending any data to the cloud or app developer, and a bedside patient monitoring system can process locally in the hospital without sending any personal data to the device manufacturer. Such localised processing reveals underlying problems of how responsibility within data protection is allocated. For example, device manufacturers are typically deemed to fall outside the scope of the GDPR. This paper argues that the current understanding of the controller/processor framework is too narrow in scope and calls for a revised understanding of the framework. This is demonstrated through various processing scenarios and a teleological interpretation of the GDPR and CJEU decisions.

Original languageEnglish
Article number105762
JournalComputer Law and Security Review
Number of pages36
Publication statusPublished - 2022

Number of downloads are based on statistics from Google Scholar and

No data available

ID: 287694036