edpb_letter_out2023_0044_responsetopipc.pdf

Here are the key points summarized:

Consent

• Consent comes down to determining which controller is involved first with the data subject.
• The European Data Protection Board (EDPB) views this question as dependent on specific circumstances.
• In example 6, the EDPB considers that a social media provider had to collect valid consent before placing advertisement cookies.

Joint Controllers

• Where multiple controllers rely on consent, they should all be named.
• If some joint controllers are not known at the time of seeking consent, further information and consent may be needed.
• The website operator embedding a social media plugin must obtain consent to transmit personal data to the social media provider.

Data Processing Practices

• The EDPB cannot provide legal advice on specific cases outside its remit or make general statements about controller practices in third countries.

National Decisions

• National decisions are taken based on specific circumstances and do not cover controller practices in third countries' jurisdictions.