If you rent addresses for direct marketing and use a lettershop, you could soon be considered a “joint controller” within the meaning of the GDPR—even if you never see the addresses. This radical legal view is taken by the Berlin data‑protection authority and could upend the entire practice of address trading.
The Case: Targeted Advertising Without Direct Data Access
The Berlin authority examined two cases in which companies sent postal advertising via a lettershop. They rented the addresses from address brokers, who selected them using criteria such as “above‑average purchasing power” or “liberal‑intellectual.” The key point: The advertising companies themselves never received the address data. The broker transmitted the selected data directly to the lettershop, which handled the mailing.
The Authority’s Argument: Those Who Set the Criteria Share Responsibility
Despite the lack of data access, the authority classified the advertisers and address brokers as joint controllers under Article 26 GDPR. Its reasoning:
Common purpose: Both parties jointly pursue the purpose of sending direct advertising to a specifically selected target group.
Common means: Both determine the essential means of processing. The advertiser defines the targeting criteria and the letter content. The broker provides the data and selection process.
According to the authority, CJEU case law holds that even those who do not process or access the data can still decide on purposes and means. Because the companies denied this joint responsibility, they naturally had no Article 26 agreement—clearly a violation in the authority’s eyes.
What Does “Joint Controllership” Mean for Your Business?
If this view prevails, the consequences for the advertising industry would be massive. As attorney Dr. Bahr notes, the risk is immense:
Joint and several liability: If there’s a data‑protection breach (e.g., a data leak at the broker), the advertising company would also be fully liable. A fine could be claimed in full from either party.
Article 26 agreement required: Advertisers would have to conclude a complex joint‑controllership agreement with each address broker, precisely regulating who fulfils which GDPR duties.
Complex data‑subject rights: If a recipient requests access under Article 15 GDPR from the advertiser, the company could no longer simply reply, “We have no data about you.” It would share responsibility to provide access together with the broker—requiring entirely new processes.
FAQ: Address Trading & the GDPR — What You Need to Know Now
What exactly is “joint controllership” under Article 26 GDPR?
It exists when two or more companies jointly decide on the purposes and essential means of processing.
Why is an Article 26 agreement so important?
It’s legally required and sets out transparently who is responsible for which duties (e.g., informing data subjects, answering requests). Without it, there’s a standalone GDPR violation.
What does “joint and several liability” mean in plain terms?
In the event of damage or a fine, the authority or the data subject may choose from whom to claim the full amount. The sum cannot simply be split.
What should I do if I rent addresses for advertising?
Monitor this development closely. Proactively talk to your brokers and review contracts. Be prepared for the need for an Article 26 agreement.
Conclusion: A Paradigm Shift in Address Trading Is Looming
The Berlin authority’s position could fundamentally change the rules for direct advertising. Although proceedings are still ongoing and a court decision is expected in 2025, the signal is clear: responsibility for processing is being construed ever more broadly. Companies relying on direct mail with rented addresses must prepare for a new era of shared responsibility and liability.
