The respective data protection obligations of any joint controller shall be established in accordance with Article 28 of Regulation (EU) 2018/1725.

In the event that the ECB acts as a joint controller together with one or more controllers, the responsibilities of the joint controllers for compliance with data protection obligations shall be determined by arrangement between them unless and in so far as those responsibilities are determined by Union or Member State law to which the joint controllers are subject.