Invalid Consent and Unclear Controller Roles Lead to GDPR Violation in Invisalign Data Processing
Align Technology's relationship with its data processing partner was not properly defined, leading the Estonian DPA to determine that Align Technology functioned as a joint controller rather than a mere processor — a critical legal distinction under GDPR. Patient consent was rendered invalid because individuals were not given sufficient information about how their data would be used or the legal bases for processing. This matters because improperly structured data-sharing agreements and vague consent mechanisms expose both parties to regulatory liability and erode patient trust. Organizations that rely on third-party services must rigorously audit the nature of those relationships to ensure contractual and legal roles accurately reflect operational reality.
Tactical Insight
Immediate actions
- Audit all third-party data processing agreements to verify whether vendors exercise enough control to qualify as joint controllers under GDPR Article 26.
- Review and update patient/user consent forms to ensure they clearly state the legal basis for processing, the identity of all controllers, and the purposes of data use.
Long-term improvements
- Establish a formal Data Protection Impact Assessment (DPIA) process for any new third-party service that handles personal data.
- Implement a periodic review cycle (at least annually) for all Data Processing Agreements (DPAs) to reflect changes in vendor relationships or processing activities.
- Maintain a comprehensive Records of Processing Activities (RoPA) register as required by GDPR Article 30 to track all data flows and controller/processor roles.
Governance & oversight measures
- Appoint or empower a Data Protection Officer (DPO) to validate the legal classification of all data-sharing relationships before contracts are signed.
- Train legal, procurement, and product teams on the distinction between data controllers, joint controllers, and processors to prevent misclassification at the contract stage.