Personal data controllers and device producers: Mind the gap

摘要（出版方所载原文摘要）

It seemed well established that producing a smart device could not, by itself, render someone a personal data controller in the absence of subsequent influence over the processing operations (the influence thesis). In contrast, legal scholars have introduced a new interpretation of European data protection law that seeks to apply the General Data Protection Regulation (GDPR) to the processing operations of smart devices even if no entity influences the processing remotely after the release of the product. This approach classifies producers as personal data controllers for device-based processing (producer-controller thesis). The proponents of the producer-controller thesis highlight the increasing importance of smart devices that store data locally and the need for protecting consumers’ rights in that context. However, as this paper claims, the GDPR is not the proper legal instrument for addressing the safety standards of smart products that process data locally. These considerations relate to legislative texts that prescribe product requirements, such as the AI Act and the Cyber Resilience Act. On those grounds, the present work criticises the producer-controller thesis. As this paper concludes, expanding the concept of ‘controller’ to encompass producers of smart devices does not enhance the protection of the data subjects and does not fit within the current data protection framework of the European Union.

出处：Personal data controllers and device producers: Mind the gap，Computer Law & Security Review, Vol. 58 (2025), Art. 106172（开放获取）。

作者：Efstratios Koulierakis（希腊雅典大学法学院 NKUA 法律·信息学与人工智能实验室）

收录：SSCI 收录（Law 类）；据 WoS Journal Info 聚合页核验。

直链：10.1016/j.clsr.2025.106172 （DOI 解析；题录经 Crossref API 逐条比对一致）

主题：数据生态与比较监管路径