The recent ruling by the Court of Justice of the European Union (CJEU) decision in the Lithuanian Ministry of Health case grapples with the definition of "controllership" under the GDPR. In this case, nearly 4,000 users' personal data had been collected by a Covid-19 mobile app released to the public without the Lithuanian Ministry's express approval, and yet the Lithuanian ministry were still held liable for the processing.  In this Bytesize Legal Update Fieldfisher's James Russell and Richard Lawne explore the key factors that led to the court's decision;  as well as the key practical takeaways for both controllers and processors.