The GDPR

The introduction of the "single window" mechanism by Article 56 of the Regulation is a major innovation of the Regulation that will significantly ease the lives of the lead controllers in their application of different personal data protection laws.

The mechanism is simple in its principle: in the case of cross-border processing, the Regulation defines the “main” supervisory authority (known as the lead supervisory authority) for the processing activities in the Union on the basis of the principal establishment of the controller or of its unique establishment. The lead supervisory authority will be the sole interlocutor of the controller or the processor for their cross-border processing (Art. 56 (6)).

Article 4 (23) of the Regulations defines “cross-border processing” as:

 

a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or

 

b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

The purpose is to have a single supervisory authority competent to monitor the activities of the controller or the processor carried out throughout the Union and to take the relevant decisions. The competence conferred on the lead supervisory authority aims to promote consistent application of European regulations, to ensure legal certainty and to reduce the administrative burden for the controller and its processors. This lead supervisory authority will be the sole interlocutor of the controller or the processor for their cross-border processing (Art. 56 (3)).

The concept of main establishment is defined in Article 4 (16) depending on whether the main establishment of the controller or the processor is located in several Member States:

- with regards to the controller, its main establishment depends on the place of its central administration in the Union. However, if the decisions on the means and purposes of the processing occur in another establishment in the EU and this establishment has the power to have such decisions implemented, then this establishment must be regarded as the main establishment;

- with regards to the processor, its main establishment is determined by the place of its central administration in the Union. In the absence of central administration in the Union, its main establishment depends on where the essential processing activities are carried out within the activities of an establishment of a processor, provided that the processor is subject to specific obligations under the Regulations.

By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State (Article 56 (2)). In this case, the supervisory authority must notify the lead supervisory authority. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.

Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply paragraph 4). The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision that the latter must take into account in the elaboration of its draft decision, which must be communicated to the supervisory authority in compliance with Article 60 (2).

Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62. This clarification requires close cooperation between the supervisory authorities (paragraph 5).

The Directive

Under Article 28, paragraph 1 and 6, of the Directive, each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, in the territory of its own Member State, the powers conferred on it to ensure the compliance with the data protection rules.

However, the Directive did not resolve the issue of the competent authority when the controller is established in the territory of several Member States. On the contrary, the Directive specified that when the controller is established in the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable (see Article 4 (1), b));

The absence of an obligation for coordination of the national supervisory authorities in the Directive has led to many problems for companies that operate on a transnational level, because of the application of different national legislations. Often the companies had to determine the applicable law for each establishment and comply with the specific competent national law.

National laws did not provide a solution when the controller is established in the territory of several Member States.

Potential issues

The designation of a single competent supervisory authority in the event of cross-border processing is obviously a good thing. This will not always be easy in practice, given the complexity of the identification rules contained in Article 56 and the concept of main establishment.

Importantly, its predictability is not certain. The competent authority may be different depending on the connection of the violation to the rules to a particular Member State and the decision of division of competences falling onto the lead supervising authority.

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the Lead Supervisory Authority - wp244rev.01 (5 April 2017)

(Endorsed by the EDPB)

Identifying a lead supervisory authority is only relevant where a controller or processor is carrying out the cross-border processing of personal data. Article 4(23) of the General Data Protection Regulation (GDPR) defines ‘cross-border processing’ as either the:

- processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or the

- processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

This means that where an organisation has establishments in France and Romania, for example, and the processing of personal data takes place in the context of their activities, then this will constitute cross-border processing.

Alternatively, the organisation may only carry out processing activity in the context of its establishment in France. However, if the activity substantially affects – or is likely to substantially affect - data subjects in France and Romania then this will also constitute crossborder processing.

Link

Retour au sommaire

European Union

CJEU caselaw

C-230/14 (1 October 2015) - Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court

C-645/19 (15 June 2021) - Facebook Ireland e.a.

1.      Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a supervisory authority of a Member State which, under the national legislation adopted in order to transpose Article 58(5) of that regulation, has the power to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where necessary, to initiate or engage in legal proceedings, may exercise that power in relation to an instance of cross‑border data processing even though it is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, with respect to that data processing, provided that that power is exercised in one of the situations where Regulation 2016/679 confers on that supervisory authority a competence to adopt a decision finding that such processing is in breach of the rules contained in that regulation and that the cooperation and consistency procedures laid down by that regulation are respected.

2.      Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the lead supervisory authority, to initiate or engage in legal proceedings, within the meaning of that provision, that the controller or processor with respect to the cross-border processing of personal data against whom such proceedings are brought has a main establishment or another establishment on the territory of that Member State.

3.      Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where appropriate, to initiate or engage in legal proceedings, within the meaning of that provision, may be exercised both with respect to the main establishment of the controller which is located in that authority’s own Member State and with respect to another establishment of that controller, provided that the object of the legal proceedings is a processing of data carried out in the context of the activities of that establishment and that that authority is competent to exercise that power, in accordance with the terms of the answer to the first question referred.

4.      Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, has brought a legal action, the object of which is an instance of cross-border processing of personal data, before 25 May 2018, that is, before the date when that regulation became applicable, that action may, from the perspective of EU law, be continued on the basis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which remains applicable in relation to infringements of the rules laid down in that directive committed up to the date when that directive was repealed. That action may, in addition, be brought by that authority with respect to infringements committed after that date, on the basis of Article 58(5) of Regulation 2016/679, provided that that action is brought in one of the situations where, exceptionally, that regulation confers on a supervisory authority of a Member State which is not the ‘lead supervisory authority’ a competence to adopt a decision finding that the processing of data in question is in breach of the rules contained in that regulation with respect to the protection of the rights of natural persons as regards the processing of personal data, and that the cooperation and consistency procedures laid down by that regulation are respected, which it is for the referring court to determine.

5.      Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.

Opinion of Advocate General 

Judgment of the Court

Retour au sommaire Retour au sommaire