The GDPR

The introduction of the "single window" mechanism by Article 56 of the Regulation is a major innovation of the Regulation that will significantly ease the lives of the lead controllers in their application of different personal data protection laws.

The mechanism is simple in its principle: in the case of cross-border processing, the Regulation defines the “main” supervisory authority (known as the lead supervisory authority) for the processing activities in the Union on the basis of the principal establishment of the controller or of its unique establishment. The lead supervisory authority will be the sole interlocutor of the controller or the processor for their cross-border processing (Art. 56 (6)).

Article 4 (23) of the Regulations defines “cross-border processing” as:

 

a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or

 

b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

The purpose is to have a single supervisory authority competent to monitor the activities of the controller or the processor carried out throughout the Union and to take the relevant decisions. The competence conferred on the lead supervisory authority aims to promote consistent application of European regulations, to ensure legal certainty and to reduce the administrative burden for the controller and its processors. This lead supervisory authority will be the sole interlocutor of the controller or the processor for their cross-border processing (Art. 56 (3)).

The concept of main establishment is defined in Article 4 (16) depending on whether the main establishment of the controller or the processor is located in several Member States:

- with regards to the controller, its main establishment depends on the place of its central administration in the Union. However, if the decisions on the means and purposes of the processing occur in another establishment in the EU and this establishment has the power to have such decisions implemented, then this establishment must be regarded as the main establishment;

- with regards to the processor, its main establishment is determined by the place of its central administration in the Union. In the absence of central administration in the Union, its main establishment depends on where the essential processing activities are carried out within the activities of an establishment of a processor, provided that the processor is subject to specific obligations under the Regulations.

By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State (Article 56 (2)). In this case, the supervisory authority must notify the lead supervisory authority. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.

Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply paragraph 4). The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision that the latter must take into account in the elaboration of its draft decision, which must be communicated to the supervisory authority in compliance with Article 60 (2).

Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62. This clarification requires close cooperation between the supervisory authorities (paragraph 5).

The Directive

Under Article 28, paragraph 1 and 6, of the Directive, each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, in the territory of its own Member State, the powers conferred on it to ensure the compliance with the data protection rules.

However, the Directive did not resolve the issue of the competent authority when the controller is established in the territory of several Member States. On the contrary, the Directive specified that when the controller is established in the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable (see Article 4 (1), b));

The absence of an obligation for coordination of the national supervisory authorities in the Directive has led to many problems for companies that operate on a transnational level, because of the application of different national legislations. Often the companies had to determine the applicable law for each establishment and comply with the specific competent national law.

National laws did not provide a solution when the controller is established in the territory of several Member States.

Potential issues

The designation of a single competent supervisory authority in the event of cross-border processing is obviously a good thing. This will not always be easy in practice, given the complexity of the identification rules contained in Article 56 and the concept of main establishment.

Importantly, its predictability is not certain. The competent authority may be different depending on the connection of the violation to the rules to a particular Member State and the decision of division of competences falling onto the lead supervising authority.

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the Lead Supervisory Authority - wp244rev.01 (5 April 2017)

(Endorsed by the EDPB)

Identifying a lead supervisory authority is only relevant where a controller or processor is carrying out the cross-border processing of personal data. Article 4(23) of the General Data Protection Regulation (GDPR) defines ‘cross-border processing’ as either the:

- processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or the

- processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

This means that where an organisation has establishments in France and Romania, for example, and the processing of personal data takes place in the context of their activities, then this will constitute cross-border processing.

Alternatively, the organisation may only carry out processing activity in the context of its establishment in France. However, if the activity substantially affects – or is likely to substantially affect - data subjects in France and Romania then this will also constitute crossborder processing.

Link

Retour au sommaire

European Union

CJEU caselaw

C-230/14 (1 October 2015) - Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court

Retour au sommaire Retour au sommaire