Privacy & Information Security Law Blog

On July 9, 2019, the European Data Protection Board (the “EDPB”) adopted Opinion 8/2019 on the Competence of a Supervisory Authority in Case of a Change in Circumstances Relating to the Main or Single Establishment (the “Opinion”) at the request of the French and the Swedish data protection authorities (“DPAs”).

Background – The French and Swedish DPAs’ Initial Request

The French and Swedish DPAs requested that the EDPB examine and issue an Opinion on the following questions: When is the competence of a supervisory authority (“SA”) fixed, rendering subsequent changes in circumstances without effect on its competence and procedure? Should this moment be (1) the initial moment where the complaint is received or, if there is no complaint, when the authority starts looking at the matter; (2) when the authority decides to investigate and contact the controller/processor; (3) when the decision-making procedure is launched; (4) or when the authority renders its decision?

Change of Circumstances Relating to the Main or Single Establishment

A change of circumstances relating to the main or single establishment may occur when the single or main establishment is (1) relocated from an EEA country to another EEA country; (2) moved from or ceases to exist in an EEA country; (3) relocated from a non-EEA country to an EEA country or is set up in an EEA country. In light of this, the EDPB established that to be in one of the above situations, the infringements must be either continuous (i.e., one event consisting of several infringing acts) or of a continuing nature (i.e., that last over a certain period of time).

The EDPB also stresses that a change of circumstances must be effective and proven by the controller. The relocation/creation of the main or single establishment in an EEA country must be more than a bureaucratic step, it must be a change with a lasting purpose.

Article 56 (1) of the GDPR – Lex Specialis

Article 56 (1) of the EU General Data Protection Regulation (“GDPR”) provides that the SA “of the main establishment or of the single establishment of the controller or processor shall be competent to act as [lead SA] for the cross-border processing carried out by that controller or processor.” In light of this, if the main or single establishment of the controller or processor is relocated once a proceeding has been initiated, the SA of the new main or single establishment will be considered as the lead SA if it meets all the requirements. In such case, the controller or processor will benefit from the one-stop-shop mechanism. In any event, the competence of a new SA as lead SA does not mean that the initial SA was not rightfully competent at the time. Hence, the acts taken by the initial SA will remain valid. In the event of a change of lead SA, the initial lead SA and the new lead SA will have an obligation to cooperate according to article 60 of the GDPR.

The Adopted Opinion

The EDPB considers that a change of lead SA can take place before a final decision has been adopted by the initial lead SA, if documented changes in relation to the main or single establishment of the controller or processor occur.

Situation 1: Relocation of another EEA country

• The relocation mid-procedure of the main establishment to another EEA country deprives the first SA of its original competence at the moment where the relocation effectively takes place. The relocation does not retrospectively affect the decisions and actions taken by the first SA.
•  If a proceeding is pending, it will be transferred to the new lead SA where the new establishment is located.
• The first SA will be under the obligation to cooperate with the newly appointed lead SA.

Situation 2: Creation of the main or single establishment in an EEA country (or relocation from a non-EEA country to an EEA country)

• The competence of the lead SA can be changed before a final decision is adopted by the lead SA.
• Every pending proceeding will be transferred to the SA of the new main or single establishment. That SA will become the lead SA.
• The creation of a main or single establishment in an EEA country or its relocation to an EEA country deprives the first SA of its competence. This will entail an obligation to cooperate between the two SAs.

Situation 3: Disappearance of the main or single establishment in an EEA country

• The disappearance of the main or single establishment in an EEA country will deprive the controller of the one-stop-shop mechanism.
• Since the processing will not be considered to be cross-border any more, the SAs will no longer be subject to the cooperation duty and each SA will regain the full jurisdiction on the matter. The SA where the main or single establishment was initially located will remain competent like any other concerned SAs.