PL EN
Book a meeting
Chapter 1Basic Compliance
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 1.12
  1. 1.1The GDPR: The EU’s ‘Act’ on Personal Data Protection
  2. 1.2Material and Territorial Scope of the GDPR
  3. 1.3GDPR Glossary: Notes on Basic GDPR Terms, with Examples
  4. 1.4Personal Data Processing Principles
  5. 1.5Legal Basis for Personal Data Processing
  6. 1.6Articles 9 and 10 GDPR: Special Categories of Data and Data on Criminal Convictions
  7. 1.7Consent as Basis for Processing Personal Data
  8. 1.8The Controller and Processor
  9. 1.9Data Processing Which Does Not Require Identification
  10. 1.10Record of Data Processing Activities
  11. 1.11Transfer of Data to Third Countries or an International Organisation (Data Export)
  12. 1.12Cross-Border Processing, i.e. Competence of the Lead Supervisory Authority (Article 4(16) and (23), Article 56 GDPR)
  13. 1.13Joint Controllers
  14. 1.14Codes of Conduct and Certification (Article 40 Onwards of the GDPR)

Cross-Border Processing, i.e. Competence of the Lead Supervisory Authority (Article 4(16) and (23), Article 56 GDPR)

Katarzyna Kloc, Maciej Gawronski, Marcin Dominiak, Michał Sztaberek, Patrycja Naklicka & Paweł Punda

#12.1 Preliminary Remarks

Under Article 4(23) GDPR:

‘cross-border processing’ means:

  1. a)processing of personal data which takes place [1] in the context of the activities [2] of establishments in [3] more than one member state [4] of a controller or [5] processor in the EU where the controller or processor is established in more than one member state, or
  2. b)processing of personal data which takes place [1a] in the context of the activities [2a] of a single establishment of a controller or [3a] processor in the EU but which [4a] substantially affects or is likely to substantially affect data subjects in more than one member state.

Therefore it appears that EU law is a result of a number of compromises.

#12.2 One-Stop-Shop

Cross-border processing is a notion that is relevant to companies and capital groups active in more than one EU Member State. For activity spanning multiple Member States, GDPR provides that the supervisory authority competent for the main establishment has jurisdiction (one-stop-shop).

In practice, the one-stop-shop rule means that when an organisation operates in a number of EU countries at one time, in principle the authority competent for the main establishment can impose penalties for the manner of conducting business or monitor an organisation in some other way.

Therefore, if business activity is only conducted in Slovakia or only in France, cross-border processing does not apply. If a Polish company has branches in the Czech Republic, Slovakia, and the United Kingdom (UK) (for the time being still an EU member), essentially the Polish authority, the Personal Data Protection Office, will have jurisdiction with respect to its activity. A branch of a French company will be subject to the jurisdiction of the CNIL.

If various types of business activity are conducted, there may be separate lead supervisory authorities for the individual types of business activity.

#12.3 Processor

There are no exceptions for processors, i.e. companies whose activity is processing of (personal) data for other organisations, to the rule of jurisdiction of the supervisory authority competent for the main establishment (parent company). There is a major exception, however, which is not provided for expressly in the GDPR. If a matter concerns a processor and controller at the same time (which usually seems to be the case), then the lead supervisory authority is the supervisory authority for the controller and not the processor.

#12.4 Controllers

There is a certain exception for controllers to the rule that the main establishment is subject to the jurisdiction of the supervisory authority (at this point this means companies that need to process data mainly for their own purposes).

Under Article 4(16)(a) GDPR:

As regards a controller with establishments in more than one member state, the main establishment is the place of its central administration in the EU, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the EU and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment.

This means that if the decision-making centre of a business, including the specifying of data processing procedures, is in an office other than the capital group’s central office, the competent supervisory authority is determined according to that other office.

In practice, the one-stop-shop can be used to protect ‘our own’ and this is probably the purpose for which it was introduced. It increases legal certainty if only because it overcomes the language barrier. It also gives controllers room for manoeuvre, but there are exceptions to the rule of monitoring by the lead supervisory authority.

#12.4.1 Local Processing

Above all, processing must be cross-border.

To give an example, processing of employee data is almost always local, and therefore with respect to protection of employee data supervision will be performed by the authority that is competent according to geographical territory (although this may involve transferring employee data to the central office, citing the legitimate interest of a corporate group, and then it becomes cross-border processing).

#12.4.2 Local Coverage

A local authority may come to the conclusion that a case does not only concern its jurisdiction (i.e., that country). In such a case it has to give the lead authority an opportunity to take charge of the case.

#12.5 Article 29 Working Party Guidelines

On 13 December 2016, the Data Protection Working Party established on the basis of Article 29 of Directive 95/46/EC adopted guidelines on determining the lead supervisory authority for a controller or processor.

#12.6 Conclusions

If it is possible to select the supervisory authority because a business has operations in multiple EEA countries, it is worth evaluating where the business will be best treated and deciding where to locate the decision-making centre. With regard to the core area of business activity, it will probably be difficult to move the decision-making centre. When developing new areas of business operations which are vulnerable from the point of view of data protection, the ‘friendliness’ of the supervisory policy of a authority in a particular country can be taken into account. In turn, when providing services that constitute data processing in the meaning of the GDPR, it is important to be aware of the supervisory policy of all of the countries in which a business has customers.

At the same time, when opening establishments in various EU countries, you should consider that for the internal matters of those establishments (in particular employee matters), the supervisory authorities in individual countries will be competent.

#12.7 Leaving One-Stop-Shop

The one-stop-shop rule is a political compromise.

Unsurprisingly it now looks like not everybody understood it in the same way. CNIL in their decision imposing an EUR 50 million fine on Google found themselves competent to decide despite Google formally operates in the EU through Google Limited Ireland.

The breach CNIL makes with their Google decision to the one-stop-shop does not come as a surprise though. Problems with fair application of the one-stop-shop rule have hit the fan in March 2019, with the leak of internal Facebook’s correspondence proving that Facebook has been extensively trying to lobby the GDPR legislative works and proving that they were quite successful with the Irish government: ‘Most revealingly, it includes details of the company’s “great relationship” with Enda Kenny, the Irish prime minister at the time, one of a number of people it describes as “friends of Facebook”.’,

The logic behind the CNIL’s Google decision is simple and compelling. If your data decision centre is not in the EU, the one-stop-shop principle does not apply, as there is no ‘main establishment’ in the meaning of Recital 36 second sentence GDPR.