Article 55 GDPR, stemming from Article 28(6) of Directive 95/46/EC, specifies territorial jurisdiction, exclusive jurisdiction and limitation of material jurisdiction of a supervisory authority.
Each supervisory authority is competent for the performance of its tasks and powers on the territory of its Member State. This principle may be modified according to Article 56 of GDPR which defines the competence of the authorities with respect to cross-border matters, as defined in Article 4 pt 23 of GDPR. I.
Article 55(3) of GDPR excludes the supervisory authorities’ from supervising data processing by the courts when they are trying and deciding cases, to ensure the independence of the judiciary. At the same time, courts are subject to the supervisory body’s authority regarding their internal processes such as employee or supplier relations.
EU legislator paid special attention to the regulation of the lead supervisory authority. Article 56 of GDPR refers to the one-stop-shop mechanism that has been created in order to unify the rules governing the jurisdiction in transborder data processing operations and to eliminate the problem of choosing the competent supervisory authority in those cases or forum shopping.
The supervisory authority is competent to act in accordance with the procedure provided in Article 60 of GDPR as a lead supervisory authority for the cross-border processing carried out by a controller or processor. The lead supervisory authority is determined by specifying the ‘main establishment’ of the controller or processor as defined in Article 4 pt 16. It may also be established in relation to the controller or processor who does not have the ‘main establishment’ in different Member States but operates in one of them through a single establishment, and the data processing operations associated with that activity shall have cross-border nature. The notion of ‘cross-border processing’ is explained in Article 4 pt 23 of GDPR.
Article 56(2) of GDPR provides a derogation from the general rule of the competence of the lead supervisory authority and states that each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of GDPR, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State. In such cases, the supervisory authority is required to inform without delay the lead supervisory authority on that matter. Then the latter should decide within three weeks whether or not it will handle the case. When deciding whether or not to deal with the case, the lead supervisory authority should consider if there is an establishment of the controller or processor in a given Member State in order to ensure that the decision concerning the controller or processor could be effectively enforced. If the lead supervisory authority decides to handle the case, the supervisory authority which informed about the complaint lodged with it or a possible infringement of GDPR should be able to submit a draft decision. The leading supervisory authority should take utmost account of that draft when preparing its own draft decision.
If the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to procedures prescribed in Article 61 – ‘Mutual assistance’ and Article 62 – ‘Joint operations of supervisory authorities’. Even though the lead supervisory authority remains the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor: