Yesterday, 14 Feb 2024, the Eu Data Protection Board published its “Opinion on the notion of main establishment on the criteria for the application of the One-Stop-Shop mechanism” under the framework of art. 64(2) GDPR. The document provides the EDPB’s position on the notion of “main establishment” and the circumstance where the One-Stop-Shop mechanism should apply.
Image by Freepik
Notion “Main establishment” under art. 4(16)(a) GDPR
As requested by the French Supervisory Authority (CNIL), the EDPB adopts this opinion. It emphasises that a controller’s “place of central administration” in the EU can be the main establishment provided that it makes the decisions for and by processing of personal data, and it is entitled to have these decisions conducted.
One-Stop-Shop mechanism
According to the EDPB’s opinion, only in case that there is evidence proving that one of the controller’s establishments in the EU takes decisions for and by processing relevant personal data and has the power to make them implemented.
As a result, if the controller takes the decision on the purposes and means of processing data, and possesses the entitlement to make these decisions implemented outside the Union, no main establishment and no One-Stop-Shop mechanism should apply. The explanation imposes the burden of proof ultimately on the controllers regarding the place where they take relevant processing decisions and where they are able to implement such decisions in the EU. Moreover, the controllers also have to collaborate with the supervisory authorities.
The supervisory authorities also have to carry the duty of cooperation out. Accordingly, they may have to jointly agree on the level of detail appropriate, subject to the concrete case. Also, they must scrutinise the place of central management of the controller as well as the place where the decisions on the purposes and means taken and where the controller has the power to implement such decisions in parallel to determine where should be its main establishment.
Full text of the opinion: https://edpb.europa.eu/system/files/2024-02/edpb_opinion_202404_mainestablishment_en.pdf
Press release: https://edpb.europa.eu/news/news/2024/edpb-clarifies-notion-main-establishment-and-calls-eu-legislators-make-sure-csam_en
To frequently get the news, follow our LinkedIn Page and to have further discussion in person – connect with me on Linkedin. Cheers!