Recital 124
General Data Protection Regulation · UE 2016/679
| (124) | Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and the controller or processor is established in more than one Member State, or where processing taking place in the context of the activities of a single establishment of a controller or processor in the Union substantially affects or is likely to substantially affect data subjects in more than one Member State, the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority. It should cooperate with the other authorities concerned, because the controller or processor has an establishment on the territory of their Member State, because data subjects residing on their territory are substantially affected, or because a complaint has been lodged with them. Also where a data subject not residing in that Member State has lodged a complaint, the supervisory authority with which such complaint has been lodged should also be a supervisory authority concerned. Within its tasks to issue guidelines on any question covering the application of this Regulation, the Board should be able to issue guidelines in particular on the criteria to be taken into account in order to ascertain whether the processing in question substantially affects data subjects in more than one Member State and on what constitutes a relevant and reasoned objection. |
In Luxembourg, the CNPD (never APDL) is the competent supervisory authority and a natural lead authority candidate for groups whose EU decision-making centre is in Luxembourg-City, Kirchberg or Esch-Belval. The law of 1 August 2018 on the organisation of the National Commission for Data Protection details the CNPD's role in article 60 cooperation and the article 63 consistency mechanism. In practice, the CNPD will only act as lead authority if the designation file shows that operational decisions, not merely tax holding, are effectively taken in Luxembourg.
Luxgap practice: for Luxembourg group structures (SOPARFI, holding, EU hub), we systematically document decision-making substance with dated minutes of the privacy steering committee held in Luxembourg, so that the CNPD can confidently assert its lead authority role against the CNIL or the Garante.
