Recital 125
General Data Protection Regulation · UE 2016/679
| (125) | The lead authority should be competent to adopt binding decisions regarding measures applying the powers conferred on it in accordance with this Regulation. In its capacity as lead authority, the supervisory authority should closely involve and coordinate the supervisory authorities concerned in the decision-making process. Where the decision is to reject the complaint by the data subject in whole or in part, that decision should be adopted by the supervisory authority with which the complaint has been lodged. |
In Luxembourg, the CNPD acts as lead authority for many financial and industrial groups with their main establishment in the country (funds, private banks, fintechs, holding headquarters). The law of 1 August 2018 organizing the CNPD specifies the cooperation arrangements and entrusts a designated commissioner with steering Article 60 cross-border procedures. The CNPD regularly publishes its doctrine on qualifying the main establishment, a sensitive point for management structures based in Kahler or Luxembourg City running operations across several Member States.
Luxgap practice: if your main establishment is claimed in Luxembourg, precisely document the effective management functions performed there (decisions on purposes and means), because the CNPD itself will reject lead qualification if the decision-making substance lies elsewhere.
