Recital 127

Recital 127

General Data Protection Regulation · UE 2016/679

(127)

Each supervisory authority not acting as the lead supervisory authority should be competent to handle local cases where the controller or processor is established in more than one Member State, but the subject matter of the specific processing concerns only processing carried out in a single Member State and involves only data subjects in that single Member State, for example, where the subject matter concerns the processing of employees' personal data in the specific employment context of a Member State. In such cases, the supervisory authority should inform the lead supervisory authority without delay about the matter. After being informed, the lead supervisory authority should decide, whether it will handle the case pursuant to the provision on cooperation between the lead supervisory authority and other supervisory authorities concerned (‘one-stop-shop mechanism’), or whether the supervisory authority which informed it should handle the case at local level. When deciding whether it will handle the case, the lead supervisory authority should take into account whether there is an establishment of the controller or processor in the Member State of the supervisory authority which informed it in order to ensure effective enforcement of a decision vis-à-vis the controller or processor. Where the lead supervisory authority decides to handle the case, the supervisory authority which informed it should have the possibility to submit a draft for a decision, of which the lead supervisory authority should take utmost account when preparing its draft decision in that one-stop-shop mechanism.

Luxembourg specificity
loi du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the CNPD (not the non-existent APDL) is the competent authority for local cases under recital 127. The law of 1 August 2018 organising the CNPD specifies its investigation and sanction powers over purely Luxembourgish processing, even where the controller has its main establishment in another Member State. The CNPD is particularly active on local HR cases: company car geolocation, professional email monitoring, office video surveillance.

Luxgap practice: for any Luxembourg subsidiary of a foreign group, establish from the outset a distinct mapping of purely LU HR processing (CNPD-handled) and group processing (handled by your EU lead authority), with a clear escalation procedure to avoid competence ambiguities during an inspection or an employee complaint.