Recital 128
General Data Protection Regulation · UE 2016/679
| (128) | The rules on the lead supervisory authority and the one-stop-shop mechanism should not apply where the processing is carried out by public authorities or private bodies in the public interest. In such cases the only supervisory authority competent to exercise the powers conferred to it in accordance with this Regulation should be the supervisory authority of the Member State where the public authority or private body is established. |
In Luxembourg, the CNPD is the sole competent supervisory authority for public authorities and private bodies acting in the public interest and established on the territory, in accordance with the Law of 1 August 2018 on the organisation of the CNPD and implementation of the GDPR. The CNPD has published several guidelines reminding that municipalities, hospitals and public establishments fall exclusively under its jurisdiction, including for cross-border processing affecting French, Belgian and German cross-border workers.
Luxgap practice: for any Luxembourg entity with a public interest mission, we recommend explicitly entering in the Article 30 register the mention "Recital 128 - one-stop-shop excluded - competent authority: CNPD" for each purpose concerned, to avoid any ambiguity during a cross-border breach notification.
