Recital 138
General Data Protection Regulation · UE 2016/679
| (138) | The application of such mechanism should be a condition for the lawfulness of a measure intended to produce legal effects by a supervisory authority in those cases where its application is mandatory. In other cases of cross-border relevance, the cooperation mechanism between the lead supervisory authority and supervisory authorities concerned should be applied and mutual assistance and joint operations might be carried out between the supervisory authorities concerned on a bilateral or multilateral basis without triggering the consistency mechanism. |
In Luxembourg, the CNPD is frequently designated as lead authority for international groups whose main establishment is located in the territory (banks, fintechs, e-commerce platforms, European headquarters of US groups). The law of 1 August 2018 organising the CNPD expressly gives it competence to conduct one-stop-shop procedures and represent Luxembourg in the EDPB consistency mechanism. Caution: the CNPD strictly applies EDPB guidelines 8/2022 on identifying the main establishment, and only recognises itself as lead if actual decisions are taken in Luxembourg, not merely domiciled there.
Luxgap practice: before any lead-authority declaration to the CNPD, we document the decision chain through executive committee minutes, delegations of power and access logs to decision systems, to substantiate the main establishment qualification in an opposable manner.
