The European Data Protection Board has issued an opinion on lead supervisory authority in the event of a change of location of the main establishment of an organization.
Highlights:
- Competence to act as lead supervisory authority can switch to another supervisory authority until a final decision has been reached.
- Relocation of a main establishment to another European Economic Area Member State mid-procedure: First authority is deprived of its original competence; operations already carried out remain valid.
- Creation of a main or single establishment or its relocation from a third country to the EEA: Controller still entitled to one-stop-shop. Every pending proceeding will be transferred to the Supervisory Authority (SA) of the state in which the main establishment is located. This SA will become the Lead Supervisory Authority (LSA), and the proceeding will continue in accordance with the rules in Article 60.
- Disappearance of main or single establishment mid-procedure: No one-stop shop. In case the establishment ceases to exist in the territory of its Member State, the former lead supervisory authority remains competent; each concerned authority regains full jurisdiction.