A multi-country EU controller must identify its lead supervisory authority for one-stop-shop purposes. Which concept, as developed under Article 4(16) and EDPB Opinion 04/2024 themes, should guide that choice?
Select an answer to reveal the explanation.
Short Explanation
Think of the real headquarters of privacy decisions — the desk where purposes and means are actually steered — not the biggest storefront or the friendliest regulator. That main-establishment idea picks the lead SA. Shopping for a nicer SA or picking a cheap cloud region misses the point.
Full Explanation
For one-stop-shop cooperation, the lead supervisory authority is generally that of the controller’s main establishment—where decisions on the purposes and means of the relevant cross-border processing are effectively taken, as developed under Article 4(16) and EDPB guidance themes including Opinion 04/2024. Largest customer count, convenience preference, or cheapest cloud region do not define main establishment. Identifying real decision centres matters for multi-country controllers that serve residents across Member States.
Customer-count majorities do not automatically set the lead supervisory authority. Controllers cannot simply designate any preferred authority for enforcement convenience. Cloud-region pricing is irrelevant to lead-authority analysis and should not appear in OSS memoranda as a deciding factor.
Exam caveat: main establishment can be processing-specific in complex groups; letterhead without real decision-making power is weak evidence. Dispute mechanisms exist when supervisory authorities disagree about the lead.
Operational check: document where purpose and means decisions for the cross-border processing are actually made, align one-stop-shop notifications and DPO contacts with that analysis, and avoid forum-shopping memos based only on perceived enforcement reputation.