A multi-country EU controller must identify its lead supervisory authority for one-stop-shop purposes. Which concept, as developed under Article 4(16) and EDPB Opinion 04/2024 themes, should guide that choice?
Select an answer to reveal the explanation.
Short Explanation
Think of the real headquarters of privacy decisions — the desk where purposes and means are actually steered — not the biggest storefront or the friendliest regulator. That main-establishment idea picks the lead SA. Shopping for a nicer SA or picking a cheap cloud region misses the point.
Full Explanation
Article 4(16) defines main establishment by reference to the place of central administration or, where decisions on purposes and means are taken elsewhere, that other place of effective management. EDPB Opinion 04/2024 elaborates main-establishment analysis for one-stop-shop. Customer volume, controller preference, and infrastructure cost do not substitute for where joint decisions are really managed.