A complaint concerns cross-border processing by a pan-EU SaaS whose main establishment is in one Member State. How should supervisory competence typically be approached under the one-stop-shop model?
Select an answer to reveal the explanation.
Short Explanation
One-stop-shop is like having a lead project manager for a multi-country job, while other site managers still get a say. For cross-border SaaS processing, the lead SA tied to the main establishment runs point with concerned SAs cooperating.
Full Explanation
For a complaint concerning cross-border processing by a pan-EU SaaS whose main establishment is in one Member State, supervisory competence typically follows the one-stop-shop model: the lead supervisory authority of the main establishment coordinates, with cooperation from concerned supervisory authorities. That design gives people a coherent path across borders while still letting affected Member State authorities contribute—civic consistency without forty disconnected solo prosecutions as the default. Making every municipal mayor the sole enforcer overnight fails by inventing local political competence GDPR does not create for SA tasks. Saying only the EDPS may investigate any private SaaS with customers in two Member States fails by misassigning Union-institution supervision to private controllers. Dismissing cross-border complaints automatically if more than one language is used fails as an arbitrary procedural myth unrelated to competence. Exam caveat: one-stop-shop applies to cross-border processing as defined; purely local matters stay with the territorial SA, and main-establishment analysis is factual, not a branding preference. Operational check: document main establishment for OSS, map concerned SAs from complaint geography, prepare cooperation files, and answer the lead SA without forum-shopping rhetoric.