A controller tries to designate the 'friendliest' supervisory authority as lead while ignoring where its main establishment actually exercises central administration. What is the correct approach?
Select an answer to reveal the explanation.
Short Explanation
You don't get to pick your tax office because the coffee is better—lead SA follows where central decisions really happen. Forum-shopping for the 'nicest' regulator isn't how main establishment works.
Full Explanation
A controller that tries to designate the ‘friendliest’ supervisory authority as lead while ignoring where its main establishment actually exercises central administration is wrong: the lead supervisory authority follows main-establishment rules, not controller preference or forum shopping. People deserve enforcement rooted in real central administration of purposes and means, not a beauty contest among regulators. Allowing controllers to freely elect any SA worldwide for marketing convenience fails by inventing elective competence foreign to the GDPR. Saying lead authority always defaults to the EDPS for private global brands fails by misusing the EDPS mandate for Union institutions. Claiming main establishment is irrelevant once a privacy policy mentions multiple languages fails—multilingual notices do not relocate where purposes-and-means decisions are taken. Exam caveat: main-establishment analysis looks to central administration of processing decisions; letterbox arrangements designed solely to forum-shop are vulnerable to challenge by authorities. Operational check: document where purposes-and-means decisions are actually made, align OSS lead assertions to that evidence, and avoid shopping for perceived leniency when structuring European establishments.