The consultation concerns paragraphs 29 to 34 and points ii) and iii) under 2.d of the Annex only.

These paragraphs cover the identification and designation of the lead supervisory authority, by identifying the controller’s “main establishment”, where there are two or more controllers established in the EEA who jointly determine the purposes and means of processing, i.e. joint controllers.

The relevant paragraphs note that the GDPR does not specifically deal with this issue, although Article 26(1) and Recital 79 of the GDPR make it clear that joint controllers must determine their respective responsibilities for compliance with their obligations under the GDPR by deciding who will carry out which tasks to ensure such compliance.

The relevant paragraphs advise that supervisory authorities are not bound by the terms of any arrangement made by joint controllers, neither on the issue of the qualification of the parties as joint controllers nor on the designated contact point. Further, the decision-making power of joint controllers does not include the determination of the relevant supervisory authority or the ability of such supervisory authority to exercise their tasks and powers.

Further, paragraph 34 states that the notion of “main establishment” is linked to a single controller and cannot be extended to a joint controllership situation. This is without prejudice to each joint controller having its own main establishment. In other words, the main establishment of a controller cannot be considered as the main establishment of the joint controllers in relation to processing carried out under their joint control. Therefore, joint controllers cannot designate a common main establishment for both joint controllers.

As for the Annex, this sets out how to identify the “lead supervisory authority”. The points being consulted on advise that, in the case of joint controllers, it is the supervisory authority of the country where the “place of central administration” is located that will be “the lead supervisory authority of the respective joint controller”.

Comments on the paragraphs being consulted on should be sent by 2 December 2022. To access the Guidelines and for details on how to respond to the consultation, click here.