A controller is established in only one Member State, France, but its cloud-marketing platform processes personal data of data subjects across the EU, and the processing is carried out solely in the context of that French establishment. A consumer in Spain complains to the Spanish supervisory authority about the controller's processing. Under the GDPR's one-stop-shop mechanism, which supervisory authority acts as the lead supervisory authority for this cross-border processing?
- AThe Spanish supervisory authority, because the data subject who complained is resident in Spain and lodged the complaint there.
- BThe European Data Protection Board, because cross-border processing affecting subjects in several Member States is handled centrally at Union level.
- CEach supervisory authority where an affected data subject resides, acting jointly without a single lead, because the processing affects multiple Member States.
- DThe French supervisory authority, because the place of the controller's main establishment determines the lead authority for its cross-border processing. Correct
Why A is wrong: Tempting because the GDPR lets a data subject complain to their own authority, but the authority that receives a complaint is the authority concerned, not automatically the lead authority, which is fixed by the location of the main establishment.
Why B is wrong: Tempting because the EDPB coordinates cross-border matters, but the Board is not a supervisory authority and never acts as a lead authority; it issues opinions and binding dispute decisions rather than leading individual cases.
Why C is wrong: Tempting because the processing is genuinely cross-border, but the one-stop-shop exists precisely to avoid parallel multi-authority handling by designating one lead authority rather than joint co-leadership by all concerned authorities.
Why D is correct: Correct: the lead authority is the supervisory authority of the main establishment, which here is the single French establishment where the processing decisions are taken, so the French authority leads even though the complaint arrived in Spain.