Version1.0 10October2022 AdoptionoftheGuidelines(updatedversionofthe previousguidelinesWP244rev.01adoptedbytheWorking Party29andendorsedbytheEDPBon25May2018)fora targetedpublicconsultation.
TheEuropeanDataProtectionBoard
HavingregardtoArticle70(1)(e)and(l)oftheRegulation2016/679/EUoftheEuropeanParliament andoftheCouncilof27April2016ontheprotectionofnaturalpersonswithregardtotheprocessing ofpersonaldataandonthefreemovementofsuchdata,andrepealingDirective95/46/EC, (hereinafterGDPR),
HavingregardtotheEEAAgreementandinparticulartoAnnexXIandProtocol37thereof,asamended bytheDecisionoftheEEAjointCommitteeNo154/2018of6July20181 ,
HavingregardtoArticle12andArticle22ofitsRulesofProcedure,
HavingregardtotheArticle29WorkingPartyGuidelinesforidentifyingacontrollerorprocessorslead supervisoryauthority,WP244rev.01,
HavingregardtotheEDPBGuidelines07/2020ontheconceptsofcontrollerandprocessorinthe GDPR,
HASADOPTEDTHEFOLLOWINGGUIDELINES
0PREFACE
1. On5April2017,theArticle29WorkingPartyadopteditsGuidelinesforidentifyingacontrolleror processorsleadsupervisoryauthority(WP244rev.01)2,whichwereendorsedbytheEuropeanData ProtectionBoard(hereinafterEDPB)atitsfirstPlenarymeeting3.Thisdocumentisaslightlyupdated versionofthoseguidelinesAnyreferencetotheWP29Guidelinesforidentifyingacontrolleror processorsleadsupervisoryauthority(WP244rev.01)should,fromnowon,beinterpretedasa referencetotheseEDPBguidelines.
2. TheEDPBhasnoticedthattherewasaneedforfurtherclarifications,specificallyregardingthenotion ofmainestablishmentinthecontextofjointcontrollershipandtakingintoaccounttheEDPB Guidelines07/2020ontheconceptsofcontrollerandprocessorintheGDPR4 .
3. Theparagraphconcerningthismatterhasbeenrevisedandupdated,whiletherestofthedocument
documents/guidelines/guidelines072020conceptscontrollerandprocessorgdpr_en
1.1 Crossborderprocessingofpersonaldata
4. Identifyingaleadsupervisoryauthorityisonlyrelevantwhereacontrollerorprocessoriscarryingout thecrossborderprocessingofpersonaldata.Article4(23)GDPRdefinescrossborderprocessingas eitherthe:
processingofpersonaldatawhichtakesplaceinthecontextoftheactivitiesofestablishments inmorethanoneMemberStateofacontrollerorprocessorintheUnionwherethecontrolleror processorisestablishedinmorethanoneMemberState;orthe
processingofpersonaldatawhichtakesplaceinthecontextoftheactivitiesofasingle establishmentofacontrollerorprocessorintheUnionbutwhichsubstantiallyaffectsorislikely tosubstantiallyaffectdatasubjectsinmorethanoneMemberState
5. ThismeansthatwhereanorganisationhasestablishmentsinFranceandRomania,forexample,and theprocessingofpersonaldatatakesplaceinthecontextoftheiractivities,thenthiswillconstitute crossborderprocessing.
6. Alternatively,theorganisationmayonlycarryoutprocessingactivityinthecontextofitsestablishment inFrance.However,iftheactivitysubstantiallyaffects orislikelytosubstantiallyaffect data subjectsinFranceandRomaniathenthiswillalsoconstitutecrossborderprocessing.
1.1.1 Substantiallyaffects
7. TheGDPRdoesnotdefinesubstantiallyoraffects.Theintentionofthewordingwastoensurethat notallprocessingactivity,withanyeffectandthattakesplacewithinthecontextofasingle establishment,fallswithinthedefinitionofcrossborderprocessing.
8. ThemostrelevantordinaryEnglishmeaningsofsubstantialinclude:ofampleorconsiderableamount orsize;sizeable,fairlylarge,orhavingsolidworthorvalue,ofrealsignificance;solid;weighty, important5 .
9. Themostrelevantmeaningoftheverbaffectistoinfluenceortomakeamaterialimpressionon. Therelatednouneffectmeans,amongstotherthings,aresultoraconsequence6 Thissuggests thatfordataprocessingtoaffectsomeoneitmusthavesomeformofimpactonthem.Processingthat doesnothaveasubstantialeffectonindividualsdoesnotfallwithinthesecondpartofthedefinition ofcrossborderprocessing.However,itwouldfallwithinthefirstpartofthedefinitionwherethe processingofpersonaldatatakesplaceinthecontextoftheactivitiesofestablishmentsinmorethan oneMemberStateofacontrollerorprocessorintheUnion,wherethecontrollerorprocessoris establishedinmorethanoneMemberState.
10. Processingcanbebroughtwithinthesecondpartofthedefinitionifthereisthelikelihoodofa substantialeffect,notjustanactualsubstantialeffect.Notethatlikelytodoesnotmeanthatthere isaremotepossibilityofasubstantialeffect.Thesubstantialeffectmustbemorelikelythannot.On theotherhand,italsomeansthatindividualsdonothavetobeactuallyaffected:thelikelihoodofa substantialeffectissufficienttobringtheprocessingwithinthedefinitionofcrossborderprocessing.
11. Thefactthatadataprocessingoperationmayinvolvetheprocessingofanumber evenalarge numberofindividualspersonaldata,inanumberofMemberStates,doesnotnecessarilymeanthat theprocessinghas,orislikelytohave,asubstantialeffect.Processingthatdoesnothaveasubstantial effectdoesnotconstitutecrossborderprocessingforthepurposesofthesecondpartofthe definition,regardlessofhowmanyindividualsitaffects.
12. SupervisoryAuthoritieswillinterpretsubstantiallyaffectsonacasebycasebasis.Wewilltakeinto accountthecontextoftheprocessing,thetypeofdata,thepurposeoftheprocessingandfactorssuch aswhethertheprocessing:
o causes,orislikelytocause,damage,lossordistresstoindividuals;
o has,orislikelytohave,anactualeffectintermsoflimitingrightsordenyinganopportunity;
o affects,orislikelytoaffectindividualshealth,wellbeingorpeaceofmind;
o affects,orislikelytoaffect,individualsfinancialoreconomicstatusorcircumstances;
o leavesindividualsopentodiscriminationorunfairtreatment;
o involvestheanalysisofthespecialcategoriesofpersonalorotherintrusivedata,particularlythe personaldataofchildren;
o causes,orislikelytocauseindividualstochangetheirbehaviourinasignificantway;
o hasunlikely,unanticipatedorunwantedconsequencesforindividuals;
o createsembarrassmentorothernegativeoutcomes,includingreputationaldamage;or
o involvestheprocessingofawiderangeofpersonaldata.
asregardsacontrollerwithestablishmentsinmorethanoneMemberState,theplaceofits centraladministrationintheUnion,unlessthedecisionsonthepurposesandmeansofthe processingofpersonaldataaretakeninanotherestablishmentofthecontrollerintheUnionand thelatterestablishmenthasthepowertohavesuchdecisionsimplemented,inwhichcasethe establishmenthavingtakensuchdecisionsistobeconsideredtobethemainestablishment;
asregardsaprocessorwithestablishmentsinmorethanoneMemberState,theplaceofits centraladministrationintheUnion,or,iftheprocessorhasnocentraladministrationinthe Union,theestablishmentoftheprocessorintheUnionwherethemainprocessingactivitiesin thecontextoftheactivitiesofanestablishmentoftheprocessortakeplacetotheextentthat theprocessorissubjecttospecificobligationsunderthisRegulation;
2STEPSTOIDENTIFYTHELEADSUPERVISORYAUTHORITY
18. Inordertoestablishwherethemainestablishmentis,itisfirstlynecessarytoidentifythecentral administrationofthecontrollerintheEEA,ifanyTheapproachimpliedintheGDPRisthatthecentral administrationintheEUistheplacewheredecisionsaboutthepurposesandmeansoftheprocessing ofpersonaldataaretaken,andthisplacehasthepowertohavesuchdecisionsimplemented.
19. TheessenceoftheleadsupervisoryauthorityprincipleintheGDPRisthatthesupervisionofcross borderprocessingshouldbeledbyonlyonesupervisoryauthorityintheEU.Incaseswheredecisions relatingtodifferentcrossborderprocessingactivitiesaretakenwithintheEUcentraladministration, therewillbeasingleleadsupervisoryauthorityforthevariousdataprocessingactivitiescarriedout bythemultinationalcompany.However,theremaybecaseswhereanestablishmentotherthanthe placeofcentraladministrationmakesautonomousdecisionsconcerningthepurposesandmeansofa specificprocessingactivity.Thismeansthattherecanbesituationswheremorethanonelead supervisoryauthoritycanbeidentified,i.e.incaseswhereamultinationalcompanydecidestohave separatedecisionmakingcentres,indifferentcountries,fordifferentprocessingactivities.
20. Itisworthrecalling,thatwhereamultinationalcompanycentralisesallthedecisionsrelatingtothe purposesandmeansofprocessingactivitiesinoneofitsestablishmentsintheEEA(andthat establishmenthasthepowertoimplementsuchdecisions),onlyoneleadsupervisoryauthoritywillbe identifiedforthemultinational.
21. Inthesesituations,itwillbeessentialforcompaniestoidentifypreciselywherethedecisionson purposeandmeansofprocessingaretaken.Correctidentificationofthemainestablishmentisinthe interestsofcontrollersandprocessorsbecauseitprovidesclarityintermsofwhichsupervisory authoritytheyhavetodealwithinrespectoftheirvariouscompliancedutiesundertheGDPR.These mayinclude,whererelevant,designatingadataprotectionofficerorconsultingforariskyprocessing activitythatthecontrollercannotmitigatebyreasonablemeans.TherelevantprovisionsoftheGDPR areintendedtomakethesecompliancetasksmanageable.
Example1:Afoodretailerhasitsheadquarters(i.e.,itsplaceofcentraladministration)inRotterdam, Netherlands.IthasestablishmentsinvariousotherEEAcountries,whichareincontactwithindividuals there.Allestablishmentsmakeuseofthesamesoftwaretoprocessconsumerspersonaldatafor marketingpurposes.Allthedecisionsaboutthepurposesandmeansoftheprocessingofconsumers personaldataformarketingpurposesaretakenwithinitsRotterdamheadquarters.Thismeansthat
thecompanysleadsupervisoryauthorityforthiscrossborderprocessingactivityistheDutch supervisoryauthority.
Example2:AbankhasitscorporateheadquartersinFrankfurt,andall8itsbankingprocessingactivities areorganisedfromthere,butitsinsurancedepartmentislocatedinVienna.Iftheestablishmentin Viennahasthepowertodecideonallinsurancedataprocessingactivitiesandtoimplementthese decisionsforthewholeEEA,then,asforeseeninArticle4(16)GDPR,theAustriansupervisoryauthority wouldbetheleadsupervisoryauthorityinrespectofthecrossborderprocessingofpersonaldatafor insurancepurposes,andthecompetentGermansupervisoryauthority(i.e.,theHessensupervisory authority)wouldsupervisetheprocessingofpersonaldataforbankingpurposes,wherevertheclients arelocated9
2.1.1Criteriaforidentifyingacontrollersmainestablishmentincaseswhereitisnotthe placeofitscentraladministrationintheEEA
23. Recital36GDPRisusefulinclarifyingthemainfactorthatshallbeusedtodetermineacontrollers mainestablishmentifthecriterionofthecentraladministrationdoesnotapply.Thisinvolves identifyingwheretheeffectiveandrealexerciseofmanagementactivities,thatdeterminethemain decisionsastothepurposesandmeansofprocessingthroughstablearrangements,takesplace. Recital36GDPRalsoclarifiesthat thepresenceanduseoftechnicalmeansandtechnologiesfor processingpersonaldataorprocessingactivitiesdonot,inthemselves,constituteamainestablishment andarethereforenotdeterminingcriteriaforamainestablishment.
Thecontrolleritselfidentifieswhereitsmainestablishmentisandthereforewhichsupervisory authorityisitsleadsupervisoryauthority.However,thiscanbechallengedbytherespective supervisoryauthorityconcernedafterwards.
Thefactorsbelowareusefulfordeterminingthelocationofacontrollersmainestablishment, accordingtothetermsoftheGDPR,incaseswhereitisnotthelocationofitscentraladministration intheEEA.
o Wherearedecisionsaboutthepurposesandmeansoftheprocessinggivenfinalsignoff?
o Wherearedecisionsaboutbusinessactivitiesthatinvolvedataprocessingmade?
o Wheredoesthepowertohavedecisionsimplementedeffectivelylie?
o WhereistheDirector(orDirectors)withoverallmanagementresponsibilityforthecrossborder processinglocated?
o Whereisthecontrollerorprocessorregisteredasacompany,ifinasingleterritory?
Notethatthisisnotanexhaustivelist.Otherfactorsmayberelevantdependingonthecontrolleror processingactivityinquestion.Ifasupervisoryauthorityhasreasonstodoubtthattheestablishment
Inthecontextofprocessingpersonaldataforbankingpurposes,theEDPBrecognisesthattherearemany differentpurposespursuedbytheseprocessingactivities.However,tosimplifymatters,theEDPBaddressesall ofthemasasinglepurpose.Thesameistrueofprocessingdoneforinsurancepurposes
ItshouldberecalledalsothattheGDPRprovidesforthepossibilityoflocaloversightinspecificcases.See Recital127: Eachsupervisoryauthoritynotactingastheleadsupervisoryauthorityshouldbecompetentto handlelocalcaseswherethecontrollerorprocessorisestablishedinmorethanoneMemberState,butthe subjectmatterofthespecificprocessingconcernsonlyprocessingcarriedoutinasingleMemberStateand involvesonlydatasubjectsinthatsingleMemberState,forexample,wherethesubjectmatterconcernsthe processingofemployees'personaldatainthespecificemploymentcontextofaMemberState. Thisprinciple meansthatthesupervisionofHRdataconnectedtothelocalemploymentcontextcouldfallonseveral supervisoryauthorities.
identifiedbythecontrollerisinrealitythemainestablishmentforthepurposesoftheGDPR,itcan ofcourserequirethecontrollertoprovidetheadditionalinformationnecessaryforittoprovewhere itsmainestablishmentislocated.
2.1.2Groupsofundertakings
establishmentforthegroup,exceptwheredecisionsaboutthepurposesandmeansofprocessingare takenbyanotherestablishment.Theparent,oroperationalheadquartersofthegroupofundertakings intheEEA,islikelytobethemainestablishment,becausethatwouldbetheplaceofitscentral administration.
carriedout,lieswithinthecompanysheadquarters.Insuchcases,determiningthelocationofthe mainestablishmentandthereforewhichsupervisoryauthorityistheleadsupervisoryauthorityis straightforward.However,thedecisionsystemofgroupofcompaniescouldbemorecomplex,giving independentmakingpowersrelatingtocrossborderprocessingtodifferentestablishments.The criteriasetoutaboveshouldhelpgroupsofundertakingstoidentifytheirmainestablishment.
34. ThenotionofmainestablishmentislinkedbyvirtueoftheGDPRtoasinglecontrollerandcannotbe extendedtoajointcontrollershipsituation.Thisiswithoutprejudicetothepossibilityforeachjoint controllertohaveitsownmainestablishment.Inotherwords,themainestablishmentofacontroller cannotbeconsideredasthemainestablishmentofthejointcontrollersfortheprocessingcarriedout undertheirjointcontrol.Therefore,jointcontrollerscannotdesignate(amongtheestablishments wheredecisionsonthepurposesandmeansoftheprocessingaretaken)acommonmain establishmentforbothjointcontrollers.
2.2 Borderlinecases
35. Therewillbeborderlineandcomplexsituationswhereitisdifficulttoidentifythemainestablishment ortodeterminewheredecisionsaboutdataprocessingaretaken.Thismightbethecasewherethere iscrossborderprocessingactivityandthecontrollerisestablishedinseveralMemberStates,butthere isnocentraladministrationintheEEAandnoneoftheEEAestablishmentsaretakingdecisionsabout theprocessing(i.e.decisionsaretakenexclusivelyoutsideoftheEEA).
36. Inthecaseabove,thecompanycarryingoutcrossborderprocessingmaybekeentoberegulatedby aleadsupervisoryauthoritytobenefitfromtheonestopshopprinciple.However,theGDPRdoesnot provideasolutionforsituationslikethis.Inthesecircumstances,thecompanyshoulddesignatethe establishmentthathastheauthoritytoimplementdecisionsabouttheprocessingactivityandtotake liabilityfortheprocessing,includinghavingsufficientassets,asitsmainestablishment.Ifthecompany doesnotdesignateamainestablishmentinthisway,itwillnotbepossibletodesignatealead supervisoryauthority.Supervisoryauthoritieswillalwaysbeabletoinvestigatefurtherwherethisis appropriate.
37. TheGDPRdoesnotpermitforumshopping.Ifacompanyclaimstohaveitsmainestablishmentin oneMemberState,butnoeffectiveandrealexerciseofmanagementactivityordecisionmakingover theprocessingofpersonaldatatakesplacethere,therelevantsupervisoryauthorities(orultimately theEDPB12)willdecidewhichsupervisoryauthorityisthelead,usingobjectivecriteriaandlookingat theevidence.Theprocessofdeterminingwherethemainestablishmentismayrequireactiveinquiry andcooperationbythesupervisoryauthorities.Conclusionscannotbebasedsolelyonstatementsby theorganisationunderreview.Theburdenofproofultimatelyfallsoncontrollersandprocessorsto demonstratetotherelevantsupervisoryauthoritieswheretherelevantprocessingdecisionsaretaken andwherethereisthepowertoimplementsuchdecisions.Effectiverecordsofdataprocessingactivity wouldhelpbothorganisationsandsupervisoryauthoritiestodeterminetheleadsupervisory authority.Theleadsupervisoryauthority,orconcernedsupervisoryauthorities,canrebutthe controllersanalysisbasedonanobjectiveexaminationoftherelevantfacts,requestingfurther informationwhererequired.
38. Insomecases,therelevantsupervisoryauthoritieswillaskthecontrollertoprovideclearevidence,in linewithanyEDPBguidelines,ofwhereitsmainestablishmentis,orwheredecisionsaboutaparticular dataprocessingactivityaretaken.Thisevidencewillbegivendueweightandthesupervisory authoritiesinvolvedwillcooperatetodecidewhichoneofthemwilltaketheleadininvestigations. SuchcaseswillonlybereferredtotheEDPBforadecisionunderArticle65(1)(b)GDPRwhere supervisoryauthoritieshaveconflictingviewsintermsofidentifyingtheleadsupervisoryauthority. However,inmostcases,theEDPBexpectsthattherelevantsupervisoryauthoritieswillbeableto agreeamutuallysatisfactorycourseofaction.
Processor
39. TheGDPRalsoofferstheonestopshopsystemforthebenefitofprocessorsthataresubjecttoGDPR andhaveestablishmentsinmorethanoneMemberState.
40. Article4(16)(b)GDPRstatesthattheprocessorsmainestablishmentwillbetheplaceofthecentral administrationoftheprocessorintheEUor,ifthereisnocentraladministrationintheEU,the establishmentintheEUwherethemainprocessing(processor)activitiestakeplace.
41. However,accordingtoRecital36GDPR,incasesinvolvingbothacontrollerandaprocessor,the competentleadsupervisoryauthorityshouldbetheleadsupervisoryauthorityforthecontroller.In thissituation,thesupervisoryauthorityoftheprocessorwillbeasupervisoryauthorityconcerned andshouldparticipateinthecooperationprocedure.Thisrulewillonlyapplywherethecontrolleris establishedintheEEAIncaseswherecontrollersaresubjecttotheGDPRonthebasisofitsArticle 3(2),theywillnotbesubjecttotheonestopshopmechanism.Aprocessorforexample,alargecloud serviceprovidermayprovideservicestomultiplecontrollerslocatedindifferentMemberStates.In suchcases,theleadsupervisoryauthoritywillbethesupervisoryauthoritythatiscompetenttoactas leadforthecontroller.Ineffect,thismeansaprocessormayhavetodealwithmultiplesupervisory authorities.
3OTHERRELEVANTISSUES
3.1 Theroleofthesupervisoryauthorityconcerned
42. GDPRArticle4(22)saysthatthe:
supervisoryauthorityconcernedmeansasupervisoryauthoritywhichisconcernedbythe processingofpersonaldatabecause:(a)thecontrollerorprocessorisestablishedontheterritory oftheMemberStateofthatsupervisoryauthority;(b)datasubjectsresidingintheMemberState ofthatsupervisoryauthorityaresubstantiallyaffectedorlikelytobesubstantiallyaffectedbythe processing;or(c)acomplainthasbeenlodgedwiththatsupervisoryauthority.
43. Theconceptofaconcernedsupervisoryauthorityismeanttoensurethattheleadsupervisory authoritymodeldoesnotpreventothersupervisoryauthoritieshavingasayinhowamatterisdealt withwhen,forexample,individualsresidingoutsidetheleadsupervisoryauthoritysjurisdictionare substantiallyaffectedbyadataprocessingactivity.Intermsoffactor(a)above,thesame considerationsasforidentifyingaleadsupervisoryauthorityapply.Notethatin(b)thedatasubject mustmerelyresideintheMemberStateinquestion;theydonothavetobeacitizenofthatState.It willgenerallybeeasyin(c)todetermineasamatteroffactwhetheraparticularsupervisory authorityhasreceivedacomplaint.
44. Article56,paragraphs(2)and(5)GDPRprovideforaconcernedsupervisoryauthoritytotakearolein dealingwithacasewithoutbeingtheleadsupervisoryauthority.Whenaleadsupervisoryauthority decidesnottohandleacase,theconcernedsupervisoryauthoritythatinformedtheleadsupervisory authorityshallhandleit.ThisisinaccordancewiththeproceduresinArticle61(Mutualassistance) andArticle62(Jointoperationsofsupervisoryauthorities)GDPR.Thismightbethecasewherea marketingcompanywithitsmainestablishmentinParislaunchesaproductthatonlyaffectsdata subjectsresidinginPortugal.Insuchacase,theFrenchandPortuguesesupervisoryauthoritiesmight agreethatitisappropriateforthePortuguesesupervisoryauthoritytotaketheleadindealingwith thematter.Supervisoryauthoritiesmayrequestthatcontrollersprovideinputintermsofclarifying theircorporatearrangements.Giventhattheprocessingactivityhasapurelylocaleffecti.e.on
individualsinPortugaltheFrenchandPortuguesesupervisoryauthoritieshavethediscretionto decidewhichsupervisoryauthorityshoulddealwiththematterinaccordancewithRecital127GDPR
45. TheGDPRrequiresleadandconcernedsupervisoryauthoritiestocooperate,withduerespectfor eachothersviews,toensureamatterisinvestigatedandresolvedtoeachauthorityssatisfaction andwithaneffectiveremedyfordatasubjects.Supervisoryauthoritiesshouldendeavourtoreacha mutuallyacceptablecourseofaction.Theformalconsistencymechanismshouldonlybeinvoked wherecooperationdoesnotreachamutuallyacceptableoutcome.
46. Themutualacceptanceofdecisionscanapplytosubstantiveconclusions,butalsotothecourseof actiondecidedupon,includingenforcementactivity(e.g.fullinvestigationoraninvestigationwith limitedscope).ItcanalsoapplytoadecisionnottohandleacaseinaccordancewiththeGDPR,for examplebecauseofaformalpolicyofprioritisation,orbecausethereareotherconcernedauthorities asdescribedabove.
47. Thedevelopmentofconsensusandgoodwillbetweensupervisoryauthoritiesisessentialtothe successoftheGDPRscooperationandconsistencyprocedures
3.2 Localprocessing
48. LocaldataprocessingactivitydoesnotfallwithintheGDPRscooperationandconsistencyprovisions. Supervisoryauthoritieswillrespecteachotherscompetencetodealwithlocaldataprocessingactivity onalocalbasis.Processingcarriedoutbypublicauthoritieswillalwaysbedealtwithonalocalbasis, too.
3.3 CompaniesnotestablishedwithintheEEA
49. TheGDPRscooperationandconsistencymechanismsonlyapplytocontrollerswithanestablishment, orestablishments,withintheEEA.IfacompanydoesnothaveanestablishmentintheEEA,themere presenceofarepresentativeinaMemberStatedoesnottriggertheonestopshopprinciple.This meansthatcontrollerswithoutanyestablishmentintheEEAmustdealwithlocalsupervisory authoritiesineveryMemberStatetheyareactivein,throughtheirlocalrepresentative.
FortheEuropeanDataProtectionBoard
TheChair (AndreaJelinek)
inmorethanoneMemberState.
orprocessorssingleestablishmentintheEEA,but:
State.
establishmentinasingleMemberState.Thisisbylogicthecontrollerorprocessorsmain establishmentbecauseitisitsonlyestablishment.
