place o f its central adm inistratio n in the EEA

the com pany s lead superviso ry autho rity fo r this cro ss-bo rder pro cessing activity is the Dutch superviso ry autho rity.

Exam ple 2: A bank has its co rpo rate headquarters in Frankfurt, and all8 its banking pro cessing activities are o rganised from there, but its insurance department is lo cated in Vienna. If the establishm ent in Vienna has the po wer to decide o n all insurance data pro cessing activities and to im plem ent these decisio ns fo r the who le EEA, then, as fo reseen in Article 4(16) GDP R, the Austrian superviso ry autho rity wo uld be the lead superviso ry authority in respect o f the cro ss-bo rder pro cessing o f perso nal data fo r insurance purpo ses, and the com petent German superviso ry autho rity (i.e., the Hessen superviso ry autho rity) wo uld supervise the pro cessing o f perso nal data fo r banking purpo ses, wherever the clients are located9 .

2.1.1 C riteria for identifying a c ontroller s main establishment in c ases where it is not the plac e of its c entral administration in the EEA

23. Recital 36 GDP R is useful in clarifying the m ain factor that shall be used to determ ine a co ntro ller s m ain establishment if the criterio n o f the central adm inistratio n does no t apply. This invo lves identifying where the effective and real exercise o f managem ent activities, that determ ine the m ain decisio ns as to the purposes and m eans o f pro cessing thro ugh stable arrangements, takes place. Recital 36 GDP R also clarifies that the presence and use of technical means and technologies for processing personal data or processing activities do not, in themselves, constitute a main establishment and are therefore not determining criteria for a main establishment .

24. The co ntro ller itself identifies where its m ain establishm ent is and therefo re which superviso ry autho rity is its lead superviso ry authority. However, this can be challenged by the respective superviso ry autho rity co ncerned afterwards.

25. The facto rs belo w are useful fo r determ ining the lo catio n o f a co ntro ller s m ain establishm ent, acco rding to the term s o f the GDP R, in cases where it is not the lo catio n o f its central adm inistratio n in the EEA.

o Where are decisio ns abo ut the purpo ses and m eans o f the pro cessing given final sign o ff ? o Where are decisio ns abo ut business activities that involve data processing m ade? o Where do es the po wer to have decisio ns im plemented effectively lie? o Where is the Directo r (o r Directo rs) with overall m anagement respo nsibility fo r the cro ss-bo rder pro cessing lo cated? o Where is the co ntro ller o r pro cesso r registered as a co m pany, if in a single territo ry?

26. No te that this is not an exhaustive list. Other facto rs m ay be relevant depending o n the co ntro ller o r pro cessing activity in questio n. If a superviso ry authority has reaso ns to do ubt that the establishment

8 In the context of processing personal data for banking purposes, the EDPB reco gnis es that there are many differ ent purposes pursued by these proces sing activiti es. However, to simplify matter s, the EDPB addresse s all of them as a single purpos e. T he sam e is true of proc es sing done for insurance purpose s. 9 It should be recall ed al so th at the G DPR pro vide s for the possibil ity of lo cal ov er sight in speci fic cas es. S ee Recital 127 : Each supervisory authority not acting as the lead supervisory authority should be competent to handle local cases where the controller or processor is established in more than one Member State, but the subject matter of the specific processing concerns only processing carr ied out in a single Member State and involves only data subjects in that single Member State, for example, where the subject matter concerns the processing of employees' personal data in the specific employment context of a Member State. This principle means that the supervi sion of HR data connected to the local e mployment conte xt could fall on se vera l supervi sory authorities.