An Analysis of EDPB’s Opinion on the Competence of a Supervisory Authority in Case of a Change in Circumstances Relating to the Main or Single Establishment

Abstract

Discussing the usefulness of an Advocate General’s Opinion, former Advocate General Wahl made the point that: “The clarity and the strength of the argumentation for the proposed solution is what elevate it from a mere opinion to an Advocate General’s Opinion.” This is an important observation, and an observation with applicability extending also to the Opinions issued by the European Data Protection Board (EDPB).

On 9 July 2019, the EDPB adopted its Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment. The Opinion was issued in response to requests by the Swedish and French Data Protection Authorities. Having found the EDPB’s Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) to be largely a disappointment, I was hoping to see clearer guidance provided in the most recent EDPB publication dealing with jurisdictional issues. Unfortunately, the EDPB’s Opinion of 9 July 2019 leaves much to be desired. Its reasoning is unconvincing and its conclusion troubling.

Keywords: GDPR, EDPB, Opinion 8/2019, competence of a supervisory authority, single establishment, jurisdiction