CJEU: national DPA may exercise powers over local establishment handling only

Powers of Supervisory Authority: Where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise its powers with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, (i) that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, (ii) exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State. (¶ 64)

In the light of the foregoing, the answer to Questions 3 and 4 is that Articles 4 and 28 of Directive 95/46 must be interpreted as meaning that, where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State.