# UNABHäNGIGES LANDESZENTRUM FüR DATENSCHUTZ SCHLESWIG-HOLSTEIN v. WIRTSCHAFTSAKADEMIE SCHLESWIG-HOLDSTEIN GmbH - Type: Case Law - Source: CJEU - Date: 2018-06-05 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210 - Canonical: https://overview.legal/posts/5949 - Topics: Supervision, Supervisory Authorities, Public Sector, Processors, Processing Agreement, Law Enforcement, Processing, Personal Data, Direct Marketing, Marketing ## Summary Powers of Supervisory Authority: Where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise its powers with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, (i) that establishment is responsible solely for the sale of advertising space and other marketing activities ## Full text ## Court Summary Powers of Supervisory Authority: Where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise its powers with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, (i) that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, (ii) exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State. (¶ 64) ## Excerpt 64 In the light of the foregoing, the answer to Questions 3 and 4 is that Articles 4 and 28 of Directive 95/46 must be interpreted as meaning that, where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State. ## Cited law provisions (1) ### GDPR — gdpr-art-28-par-3-en Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: --- Generated by overview.legal · https://overview.legal/posts/5949 · 2026-08-22