# Supervision — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/supervision > Sources are cited per item. Verify against the official texts before relying on them. Oversight and enforcement by supervisory authorities ## Overview ## Legal Framework Supervision under the GDPR rests on two pillars: the tasks and powers of each national supervisory authority, and the cooperation machinery for cross-border processing. Article 57(1)(a) and (g) GDPR require every authority to monitor and enforce the Regulation on its own territory and to cooperate with peer authorities to ensure consistent enforcement — a formulation the CJEU has repeatedly emphasised as the core of the oversight system (see *Facebook Ireland v Gegevensbeschermingsautoriteit* and *IAB Europe*). For cross-border processing, [Article 56](/laws/gdpr/art-56) designates the authority of the main establishment as lead supervisory authority. Where a local authority receives a complaint or identifies an infringement confined to its territory, it must inform the lead authority, which then has a defined window to decide whether to take the case: > "Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60" > — [GDPR Art. 56(3)](/laws/gdpr/art-56#par-3) [Article 60](/laws/gdpr/art-60) then structures the cooperation procedure: the lead authority exchanges information, submits a draft decision, and takes due account of the views of the authorities concerned. The system is designed to converge on consensus, with a structured escape valve: > "expresses a relevant and reasoned objection to the draft decision" > — GDPR Art. 60(4) A relevant and reasoned objection triggers the Article 63 consistency mechanism if not followed. [Article 62](/laws/gdpr/art-62) adds joint operations — joint investigations and enforcement measures — while [Article 77](/laws/gdpr/art-77) gives every data subject the right to lodge a complaint and obliges the authority to inform the complainant of progress and outcome. ## Key Developments The independence of supervisory authorities is not aspirational: in *Commission v Hungary* (Grand Chamber, 8 April 2014), the Court held that Member States enjoy discretion in designing their authority, but that discretion ends once a term of office is set: > "once that term has been set, the Member State must respect it and cannot compel the office to be vacated before the expiry of that term, except for overriding and objectively verifiable reasons" > — [Commission v Hungary ¶38](/posts/132371#seg-38) On the enforcement side, decisions like the Irish DPC's *Midlands Regional Hospital Tullamore* ruling show the practical exercise of Article 58(2) powers. The DPC grounded its compliance order directly in the corrective-measures provision: > "order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period." > — [DPC Tullamore §180](/posts/83465#seg-180) The Belgian APD's cookie-competence decision confirms that authorities assert jurisdiction over online identifiers notwithstanding ePrivacy interplay, relying on EDPB Opinion 5/2019. ## Status of the Debate This topic is contested in court. The statutory allocation of competence is clear, but its application is actively fought over: which establishment counts as the "main establishment" (EDPB Opinion 8/2019 and Guidelines 8/2022 grapple with changes in circumstances), and how the one-stop-shop interacts with local complaint rights under Article 56(2). The EDPB's Statement 4/2024 on the draft procedural enforcement regulation signals ongoing institutional disagreement about whether concerned authorities should be able to compel lead authorities to open ex officio procedures. No definitive court split has yet crystallised on these boundaries; a CJEU ruling clarifying the scope of Article 56(2)'s "substantially affects" test and the weight of objections under Article 60(4) would resolve the open questions. ## Practical Guidance - **Map your establishments now.** Identify your main establishment to predict which authority will be your lead — and sole procedural interlocutor — under [Article 56(1)](/laws/gdpr/art-56#par-2). - **Do not assume the one-stop-shop shields you.** Local authorities retain competence for complaints affecting only their data subjects under Article 56(2). - **Track the Article 60 timeline.** A four-week objection window and the Article 63 consistency mechanism mean draft decisions can shift late in the process. - **Prepare for corrective orders, not just fines.** As *Tullamore* shows, authorities routinely order specified compliance measures within set deadlines under Article 58(2)(d), alongside or instead of fines under Article 83. - **Treat complaints as enforcement triggers.** Article 77 obliges authorities to inform complainants of outcomes, creating a direct litigation pathway via Article 78 that complainants will use. ## Legislation (full text of key provisions) ### Cooperation between the lead supervisory authority and the other supervisory authorities concerned *Source: GDPR, gdpr-art-60-en, 2016-04-27 — https://overview.legal/posts/91098* ### Joint operations of supervisory authorities *Source: GDPR, gdpr-art-62-en, 2016-04-27 — https://overview.legal/posts/91146* ### Competence of the lead supervisory authority *Source: GDPR, gdpr-art-56-en, 2016-04-27 — https://overview.legal/posts/91010* ### Cooperation with the supervisory authority *Source: GDPR, gdpr-art-31-en, 2016-04-27 — https://overview.legal/posts/90617* The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks. ### Supervisory authority *Source: GDPR, gdpr-art-51-en, 2016-04-27 — https://overview.legal/posts/90956* ### Right to lodge a complaint with a supervisory authority *Source: GDPR, gdpr-art-77-en, 2016-04-27 — https://overview.legal/posts/91328* ### General conditions for the members of the supervisory authority *Source: GDPR, gdpr-art-53-en, 2016-04-27 — https://overview.legal/posts/90980* ### Right to an effective judicial remedy against a supervisory authority *Source: GDPR, gdpr-art-78-en, 2016-04-27 — https://overview.legal/posts/91334* ### Rules on the establishment of the supervisory authority *Source: GDPR, gdpr-art-54-en, 2016-04-27 — https://overview.legal/posts/90990* ### Notification of a personal data breach to the supervisory authority *Source: GDPR, gdpr-art-33-en, 2016-04-27 — https://overview.legal/posts/90633* ## Case law ### Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per *Source: Court of Justice of the European Union, C-288/12, 2014-04-08 — https://overview.legal/posts/132371 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0288* The European Commission brought an infringement action against Hungary before the Court of Justice (Grand Chamber) under Article 258 TFEU, alleging that Hungary violated Article 28(1) of Directive 95/46/EC by adopting national legislation that prematurely terminated the term of its existing data protection supervisory authority and appointed a new head. The Court ruled that Hungary had failed to fulfil its obligations, holding that the independence of supervisory authorities under Article 28(1) requires that their term of office cannot be brought to an end without legitimate justification, and that a Member State may not reduce the originally established term of office through general legislation without respecting the conditions previously governing the termination of that term. No fine was imposed in this judgment. ### Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol) *Source: Court of Justice of the European Union, C-755/21, 2024-03-05 — https://overview.legal/posts/132271 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0755* In Case C-755/21 P, Marián Kočner appealed a General Court judgment dismissing his claim for compensation against Europol for alleged damage arising from Europol's disclosure of his personal data and inclusion of his name on so-called "mafia lists." The Grand Chamber of the Court of Justice of the European Union examined the scope of non-contractual liability under Articles 49(3) and 50 of Regulation (EU) 2016/794, addressing whether Europol could be held liable for non-material damage resulting from unlawful data processing. The full outcome of the appeal is not reflected in the provided excerpt, which does not include the operative part of the judgment. ### Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems *Source: CJEU, 2020-07-16 — https://overview.legal/posts/5945 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311* “the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data. Each of those authorities is therefore vested with the power to check whether a transfer of personal data from its own Member State to a third country complies with the requirements laid down in that regulation” / “The exercise of that responsibility is of particular importance where personal data is tra ### CE asks CJEU if GDPR one-stop-shop applies to ePrivacy cookie consent cases *Source: CE, 2022-01-28 — https://overview.legal/posts/122847 — original: https://gdprhub.eu/index.php?title=CE_-_449209* Facts — On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act (which transposes the ePrivacy Directive). Google (1) had not obtained the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) had lacked to provide information, and (3) had not implemented a mechanism to refuse the cookies. Google did not agree with the CNIL’s decision and brought the issue before court. First, it claimed that, since there is cross-border processing, the Irish DPA (DPC) is the lead supervisory authority since Google’s main establishment in the EU is in Ireland, and the CNIL therefore did not have competence to rule on this matter according to the one-stop-shop mechanism. Second, it found the fine to be disproportionate. Hence, it requested the Council of State to annul the decision, and to refer two preliminary questions to the CJEU, asking: (1) whether the one-stop-shop mechanism provided for in Article 56 GDPR is excluded in the context of cross-border processing that falls within the scope of both the ePrivacy Directive and the GDPR, and (2) whether Article 15a ePrivacy Directive violates the right to data protection because does not provide an obligation, but rather an option, “for the competent national regulatory authorities to adopt measures to ensure effective cross-border cooperation in the enforcement of national laws adopted pursuant to the directive and to create harmonised conditions for the provision of services involving cross-border data flows”. Holding — The Council of State rejected Google’s appeal. First, according to the Council, the ePrivacy Directive, implemented in the French Data Protection Act, does not provide for the application of the one-stop-shop mechanism as mentioned in Article 56 GDPR. Although the requirements for consent are regulated by the GDPR the deposit of cookies is regulated by the ePrivacy Directive. Hence, even if cross-border processing takes place, the CNIL is competent to monitor compliance with the objectives of such Directive. The Council then notes that “it follows that, as regards the control of the operations of access and recording of information in the terminals of users in France of an electronic communications service, even if they are the result of cross-border processing, the measures to monitor the application of the provisions transposing the objectives of Directive 2002/58/EC fall within the competence conferred on the CNIL by the Law of 6 January 1978.” The Council stipulated that there is no need to refer preliminary questions to the CJEU, because it had no doubt as to whether the one-stop-shop mechanism should be excluded in the context of cookies. Second, the Council rejected Google’s argument that their right of defense had been infringed by the CNIL because they did not provide a prior formal notice, since it is not required to provide such a formal notice before imposing a sanction. Third, on the substance of the matter, the Council confirmed the three violations of Article 82 of the Data Protection Act: (1) not obtaining the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) not providing clear information on the deposit of cookies, and (3) not implementing a mechanism to refuse the cookies. Lastly, the Council stated that the fines were not disproportionate in light of the financial capacities of the “two” companies. It considered Google’s market share of more than 90% with (an estimated) 47 million users in France and the large profits that follow from the targeted online advertisement. Moreover, it stated that Google did not genuinely cooperated with the CNIL since it did not provide advertising revenues, and the breaches were serious. ### Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit *Source: Court of Justice of the European Union, C-645/19, 2021-06-15 — https://overview.legal/posts/132323 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0645* In Case C-645/19, the Court of Justice of the European Union (Grand Chamber) addressed a preliminary ruling from the Brussels Court of Appeal concerning Facebook Ireland Ltd and others versus the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) regarding the scope of the GDPR's "one-stop shop" mechanism for cross-border data processing. The core issue was whether a national supervisory authority that is not the lead supervisory authority retains the competence to initiate legal proceedings and bring enforcement actions against a controller for cross-border processing violations. The Court held that non-lead supervisory authorities retain the power to bring proceedings before national courts, even regarding cross-border processing, subject to the obligation of sincere and effective cooperation under Articles 60 to 66 of the GDPR. No fine was imposed in this judgment, as it was a preliminary ruling on the interpretation of EU law. ### BVwG: Data protection complaint by litigation-funded enforcement association inadmissible *Source: Federal Administrative Court, 2026-01-07 — https://overview.legal/posts/353598 — original: https://gdprhub.eu/index.php?title=BVwG_-_W292_2342582-1/13E* Facts — A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders. The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of Article 15 GDPR. The grounds of the violation were illustrated only rudimentary in the complaint. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a service fee. The DPA refused to act on the request on the basis of Article 57(4) GDPR because it held that the data subject lodged the complaint not for reasons of the protection of personal data. The data subject appealed the decision. Holding — The Federal Administrative Court (Bundesverwaltungsgericht) upheld the decision of the DPA and decided that the data subject lodged the complaint not for reasons of the protection of personal data but for financial reasons. Therefore, Article 57(4) GDPR was applicable. The Court believed that without the financial incentive, the data subject would not have lodged the complaint. According to the Court, the fact that the initiative to exercise the data subject’s right did not come from the data subject themselves but from the association, is another factor that lead the Court to assume an abusive exercise of data subjects’ rights. The data subject did not explicitly mandate the association with the access request, the data was already available to the data subject via the portal but they did not show any interest in it and there was no indication of unlawful processing. All those factors added to the conclusion that the data subject did not have a data protection interest for exercising their rights. The sole motivation for the access request was to enable the business model of the association. These activities of the association that are aimed primarily at re-claiming the service fee through the means of civil law, are already known to the Court. The decision of the DPA to reject the complaint instead of requesting the DPA to issue a fee for their activity pursuant to Article 57(4) GDPR, which would be a less intrusive measure, was adequate. Because of the notorious activity of the association that is systematically disabling the work of the DPA, a fee would not be adequate to stop this activity. ### CE upholds CNIL competence to fine Google €100M for cookies despite no lead authority role *Source: CE, 2021-03-04 — https://overview.legal/posts/125660 — original: https://gdprhub.eu/index.php?title=CE_-_449212* Facts — On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance with the General Data Protection Regulation (GDPR) and ePrivacy Directive 2002/58/EC, for lack of transparency, inadequate information and lack of valid consent regarding for violating the regulation on cookies while operating the website google.fr. The sanction was accompanied by an order to comply with article 82 of the French Law on data protection (Law Informatique et Libertés), under three months on penalty of a €100,000 fine per day of delay. The companies appealed to the Conseil d’État in interim procedure against the CNIL's decision, arguing that the French DPA was not the competent authority because it was not the lead supervisory authority for Google LLC or Google Ireland Limited. Dispute — Is the CNIL territorially competent to investigate and sanction a company for violating the information principle when depositing cookies if it is not the lead supervisory authority of the company? The CNIL considered that Google does have EU headquarters in Ireland, but that this Irish entity ‘did not have a decision making power’ in relation to the relevant cross-border data processing activities to which the complaints related. For that reason the CNIL decided that the One Stop Shop mechanism did not apply and that the CNIL, like any other European supervisory authority, was therefore competent to make a decision. Holding — The Conseil d’État rejected the request made by Google and ruled that the French DPA was territorially competent on this matter even though it is not the lead supervisory authority. The court stated that Article 82 of the Law Informatique et Libertés was a transposition of Article 5(3) ePrivacy Directive 2002/58/EC into French Law when dealing with cookies and that the CNIL is charged with enforcing this Directive. As such, the one-stop shop mechanism provided for in Article 56 GDPR does not apply in the present case. ### TR v Land Hessen *Source: Court of Justice of the European Union, C-768/21, 2024-09-26 — https://overview.legal/posts/132245 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0768* In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (HBDI) for declining to exercise corrective powers against Sparkasse X following a personal data breach complaint. The Court clarified the limits of supervisory authorities' discretion under GDPR Articles 57(1) and 58(2), holding that while authorities retain discretion in selecting corrective measures, they are legally obliged to exercise those powers when an infringement is established, and complainants have a right to an effective remedy under Article 77 even where no enforcement action was taken. No fine was imposed in this proceeding, as the ruling addressed the supervisory authority's enforcement obligations rather than penalizing a controller. ### Data Protection Commission v European Data Protection Board *Source: General Court, T-70/23, 2025-01-29 — https://overview.legal/posts/132152 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0070* The Irish Data Protection Commission (DPC) challenged provisions of EDPB Binding Decisions 3/2022, 4/2022, and 5/2022, arguing the EDPB exceeded its competence under Article 65(1)(a) GDPR by requiring the DPC to broaden its investigation into Facebook, Instagram, and WhatsApp and issue new draft decisions. The core legal issue was whether the EDPB, in the consistency mechanism context, can compel a lead supervisory authority to conduct additional investigations and produce new draft decisions beyond addressing the specific relevant and reasoned objections raised by concerned supervisory authorities. The General Court dismissed the DPC's actions, upholding the EDPB's authority to issue binding decisions instructing the lead supervisory authority to carry out further investigation and issue new draft decisions. ### VG Düsseldorf: data subjects challenge district's sharing of personal data in water-law *Source: Administrative Court Düsseldorf, 2026-06-22 — https://overview.legal/posts/108992 — original: https://gdprhub.eu/index.php?title=VG_Düsseldorf_-_29_K_3490/24* Facts — A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties. One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, the controller shared the data subjects' personal data with various participants, including the owners of the affected properties, other public authorities and a lawyer who claimed to represent the data subjects. The data subjects lodged a complaint with the competent supervisory authority (LDI NRW), alleging that the controller had unlawfully processed and disclosed their personal data. They argued that their personal data had been shared with uninvolved third parties, that the controller had communicated with a lawyer whom they had not authorised, recorded a telephone conversation with an unknown person, and transmitted personal data by unencrypted email. The controller's data protection officer addressed each allegation and provided additional factual information concerning the disputed processing operations. The DPA initially informed the data subjects that no GDPR infringement was apparent, invited them to provide any additional factual information, and explained that it would obtain extracts from the controller's administrative file if there were concrete indications that it contained relevant facts not already available. The data subjects did not identify any additional facts and instead reiterated their legal position that the controller had breached its GDPR accountability obligations. The DPA rejected the complaint, concluding that no GDPR infringement could be established. The data subjects then brought an action before the Verwaltungsgericht Düsseldorf (Administrative Court Düsseldorf), seeking a fresh decision on their complaint on the basis that the DPA had failed to adequately investigate the complaint because it had not obtained the controller's administrative file before reaching its decision. Holding — The court held that Articles 57(1)(f) and 77(1) GDPR give rise to an enforceable right requiring a supervisory authority to investigate a complaint to the extent appropriate in the circumstances before determining whether a GDPR infringement has occurred. Recital 141 GDPR requires the investigation to extend as far as is appropriate in light of the circumstances of the individual case, including the significance of the complaint and the seriousness of the alleged infringement. Applying these principles, the court held that the DPA had adequately investigated the complaint. It had considered each allegation together with the detailed response provided by the controller's data protection officer, invited the data subjects to provide any additional factual information, and explained that it would obtain extracts from the administrative file if concrete indications emerged that further relevant facts required clarification. As the data subjects did not provide any additional facts and there were no objective indications that the information already available was inaccurate or incomplete, the court held that the DPA was not required to obtain the controller's administrative file or undertake further investigations in the absence of concrete indications that additional factual clarification was necessary. The court further held that the DPA had correctly concluded that no GDPR infringement had occurred. The court held that the disputed processing was lawful under Article 6(1)(e) GDPR, read together with Article 6(3) GDPR and § 88 of the German Water Resources Act (WHG), which provided the legal basis for the processing. The court also held that the transmission of personal data by email did not infringe Article 5(1)(f) GDPR because, in the circumstances of the case, transport encryption provided an appropriate level of security. ### BE v Nemzeti Adatvédelmi és Információszabadság Hatóság *Source: Court of Justice of the European Union, C-132/21, 2023-01-12 — https://overview.legal/posts/132298 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0132* In Case C-132/21, the Court of Justice of the European Union (First Chamber) issued a preliminary ruling responding to a referral from the Budapest High Court concerning the parallel exercise of GDPR remedies under Articles 77, 78, and 79. The underlying dispute involved data subject BE challenging the refusal by the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian Data Protection Authority) of BE's request to obtain extracts from a sound recording of a shareholders' general meeting. The Court held that data subjects may simultaneously lodge a complaint with a supervisory authority and bring a judicial action against a controller, as Member States may not impose procedural rules that prevent the parallel exercise of these remedies in a manner that undermines the effective protection guaranteed by the GDPR and Article 47 of the EU Charter of Fundamental Rights. ### Cour Administrative - 49701C *Source: Administrative Court of the Grand-Duchy of Luxembourg, 2024-12-12 — https://overview.legal/posts/158440 — original: https://gdprhub.eu/index.php?title=Cour_Administrative_-_49701C* Facts — On 19 May 2020, a Luxembourg bank informed the complainant that, by 30 June 2020, they would transmit the complainant's bank account information to the Luxembourg fiscal authorities. Afterwards, by latest the 30th September 2020, the Luxembourg fiscal authorities will share this information with the US fiscal authorities. The complainant, a French and American citizen connected to the association for the protection of civil rights ASBL, turned to the Luxembourg direct Tax Office (hereinafter: ACD), explaining that the data to be transferred on the basis of the FATCA concern identification, financial and economic data, i.e. personal data as defined in the GDPR. Thus, the complainant requested the ACD to erase the personal data and immediately discontinue the exchange of information between the ACD and the American fiscal authorities. The director of the ACD rejected this request, stating that the ASBL is not a data subject and the processing of the personal data of the complainant was necessary to respect the Luxembourg FATCA Agreement law to which the ACD is subject, Thus, in their view the request to restrict processing is not justified. The complainant turned to the Luxembourg Administrative Tribunal, which rejected the injunctive request to suspend the information sharing with the US fiscal authorities. The Tribunal also declared itself entitled neither to decide on the decision of the ACD, nor to invalidate it. As to the merit, the Tribunal found the request for invalidation unfounded, rejecting the request for a reimbursement and ordering the complainant to pay the costs. The ACD challenged the receivability of appeal. Holding — In relation to the GDPR-related questions, the court held the following. Whether the GDPR was applicable to the data transfer With regards to the applicability of the GDPR and the law of the 1st August 2018 about the organisation of the Commission Nationale pour la Protection des Données (CNPD, the Luxembourg data protection supervisory authority) and the implementation of Regulation (EU) 2016/679 replacing Directive 95/46 EC and the law of the 2nd August 2002 about the implementation of said directive. The subject of the case is neither direct prevention, detection and prosecution of criminal activities (when Directive (EU) 2016/680 would apply), nor is it within the area of the Common Foreign and Security Policy (which is exempt from the application of the GDPR), therefore the GDPR applies. In respect of the prevention, detection and prosecution of criminal activities, Directive (EU) 2016/680 would only apply if the data controller were a competent authority. These authorities are only authorities of law enforcement, and the tax office is not one of them. The processing in question in the case at hand concerns the exercise of the rights of Member States in the area of taxation, in particular the mutual cooperation in tax matters through the automatic exchange of information. Whether the FATCA Agreement was valid in the light of the GDPR In interpreting the GDPR related to the case, the court found furthermore, that Article 96 GDPR applies, i.e. as an existing international treaty, the FATCA Agreement is valid even if it contradicts the GDPR. As the FATCA Agreement was signed the 28th March 2014 and enacted by the law of the 24th July 2015, it was concluded before the GDPR entered into force and is thus covered by Article 96 of the GDPR. There is also no stipulation which would require – contrary to what the appellants state – to modify the FATCA Agreement in view of the GDPR. The primacy of international law over the national law, which is enshrined in Luxembourg law, in case when there is a conflict between rules of an international treaty and those in national law, even a posteriori (i.e. when the rules of national law are adopted after the entry in force of the international treaty), the international norm has precedence over the national norm. Thus, in case of a hypothetical contradiction with the law of the 2nd August 2002, the FATCA Agreement would prevail. Whether the transfer of personal data to the US should have been preceded by a Transfer Impact Assessment and whether the transfer to the US was lawful Concerning the further two questions proposed to be asked from the CJEU, the court was of the opinion that these were not necessary to decide the present case. Given that Article 96 GDPR applies, the legality the decision of the director of ACD of the 22nd March 2021, having refused to stop the transfer of the personal data provided by the Luxembourg financial institutions through the automatic exchange of information to the fiscal administration of the United States in the framework of the FATCA Agreement has thus to be examined exclusively in the light of the Directive 95/46 EC, as this directive remains in force (due to Article 96 GDPR) as the only legal reference to judge the lawfulness of the measure, as no withdrawal or modification of FATCA Agreement was necessary. Articles 25 and 26 of Directive 95/46 EC are the rules to be taken into account as specific rules as the automatic exchange of information according to FATCA Agreement is a transfer of personal data to third countries, and these rules are part of chapter IV of Directive 95/46 EC, entitled “transfer of personal data to third countries”. The appellants claim that in this respect, ACD should have investigated the adequate level of protection in the US. However, in Mémorial (the Luxembourg official journal), series A n° 156 of the 10th August 2015 (p. 3796) establishes that "the conditions of entry into force of the agreement about the exchange of notes indicated above (i.e. the exchange of notes regarding FATCA Agreement, signed the 31st March and 1st April 2015) being fulfilled the 29th July 2015, the said acts entered into force between the Contracting Parties the 28th July 2015, according to Article 10 of the Agreement. Thus, the State had sufficient elements of information to conclude that the exchanged data remain confidential, will be used for fiscal purposes and will be processed by infrastructures which ensure such confidentiality. Thus, the State did not find any elements to doubt in this regard at that point. Article 26 (1), point d Directive 95/46 authorises Member States to foresee or authorise transfers of personal data to a third country also when the legal system of this latter does not ensure an adequate level of protection, namely in the case when this transfer is necessary for the concerned Member State to preserve an important public interest. This stipulation has to be understood as giving Member States a certain freedom of manoeuvre concerning the content of the notion of important public interest which they consider justifying the transfer of personal data to third countries which do not guarantee an adequate level of protection, given that the interests which merit protection are not entirely the same in the different Member States. In general, the State rightly argues that the CJEU recognised the fight against aggressive tax planning and the prevention of risk of tax avoidance and tax fraud as objectives in the general interest recognised by the Union which can justify the restriction of rights guaranteed in the Charter of Fundamental Rights (judgment of the 8th December 2022, case C-694/20, Orde van Vlaamse Balies e.a. and of the 29th July 2024, case. C-623/22, Belgian Association of Tax Lawyers). The transfer of information serves this objective. The appellants contest nevertheless this analysis, referring to the Guidelines 2/2020 the EDPB according to which the derogations should be interpreted narrowly and concern mainly occasional and on-repetitive transfers but cannot justify transfers on a large scale, as foreseen in the FATCA Agreement. This restriction does not, however, stem from Article 26 (1), point d of Directive 95/46 EC, neither from the relevant Recitals of Directive 95/46 EC. Even if the EDPB has a certain role in the harmonised application of the Directive 95/46 EC and afterwards of the GDPR by all member States, its analysis in its guidelines is not binding. The appellants also claim that there should be a similar provision of information from the US fiscal authorities to the European authorities. Nevertheless, such a requirement of reciprocity is not required neither from Article 26 (1), point d), nor from the recitals of Directive 95/46 EC. Even when such a reciprocity corresponds a certain logic of cooperation, such a logic is in political domain but does not influence the interpretation of a rule of Union law. Based on the above considerations, the court considers that the execution of the FATCA Agreement and of the law of the 24th July 2015 by the ACD is lawful based on Article 26 (1) point d), of Directive 95/46 EC, even when the US does not guarantee and adequate protection of personal data pursuant to Article 25 (1), of Directive 95/46 EC. Therefore, the arguments of the appellants to the contrary have to be rejected. This analysis is also sufficient to support that there is no need to request a preliminary ruling from the CJEU. Therefore, the Administrative Court of Luxembourg rejected the appeal. ## Guidance ### Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority *Source: EDPB, edpb-guidelines-for-identifying-a-controller-or-processors-lead-supervisory-authority, 2023-04-17 — https://overview.legal/posts/38046 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-82022-on-identifying-a-controller-or-processors-lead-supervisory_en* The European Data Protection Board (EDPB) adopted Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority, providing updated guidance on the criteria for determining main establishment and the one-stop-shop mechanism under the GDPR. The guidelines address key concepts including cross-border processing, the "substantially affects" threshold, and the steps controllers and processors must follow to identify their lead supervisory authority. This document serves as interpretive guidance with no fines or enforcement outcomes, replacing the prior WP244 guidelines endorsed by the EDPB in 2018. ### Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment *Source: EDPB, opinion-82019-on-the-competence-of-a-supervisory-authority-in-en, 2019-07-12 — https://overview.legal/posts/126208 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-82019-on-the-competence-of-a-supervisory-authority-in_en* Adopted 1 Opinion 8 /2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment Adopted on 9 July 2019 Adopted 2 Table of c ontents 1 SUMMARY OF THE FACTS ................................ ................................ ................................ ................ 3 2 ON THE COMPETENCE OF THE BOARD TO ADOPT AN OPINION UNDER ARTICLE 64.2 ON THIS TOPIC ................................ ................................… ### Coordinated Enforcement Action, *Source: EDPB, coordinated-enforcement-action-implementation-right-erasure-en, 2026-03-02 — https://overview.legal/posts/53740 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/other/coordinated-enforcement-action-implementation-right-erasure_en* EDPB, Coordinated Enforcement Action, implementation of the right to erasure by controllers ### Opinion 7/2020 on the draft list of the competent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35(5) GDPR) *Source: EDPB, opinion-72020-on-the-draft-list-of-the-competent-supervisory-en, 2020-04-22 — https://overview.legal/posts/126167 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-72020-on-the-draft-list-of-the-competent-supervisory_en* Adopted 1 Opinion 7 / 2020 on the draft list of the com petent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35( 5 ) GDPR) Adopted on 22 April 2020 Adopted 2 Adopted 3 The European Data Protection Board Having r egard to Article 63, Article 64 (2) , Article 64(3) and Article 35( 1), (5), (6) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the… ### Statement 4/2024 on the recent legislative developments on the Draft Regulation laying down additional procedural rules for the enforcement of the GDPR *Source: EDPB, statement-42024-on-the-recent-legislative-developments-on-en, 2024-10-09 — https://overview.legal/posts/125713 — original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/statement-42024-on-the-recent-legislative-developments-on_en* 1 Statement 4 /2024 on the recent legislative developments on the Draft R egulation laying down additional procedural rules for the enforcement of the GDPR Adopted on 7 October 2024 The European Data Protection Board has adopted the following statement: 1. BACKGROUN D AND PURPOSE OF THE STATEMENT Following its Statement on enforcement cooperation 1 , the European Data Protection Board ( EDPB ) sent to the European Commission a list of procedural aspects that could benefit from further… ### Coordinated Enforcement Action, implementation of the right of access by controllers *Source: EDPB, edpb-cef-report-2024-20250116-rightofaccess-en, 2025-01-20 — https://overview.legal/posts/50412 — original: https://www.edpb.europa.eu/documents/coordinated-enforcement-framework/coordinated-enforcement-action-implementation-of-the_en* EDPB 20 jan 2025, Coordinated Enforcement Action, implementation of the right of access by controllers. ### Opinion 13/2019 on the draft list of the competent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35(5) GDPR) *Source: EDPB, opinion-132019-on-the-draft-list-of-the-competent-supervisory-en, 2019-07-12 — https://overview.legal/posts/126218 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-132019-on-the-draft-list-of-the-competent-supervisory_en* Adopted 1 Opinion 13 /2019 on the draft list of the com petent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35( 5 ) GDPR) Adopted on 10 July 2019 Adopted 2 Adopted 3 The European Data Protection Board Having r egard to Article 63, Article 64 (2)and Article 35( 1), (5), (6) of the Regulation 2016/679/E U of the European Parliament and of the Council of 27 April 2016 on the protection of natural… ### Opinion 12/2019 on the draft list of the competent supervisory authority of Spain regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35(5) GDPR) *Source: EDPB, opinion-122019-on-the-draft-list-of-the-competent-supervisory-en, 2019-07-12 — https://overview.legal/posts/126210 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-122019-on-the-draft-list-of-the-competent-supervisory_en* Adopted 1 Opinion 12 /2019 on the draft list of the com petent supervisory authority of Spain regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35 ( 5 ) GDPR) Adopted on 10 July 2019 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 6 3, Article 64(2)and Article 35 (1), (5), (6) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural… ## Enforcement decisions ### Xfera Moviles S.A.: Insufficient cooperation with supervisory authority *Source: Spanish Data Protection Authority (aepd), 2020-07-23 — https://overview.legal/posts/46470 — original: https://www.enforcementtracker.com/ETid-355* Following a complaint, Xfera Móviles was requested by the AEPD to submit certain information and documents, but did not do so within the provided time limit. ### FUENSANTA S.L.: Insufficient cooperation with supervisory authority *Source: Spanish Data Protection Authority (aepd), 2021-11-23 — https://overview.legal/posts/47028 — original: https://www.enforcementtracker.com/ETid-913* The controller failed to provide information requested by the Spanish DPA (AEPD) for investigative purposes. ### Globus Score SRL: Insufficient cooperation with supervisory authority *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2019-12-16 — https://overview.legal/posts/46260 — original: https://www.enforcementtracker.com/ETid-145* The company did not comply with measures ordered by the National Supervisory Authority. ### SPAIN DPA: Insufficient cooperation with supervisory authority *Source: Spanish Data Protection Authority (aepd), 2025-12-20 — https://overview.legal/posts/51497 — original: https://www.enforcementtracker.com/ETid-2986* The Spanish DPA has imposed a fine of EUR 300 on an unkonwn person/entity. The controller failed to react to requests made by the DPA. ### Entrepreneur: Insufficient cooperation with supervisory authority *Source: Polish National Personal Data Protection Office (UODO), 2025-07-28 — https://overview.legal/posts/48879 — original: https://www.enforcementtracker.com/ETid-2764* The Polish DPA has imposed a fine of EUR 4,400 on an Entrepreneur. The controller failed to adequatly react to a request from the DPA. ### Dincă Viorel George: Insufficient cooperation with supervisory authority *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2025-06-18 — https://overview.legal/posts/48837 — original: https://www.enforcementtracker.com/ETid-2722* The Romanian DPA has imposed a fine of EUR 200 on a private individual. The controller failed to react to communication from the supervisory authority. ### Modern Barber: Insufficient cooperation with supervisory authority *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2019-11-26 — https://overview.legal/posts/46263 — original: https://www.enforcementtracker.com/ETid-148* The company did not comply with measures ordered by the National Supervisory Authority. ### LATVIA DPA: Insufficient cooperation with supervisory authority *Source: Data State Inspectorate (DSI), 2022-01-01 — https://overview.legal/posts/48017 — original: https://www.enforcementtracker.com/ETid-1902* Six fines for failing to provide information requested by the DPA during an investigation. ## Recent developments ### Annual Report 2025 out now! *Source: noyb - European Center for Digital Rights, 2026-10-13 — https://overview.legal/posts/595733 — original: https://noyb.eu/en/annual-report-2025-out-now* noyb remains one of the leading European forces pushing for the fundamental right to data protection for all users. To date, our legal work has resulted in administrative fines totalling €2 billion. In 2025, we not only filed several new GDPR complaints, but also began preparations for our first first collective redress case and dedicated significant resources to the EU Commission's Digital Omnibus package. Read the Annual Report for 2025! Our biggest projects in 2025. In 2025, noyb has started ### Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs *Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593252 — original: https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en* Background informationDate of final decision: 28/07/2026National caseController: Ministry of Social Cohesion and Family AffairsLegal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject)Decision: Administrative fine, Compliance order, Summary of the DecisionOrigin o ### We Demand More Information on How Marin Cops Illegally Shared Flock ALPR Data *Source: Electronic Frontier Foundation, 2026-10-01 — https://overview.legal/posts/449820 — original: https://www.eff.org/deeplinks/2026/10/we-demand-more-information-how-marin-cops-illegally-shared-flock-alpr-data* The Marin County Sheriff’s Office is the latest California law enforcement agency to get caught sharing automated license plate reader (ALPR) data from their Flock Safety system with out-of-state and federal agencies. EFF and the ACLU of Northern California are calling them out for this direct violation of California law, which has put every driver in the county at risk and is especially dangerous for immigrants, abortion seekers, and other targets of the federal government. Today, we sent the M ### 📱 Hey Siri, How Do I Limit AI Data Access? | EFFector 38.17 *Source: Electronic Frontier Foundation, 2026-09-30 — https://overview.legal/posts/449825 — original: https://www.eff.org/deeplinks/2026/09/hey-siri-how-do-i-limit-ai-data-access-effector-3817* With the launch of iOS 27, Apple is rolling out a variety of new AI features to its familiar voice assistant, Siri. But how are AI tools like these handling our data? In our latest EFFector newsletter, we're talking about the privacy complications of AI phone features. JOIN OUR NEWSLETTER For over 35 years, EFFector has been your guide to understanding the intersection of technology, civil liberties, and the law. This issue covers drones and our right to record the law enforcement, video doorbel ### While the Country Rejects ALPR Mass Surveillance, SF Settles for Weak Safeguards *Source: Electronic Frontier Foundation, 2026-09-29 — https://overview.legal/posts/449826 — original: https://www.eff.org/deeplinks/2026/09/while-country-rejects-alpr-mass-surveillance-sf-settles-weak-safeguards* San Francisco's decision to retain its use of Automated License Plate Reader (ALPR) surveillance cameras belies what we know about this spying technology tool: it endangers residents and threatens the privacy and civil liberties of our community. Based on what's in the city's press release and announcement, this policy will do nothing to stop actual harms. We know innocent drivers will be stopped and menaced by officers because of erroneous matches. We know officers use Flock to stalk potential ## Literature ### European Union ∙ EDPB Opinion on the Draft Lists of Competent Supervisory Authorities Regarding the Processing Operations Subject to DPIAs *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132500 — original: https://doi.org/10.21552/edpl/2018/4/13* ### The independence requirement for national data protection supervisory authorities. *Source: PinG Privacy in Germany, 2019-04-26 — https://overview.legal/posts/132494 — original: https://doi.org/10.37307/j.2196-9817.2019.03.07* ### The Wirtschaftsakademie Fan Page Decision: A Landmark on Joint Controllership – A Challenge for Supervisory Authorities Competences *Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132499 — original: https://doi.org/10.21552/edpl/2018/4/21* Case C-210/16 Wirtschaftsakademie Schleswig-Holstein [2018] ECLI:EU:C:2018:388, Judgment of the Court (Grand Chamber) of 5 June 2018 – Article 16(2) of the Treaty on the Functioning of the European Union [2012] OJ C 326/47 – Article 8(3) of the Charter of Fundamental Rights of the European Union [2012] OJ C 326/391 – Article 2 (b), (d), (e) and (f), Article 4(1), Article 24, Article 28 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L 281/31 ### Complete Independence of national Data Protection Supervisory Authorities: About persons, czars and data governance in Belgian debates *Source: European Law Blog, 2021-12-24 — https://overview.legal/posts/132495 — original: https://doi.org/10.21428/9885764c.7197cf15* ### `Data Protection, Privacy Regulators and Supervisory Authorities` by Jacob Kornbeck *Source: Journal of Data Protection Privacy, 2021-03-01 — https://overview.legal/posts/132492 — original: https://doi.org/10.69554/jyow6251* ## Tools ### GDPR Enforcement Tracker (fines and penalties database) *Source: CMS, 2026-07-17 — https://overview.legal/posts/125626 — original: https://www.enforcementtracker.com/* Continuously updated database by CMS of thousands of GDPR fines and penalties across all member states: authority, amount, date, sector, violated articles and a summary per decision, with filtering and statistics. The de-facto reference for fine benchmarking. ## Related topics - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Processors** — https://overview.legal/topics/processors Entities that process data on behalf of controllers - **Public Authority** — https://overview.legal/topics/public-authority Government bodies and their data processing activities --- Generated by overview.legal · https://overview.legal/topics/supervision · 2026-10-13