Procedural right – challenging the decision designating a LSA

Article(s) involved (national, EU, or other): Article 56 GDPR

Problem

It is currently difficult for the controllers, the complainants or their representative to contest the decision of a SA designating a LSA, since this type of decision is usually not shared with the parties. 

Ideal Solution

As already pointed out above (Section V. Procedural deadlines), the SA should be obliged to issue a decision on (1) the admissibility of the complaint ; (2) its competence as LSA and/or (3) the decision to transfer the complaint to a LSA within three months from the day of the receipt of the complaint.

This decision should be subject to judicial challenge. If the decision designating the LSA is being challenged, the EDPB should be responsible for determining who that LSA is on the basis of Article 65(1)(b) GDPR. The complainant or the controllers should be able to trigger Article 65(1)(b) GDPR, as not obstacle to this course of action exists in the GDPR.

Furthermore, procedural law should also deal with how to assess the evidence on where the main establishment is located.

Proposed Solution

Concepts 3 and 5 address this issue.

Reference to specific noyb cases:

1) noyb case on forced consent by Google: the French SA adopted a partial decision on the complaint and then sent the case to the Irish SA which then considered that it was after all not the LSA and sent it back to the French SA. The case was sent to the EDPB to determine the competent LSA four years after the complaint. The case was then withdrawn by the CNIL for reasons not shared with noyb, left in the dark.

2) noyb case C014: this complaint concerns a simple access request regarding YouTube and has been pending since January 2019. noyb is of the view that Google LLC is the relevant controller. Despite this, the Austrian SA  forwarded the case to the Irish SA as (assumed) LSA and the Irish SA refuses to act unless noyb accept their view that Google Ireland Ltd. is the controller. The result is that neither SA is doing anything.

3) noyb case C026: the situation here is similar to the one mentioned above: noyb considers Google LLC to be the controller, the Irish SA refuses to act unless noyb accepts their view of Google Ireland being the controller. Neither the Austrian nor the Irish SA have
conducted an investigation on the actual controllership, but after almost a year the Austrian SA decided to forward the case to the Irish SA as the assumed LSA.

4) noyb case C-021: Twitter’s MoPub: there is an argument between the Irish SA and Norwegian SA on who is LSA to investigate . We know the dispute is ongoing but we do not have any way of contributing to the discussion. 

Reference to EDPB documents/table:

The EDPB guidelines on LSA say is that SAs should cooperate to assess this, and should not solely base their statements upon statements provided by the controller or processor.