Navigation
GDPR > Betragtning 36
Download PDF

Betragtning 36

Recital 36

(36) En dataansvarligs hovedvirksomhed i Unionen bør være stedet for dennes centrale administration i Unionen, medmindre der træffes beslutninger vedrørende formål og hjælpemidler i forbindelse med behandling af personoplysninger et andet sted i Unionen, hvor den dataansvarlige er etableret; i dette tilfælde bør dette andet sted anses for at være hovedvirksomheden.

En dataansvarligs hovedvirksomhed i Unionen bør fastlægges ud fra objektive kriterier og bør indebære effektiv og faktisk udøvelse af ledelsesaktiviteter, der fastlægger de vigtigste beslutninger om behandlingsformål og -hjælpemidler gennem en mere permanent struktur.

Dette kriterium bør ikke afhænge af, om behandling af personoplysninger foretages på dette sted.

Det forhold, at der findes og anvendes tekniske midler og teknologi til behandling af personoplysninger eller behandlingsaktiviteter, medfører ikke i sig selv, at der er etableret en hovedvirksomhed, og er derfor ikke afgørende for kriteriet om hovedvirksomhed.

Databehandlerens hovedvirksomhed bør være stedet for den pågældendes centrale administration i Unionen, eller hvis databehandleren ikke har nogen central administration i Unionen, det sted, hvor hovedbehandlingsaktiviteterne foregår i Unionen.

I tilfælde, der involverer både den dataansvarlige og databehandleren, bør den kompetente ledende tilsynsmyndighed fortsat være tilsynsmyndigheden i den medlemsstat, hvor den dataansvarlige har sin hovedvirksomhed, men databehandlerens tilsynsmyndighed bør anses for at være en berørt tilsynsmyndighed, og denne tilsynsmyndighed bør deltage i den samarbejdsprocedure, der er fastsat i denne forordning.

Under alle omstændigheder bør tilsynsmyndighederne i den eller de medlemsstater, hvor databehandleren har en eller flere etableringer, ikke anses for at være berørte tilsynsmyndigheder, når et udkast til afgørelse kun vedrører den dataansvarlige.

Foretages behandlingen af en koncern, bør den kontrollerende virksomheds hovedvirksomhed anses for at være koncernens hovedvirksomhed, medmindre formål og hjælpemidler fastlægges af en anden virksomhed.

(36) The main establishment of a controller in the Union should be the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union, in which case that other establishment should be considered to be the main establishment.

The main establishment of a controller in the Union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing through stable arrangements.

That criterion should not depend on whether the processing of personal data is carried out at that location.

The presence and use of technical means and technologies for processing personal data or processing activities do not, in themselves, constitute a main establishment and are therefore not determining criteria for a main establishment.

The main establishment of the processor should be the place of its central administration in the Union or, if it has no central administration in the Union, the place where the main processing activities take place in the Union.

In cases involving both the controller and the processor, the competent lead supervisory authority should remain the supervisory authority of the Member State where the controller has its main establishment, but the supervisory authority of the processor should be considered to be a supervisory authority concerned and that supervisory authority should participate in the cooperation procedure provided for by this Regulation.

In any case, the supervisory authorities of the Member State or Member States where the processor has one or more establishments should not be considered to be supervisory authorities concerned where the draft decision concerns only the controller.

Where the processing is carried out by a group of undertakings, the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings, except where the purposes and means of processing are determined by another undertaking.