Uvodna izjava 36
Recital 36
(36) Glavni poslovni nastan voditelja obrade u Uniji trebalo bi biti mjesto njegove središnje uprave u Uniji, osim ako se odluke o svrhama i načinima obrade osobnih podataka donose u drugom poslovnom nastanu voditelja obrade u Uniji, u kojem slučaju taj drugi poslovni nastan trebao bi se smatrati glavnim poslovnim nastanom.
Glavni poslovni nastan voditelja obrade u Uniji trebalo bi utvrditi prema objektivnim kriterijima, a pod time bi se trebalo podrazumijevati djelotvorno i stvarno obavljanje upravljačkih aktivnosti koje utvrđuju glavne odluke u vezi sa svrhama i načinima obrade putem stabilnih aranžmana.
Taj kriterij ne bi smio ovisiti o tome obavljali se obrada osobnih podataka na toj lokaciji.
Prisutnost i uporaba tehničkih sredstava i tehnologija za obradu osobnih podataka ili aktivnosti obrade same po sebi ne predstavljaju glavni poslovni nastan pa prema tome nisu odlučujući kriteriji za glavni poslovni nastan.
Glavni poslovni nastan izvršitelja obrade trebalo bi biti mjesto njegove središnje uprave u Uniji ili, ako nema središnju upravu u Uniji, mjesto u Uniji u kojemu se odvijaju glavne aktivnosti obrade.
U slučajevima koji uključuju i voditelja obrade i izvršitelja obrade, nadležno vodeće nadzorno tijelo trebalo bi ostati nadzorno tijelo države članice u kojoj voditelj obrade ima glavni poslovni nastan, ali nadzorno tijelo izvršitelja obrade trebalo bi smatrati predmetnim nadzornim tijelom te te bi to nadzorno tijelo trebalo sudjelovati u postupku suradnje koji je predviđen ovom Uredbom.
U svakom slučaju, nadzorna tijela jedne države članice ili više njih u kojima izvršitelj obrade ima jedan ili više poslovnih nastana ne bi trebalo smatrati predmetnim nadzornim tijelima ako se nacrt odluke odnosi samo na voditelja obrade.
Kada obradu obavlja grupa poduzetnika, glavni nastan poduzetnika u vladajućem položaju trebalo bi smatrati glavnim nastanom grupe poduzetnika, osim ako svrhe i načine obrade ne određuje drugi poduzetnik.
(36) The main establishment of a controller in the Union should be the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union, in which case that other establishment should be considered to be the main establishment.
The main establishment of a controller in the Union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing through stable arrangements.
That criterion should not depend on whether the processing of personal data is carried out at that location.
The presence and use of technical means and technologies for processing personal data or processing activities do not, in themselves, constitute a main establishment and are therefore not determining criteria for a main establishment.
The main establishment of the processor should be the place of its central administration in the Union or, if it has no central administration in the Union, the place where the main processing activities take place in the Union.
In cases involving both the controller and the processor, the competent lead supervisory authority should remain the supervisory authority of the Member State where the controller has its main establishment, but the supervisory authority of the processor should be considered to be a supervisory authority concerned and that supervisory authority should participate in the cooperation procedure provided for by this Regulation.
In any case, the supervisory authorities of the Member State or Member States where the processor has one or more establishments should not be considered to be supervisory authorities concerned where the draft decision concerns only the controller.
Where the processing is carried out by a group of undertakings, the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings, except where the purposes and means of processing are determined by another undertaking.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.