Understanding “Main Establishment” under the GDPR for non-EU companies

This is a hot topic in GDPR discussions currently and is largely focused around big multinationals who might have an HQ in Ireland but significant offices in Germany, France etc…

Most companies would like to deal with one regulator (one-stop-shop) and the GDPR facilitates this. There is a lot of discussion around existing EU structures but I want to focus on what a company needs to do if they are creating a legal entity in the EU for the first time. 

It is important to note that if a controller/processor, does not have a company in the EU and appoints a Representative. They do not have access to the ‘One Stop Shop’ mechanism. 

The approach outlined in the GDPR is that central administration in the EU is the place where decisions about the purposes and means of the processing of personal data are taken. 

The WP29 working group has given some good guidance on this. It is essential for companies to identify precisely where the decisions on processing are taken. It is not obligatory but considered important that the DPO (if needed) is located in the same country as the place of the main establishment. 

Factors that Determine Main Establishment

The Data Controller/Processor itself identifies where its place of the main establishment is. This can be challenged by the respective supervisory authority. 

Factors that help determine a companies place of main establishment:

• Where the legal entity is registered (a company)
• Where directors of this company are resident
• Where decisions are given a final sign off. This can be formally recorded via board meetings.
• Where business decisions are made. This can be formally recorded via board meetings.
  
  

Clear Evidence

The GDPR does not permit ‘Forum shopping’. If a company claims to have its main establishment in a country, it needs to show it has management and control based there. In some cases, the relevant supervisory authority will ask the company to produce “clear evidence” of this. 

The burden of proof ultimately falls on the controller/processor. However, this can be challenged by the respective supervisory authority concerned. It is best to have all your paperwork in good order. 

If you are looking to set up your companies place of Main Establishment in Ireland, get in touch with us using the form below.