The competence of non-lead supervisory authority under the EU GDPR’S one-stop-shop mechanism: CJEU judgment in Facebook and Others (C-645/19)

On 15 June 2021, the Court of Justice of the European Union (CJEU) ruled in case C-645/19 between Facebook and the Belgian Data Protection Authority. The CJEU offered some clarification on the General Data Protection Regulation’s (GDPR) one-stop-shop mechanism. In particular, the Court addressed the question of whether a national supervisory authority that is not the lead authority can bring legal proceedings before a court in its Member State with respect to the cross-border data processing. In its judgment, the CJEU reaffirmed the allocation of competences between the ‘lead’ and ‘concerned’ supervisory authorities laid down by the GDPR, while emphasising the importance of sincere and effective cooperation between them, in order to ensure consistent and homogeneous implementation of the GDPR.