In C-645/19 Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit, the Court confirmed that only the lead Data Protection Authority can act against a controller, another supervisory authority can only initiate proceedings against a controller, provided that this power is exercised in one of the limited situations where the Regulation (EU) 2016/679 confers a competence to adopt a final decision, and provided that the cooperat...