In C-645/19 Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit, the Court confirmed that only the lead Data Protection Authority can act against a controller, another supervisory authority can only initiate proceedings against a controller, provided that this power is exercised in one of the limited situations where the Regulation (EU) 2016/679 confers a competence to adopt a final decision, and provided that the cooperation and...

This article discusses the territorial application of the provisions of the GDPR in the context of digital platforms made available by organizations outside the Union through an analysis of relevant CJEU case law and EDPB recommendations. In the introduction we have shown the main criteria for establishing the territorial application of GDPR, in section 2 we have analyzed the notion of headquarters in the context of GDPR, and in sections 3 and...