15/02/24 (Agence Europe) – On Thursday 15 February, the European Data Protection Board (EDPB) issued an opinion in which, at the request of the French data protection authority, it clarifies the concept of a data controller’s ‘principal place of business’ in the EU under the GDPR, particularly in cases where decisions concerning processing are taken outside the EU. According to the EDPB, the ‘place of central administration’ should only be considered as a main establishment if it takes the decisions on the purposes and means of the processing of personal data, and it has power to have these decisions implemented. The EDPB also considers that if the decisions on the purposes and means of processing are taken outside the EU, there should be no main establishment of the controller in the EU and therefore the one-stop shop mechanism should not apply. See the opinion: https://aeur.eu/f/avo (TM)