For Modules 1, 2, and 3: Which Supervisory Authority Should Be Designated as the Competent Authority?

ANSWER

By entering into the SCCs, the data importer agrees to submit to the jurisdiction of a supervisory authority within the EEA (Clause 13). This means that the data importer agrees to cooperate with that authority in all proceedings relating to compliance with the SCCs (e.g., inquiries, investigations, and audits) and to comply with decisions issued by the EEA supervisory authority (e.g., orders requiring processing activities to be brought into compliance with the SCCs).

The parties should designate the competent supervisory authority in Annex I.C of the SCCs. If there is more than one data exporter, there may be multiple competent supervisory authorities. Clause 13 of the SCCs sets out how the competent authority is to be determined.

If the data exporter is established in the EEA, the designated supervisory authority should be the authority competent for the data exporter. For companies carrying out cross-border processing activities within the EEA, the competent authority will be the lead supervisory authority.

If the data exporter is not established in the EEA but is directly subject to the GDPR, the competent supervisory authority will be:

• if the data exporter is required to appoint a representative (under Article 27 GDPR): the supervisory authority in the EEA country where the representative is established;
• if the data exporter is not required to appoint a representative (under Article 27 GDPR): the supervisory authority in the EEA country where the data subjects whose data is being transferred are located.

It should also be noted that the SCCs allow data subjects to lodge a complaint with the supervisory authority in the EEA country where they reside. If that authority differs from the one designated by the parties, both authorities will cooperate in handling the complaint.