Concerned Supervisory Authority
A Concerned Supervisory Authority is a regulatory body within the European-Union that possesses a legal interest in a specific data processing activity under the GDPR. As defined in Article 4(22), an authority is considered 'concerned' if the Data-Controller or Data-Processor is established on its territory, if Data-Subject individuals residing in its territory are substantially affected, or if a complaint has been lodged with that specific authority.
The identification of a Concerned Supervisory Authority is a fundamental component of the One-Stop-Shop mechanism. This system is designed to streamline the regulatory process for organizations operating across multiple borders by allowing them to deal primarily with a single Lead-Supervisory-Authority. However, the concerned authorities remain deeply involved in the decision-making process. They are entitled to receive information, participate in joint investigations, and submit 'reasoned and relevant objections' to any draft decisions proposed by the lead authority to ensure that the Personal-Data rights of their local citizens are upheld.
According to guidelines from the European Data Protection Board, the cooperation between these authorities is essential for achieving a high level of data protection consistency. If the authorities cannot reach a consensus on a case, the matter is referred to the Consistency-Mechanism, where the European-Data-Protection-Board issues a binding decision to resolve the dispute.