Law
Why the principle of subsidiarity shapes EU data protection enforcement
Quick fact
Under the GDPR, a company that operates across Europe is supervised mainly by the data protection authority of the country where it has its main establishment—often Ireland—even if the company's decisions affect citizens in all 27 EU member states.
Why this is interesting
You might think the EU’s data protection law is enforced by a single European authority, but in reality, your complaints are handled by the data protection agency of the country where the company is based. Why does that happen?
Read the full explanation
Understanding Why the principle of subsidiarity shapes EU data protection enforcement
Imagine a rule that applies equally to all schools in a country, but each school has its own principal who decides how to enforce it. In the EU, the principle of subsidiarity means that the EU only acts where countries cannot do the job effectively on their own. For data protection, this principle led to a network of national supervisory authorities rather than a single EU-wide regulator. The GDPR, the EU's data protection law, is applied by these national authorities. When a company has its main office in a particular EU country, that country's authority becomes the 'lead supervisory authority' for that company, even if the company processes data of people all over Europe. This is why a complaint from a citizen in Germany about a US tech company might be investigated by the Irish Data Protection Commission if the company's EU headquarters is in Ireland.
A deeper explanation
The principle of subsidiarity is a core legal principle in EU law, ensuring decisions are made as closely as possible to citizens. In the context of data protection, the EU decided that a centralized enforcement agency would be too distant from ordinary people and national legal systems. Instead, the GDPR establishes a system of 'one-stop-shop' supervision: each company has a 'lead supervisory authority' based on where its main establishment is in the EU. This authority is primarily responsible for enforcing the GDPR on that company. Other national authorities can object or be involved, but they can't directly lead. This design reflects subsidiarity because it leaves enforcement to the national level, but with mechanisms for cooperation to ensure consistent application. The result is that a company like Google, with its EU headquarters in Ireland, is primarily supervised by the Irish Data Protection Commission, even though its services affect people across the entire EU. That's why important GDPR decisions about such companies often come from the Irish authority, and why this arrangement is both praised for its local sensitivity and criticized for potential delays and conflicts of interest.