the main establishment. The main establishment of a controller in the Union should be determined according to
objective criteria and should imply the effective and real exercise of management activities determining the main
decisions as to the purposes and means of processing through stable arrangements. That criterion should not
depend on whether the processing of personal data is carried out at that location. The presence and use of
technical means and technologies for processing personal data or processing activities do not, in themselves,
constitute a main establishment and are therefore not determining criteria for a main establishment. The main
establishment of the processor should be the place of its central administration in the Union or, if it has no
central administration in the Union, the place where the main processing activities take place in the Union. In
cases involving both the controller and the processor, the competent lead supervisory authority should remain
the supervisory authority of the Member State where the controller has its main establishment, but the
supervisory authority of the processor should be considered to be a supervisory authority concerned and that
supervisory authority should participate in the cooperation procedure provided for by this Regulation. In any
case, the supervisory authorities of the Member State or Member States where the processor has one or more
establishments should not be considered to be supervisory authorities concerned where the draft decision
concerns only the controller. Where the processing is carried out by a group of undertakings, the main
establishment of the controlling undertaking should be considered to be the main establishment of the group of
undertakings, except where the purposes and means of processing are determined by another undertaking.
(37) A group of undertakings should cover a controlling undertaking and its controlled undertakings, whereby the
controlling undertaking should be the undertaking which can exert a dominant influence over the other
undertakings by virtue, for example, of ownership, financial participation or the rules which govern it or the
power to have personal data protection rules implemented. An undertaking which controls the processing of
personal data in undertakings affiliated to it should be regarded, together with those undertakings, as a group of
undertakings.
(38) Children merit specific protection with regard to their personal data, as they may be less aware of the risks,
consequences and safeguards concerned and their rights in relation to the processing of personal data. Such
specific protection should, in particular, apply to the use of personal data of children for the purposes of
marketing or creating personality or user profiles and the collection of personal data with regard to children
when using services offered directly to a child. The consent of the holder of parental responsibility should not be
necessary in the context of preventive or counselling services offered directly to a child.
(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that
personal data concerning them are collected, used, consulted or otherwise processed and to what extent the
personal data are or will be processed. The principle of transparency requires that any information and communi-
cation relating to the processing of those personal data be easily accessible and easy to understand, and that clear
and plain language be used. That principle concerns, in particular, information to the data subjects on the
identity of the controller and the purposes of the processing and further information to ensure fair and
transparent processing in respect of the natural persons concerned and their right to obtain confirmation and
communication of personal data concerning them which are being processed. Natural persons should be made
aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their
rights in relation to such processing. In particular, the specific purposes for which personal data are processed
should be explicit and legitimate and determined at the time of the collection of the personal data. The personal
data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.
This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict
minimum. Personal data should be processed only if the purpose of the processing could not reasonably be
fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits
should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken
to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a
manner that ensures appropriate security and confidentiality of the personal data, including for preventing
unauthorised access to or use of personal data and the equipment used for the processing.
(40) In order for processing to be lawful, personal data should be processed on the basis of the consent of the data
subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or
Comments