Two months ago, in a post titled “A Lot of Noise, One Fine, Zero Survivors”, one of us observed that the Court of Rome had just annulled the €15 million fine that Italy’s data protection authority, the Garante, had imposed on OpenAI for its handling of ChatGPT, “the only final GDPR enforcement decision ever adopted in Europe in relation to the public launch of generative AI”. That post was written the day after the operative part of the ruling was read out, when the Court’s full reasoning was not yet available.[i] It left three questions hanging in the air. Had the Court doubted the proportionality of the sanction? Had it disturbed the Garante’s findings of GDPR violations on the merits? Or could a fresh decision follow on the Court’s instructions?
Now the full grounds of the judgment have just surfaced. The short answer to all three questions above is, in a sense, “none of the above”. The Court did not weigh the proportionality of the fine. It did not unsettle a single finding on the substance. It annulled Decision No. 755 in its entirety on a purely preliminary, jurisdictional ground: in the Court’s view, the Garante simply lacked the competence to adopt the decision at all. Every remaining ground of appeal, including those going to the merits and to the size of the penalty, was declared “absorbed” and never examined.
We set down these first reactions ad hoc, on the very day the reasoning appeared, and without the benefit of the parties’ full pleadings or of the secondary literature that a ruling of this importance will attract. Our purpose is deliberately modest. It is neither to applaud nor to condemn the judgment, which is in several respects carefully reasoned, but to surface the questions that this short but important decision raises and that, in our view, deserve sustained attention, perhaps from a higher court and ultimately, we would suggest, from the Court of Justice.
How a fifteen-million-euro fine fell on a single preliminary point
The facts that matter are chronological. OpenAI launched ChatGPT to the public on 30 November 2022. The data breach that the Garante later faulted it for failing to notify occurred on 20 March 2023. The other infringements the Garante charged also dated from 2022 and 2023: accountability, lawfulness of the processing, transparency, and data protection by design and by default. OpenAI Ireland Limited was incorporated on 24 March 2023.[ii] The Garante opened its sanctioning proceeding on 26 January 2024. The Irish Data Protection Commission formally recognised OpenAI Ireland as the company’s single establishment in the EEA on 15 February 2024, roughly three weeks after the Italian proceeding had begun. The Garante adopted its final decision on 2 November 2024.
On these facts the Court’s logic runs in a straight line. Article 56(1) GDPR confers exclusive competence over cross-border processing on the supervisory authority of the controller’s main or single establishment, acting as lead authority through the one-stop-shop. Once OpenAI Ireland was recognised as the single establishment, the Irish authority became the lead authority. Relying on Opinion 8/2019 of the European Data Protection Board (EDPB), and in particular its section 4.3.2 on the creation of a main or single establishment or its relocation from a third country to the EEA, the Court held that lead competence may switch to a newly competent authority at any time until a final decision has been reached, and that any pending proceeding must accordingly be transferred to the authority of the State where the single or main establishment now sits. Because no final decision had been taken by 15 February 2024, the proceeding ought to have been handed to Ireland. The decision of November 2024 was therefore adopted by an authority that had, on this reasoning, already lost its competence, and it had to fall.
This holding settles both a great deal and very little. The Court did not find that OpenAI complied with the GDPR. It did not find that fifteen million euros was disproportionate. It found only that the wrong authority spoke. The substance of the case, the very questions about legal basis for training, transparency, breach notification and age verification that animated the original enforcement wave, remains formally untouched and, for now, unanswered.
The pivot: paragraph 16 of the EDPB Opinion and the word “mainly”
Almost the entire judgment turns on a disagreement about the reach of a single paragraph of a soft-law instrument. Under the heading “Scope of the Opinion,” paragraph 16 of EDPB Opinion 8/2019 states that the questions examined in the Opinion “mainly relate to infringements of a continuing or continuous nature due to the fact that, for a change in circumstances relating to the main or single establishment to intervene, the infringements need to have been committed over a certain period of time.”
The Garante read that sentence as a limit. The one-stop-shop transfer logic, it argued, was designed for infringements that are continuing or continuous, so that a change of establishment can fall within their lifespan; it does not govern infringements that were already completed before any EEA establishment existed (i.e., “consumed” infringements). On that view the Garante kept the completed pre-establishment conduct for itself while forwarding to the Irish authority the files concerning the ongoing infringements. According to the Garante, that position was supported also by the tempus regit actum principle set forth by Article 11 of the Preliminary Provisions of the Italian Civil Code, according to which the law generally does not have retroactive effects.
OpenAI read the same sentence and principles in the opposite direction: “mainly” is not “exclusively”, and the operative criterion fixed by the Opinion is the moment of the final decision. Otherwise, OpenAI argued, distinguishing between “continuous or continuing” and “consumed” infringements would create uncertainty and undermine the effet utileprinciple underpinning the one-stop-shop mechanism. OpenAI added that, under the tempus regit actum principle, the procedural rules in force at the time of the decision should govern the decision itself.
The Court sided with OpenAI, reasoning that “mainly” simply identifies the type of infringement in which the issue arises most frequently, and that it “cannot be ruled out” that the same logic applies to completed infringements where the proceeding is still pending and no final decision has been taken. On the tempus regit actum point, the Court held that the principle was not relevant here, because the case did not concern a temporal succession of laws but rather a succession of facts.
This is the where the case turns, and the point on which we are least persuaded, though we should say at once that the Court’s reading is coherent and, as the next section explains, has real force. The Court’s reading rests on treating “mainly” as a statement of frequency: continuing infringements are merely where the question arises most often. We are not convinced that this is the better reading. Paragraph 16 does not simply observe that the question tends to arise with continuing infringements; it gives a reason for that observation, and the reason is logical rather than statistical. The Opinion ties the analysis to infringements “committed over a certain period of time” precisely because a change in the establishment must be able to “intervene” while the infringement is still unfolding.
We accept, with respect, that section 4.3.2 of the Opinion expressly contemplates not only the relocation of an existing establishment but also the creation of a new main or single establishment by a controller previously established outside the EEA, and that a change “relating to the single establishment” therefore reaches the very move OpenAI made. The Court itself reasoned in these terms, treating the creation of the single establishment, recognised in February 2024 while the proceeding was pending, as the event that should have triggered an immediate transfer to Ireland. But that does not carry the Court’s conclusion. What matters is not whether the relevant event is a relocation or a first creation; it is whether, at the moment the establishment comes into being, there is still a live infringement for the new connection to “intervene” in. Where conduct was already complete before any EEA establishment existed, the creation of that establishment arrives too late to fall within or alongside the infringement, for the plain reason that there is no longer an ongoing infringement to attach to. So read, “mainly” is not loose drafting that quietly leaves the door open to completed conduct; it marks a structural feature of the scenario the EDPB had in mind. The residual space that “mainly” leaves open is, in our view, confined to borderline cases at the edge of the continuing category. It does not stretch to conduct that began and ended before the very connection that grounds lead-authority competence came into being. That is the step the Court took, and the judgment, as we read it, does not explain why the temporal cut-off should reach that far.
One feature of the case makes this especially pressing. Opinion 8/2019 is soft law, as the Court itself accepts: an interpretive aid, not a binding source. That status cuts in two directions. It meant the Court was free not to follow the Opinion. It also means the Opinion cannot, on its own, carry the weight of setting aside the Garante’s reading of Articles 55 and 56 of the GDPR. To displace that reading, one would need to show that the binding text of Article 56 itself reaches conduct predating the establishment, not merely that a soft-law opinion can be read that way. It is this textual demonstration, anchored in the Regulation rather than in the Opinion, that the judgment does not provide.[iii] If anything, the binding text points the other way. Article 56(1) confers lead-authority competence only over “cross-border processing”, and cross-border processing, as defined in Article 4(23), presupposes processing carried out “in the context of the activities” of an establishment of the controller in the Union. During its launch window OpenAI had no such establishment; it fell within the GDPR solely through the targeting criterion of Article 3(2). For conduct already complete before any EU establishment existed, there was therefore no “cross-border processing” within the meaning of Article 4(23) at all, and nothing on which the one-stop-shop of Article 56(1) could operate.
Why the Court’s reading is attractive
It would be wrong to present the judgment as weak. It rests on at least three arguments of real force, and the strongest of them is elegant. If competence in a cross-border case depended on whether each alleged infringement is continuing, continuous or consumed, then one could not determine who is competent without first characterising the substance and the duration of every infringement. That inverts the proper order of analysis. Jurisdiction is a preliminary question that should be resolved on objective criteria before the merits are reached, yet the Garante’s approach makes the preliminary question hostage to a contested characterisation of the merits. The Court anchors this in Article 34(2) of the Italian Code of Administrative Procedure and in the inherent difficulty of dating the “completion” of an offence. The final-decision criterion, by contrast, is a bright line that anyone can apply, which is exactly the virtue the Opinion claims for it.
The second argument concerns the avoidance of fragmented and concurrent competences, an objective the Opinion itself names. Here the Garante arguably handed the Court the rope. By forwarding the continuing infringements to Dublin while retaining the consumed ones, the Garante produced precisely the outcome the one-stop-shop exists to prevent: a single course of conduct by a single controller split between two (or more) authorities on the basis of a debatable, infringement-by-infringement characterisation, with the attendant risks of inconsistent decisions and double jeopardy. An interpretation that produces that fragmentation is naturally disfavoured.
The third argument is the legal-certainty point that runs through Recital 13 and through the Opinion’s stated objectives. A clear, single interlocutor and a predictable cut-off serve the controller, and the duration of an offence is often genuinely uncertain. On all three of these grounds the Court has, in our view, the better of the argument.
The harder questions the Court did not confront
If the procedural case is strong, the substantive and systemic questions seem to us harder, and the judgment does not engage with them. We raise them as questions that remain open, not as proof that the Court was wrong.
The first is forum shopping, and here the EDPB Opinion’s own insistence cuts against the Court. Paragraph 18 lists the avoidance of “forum shopping or forum hopping” among the three objectives any criterion must serve, and paragraph 26 is devoted entirely to the point: a relocation must be “effective and proven,” the establishment must be “a real one, made with a lasting purpose,” and authorities “should exercise effective control over the notion of main establishment in order to reduce the risk that controllers … artificially change their main establishment for the purpose of changing the competent authority.” The Court’s reading creates the very incentive the Board sought to suppress: a provider with no EEA establishment may launch, observe where enforcement is intensifying, and then set up an establishment in the most congenial Member State so as to capture every pending proceeding before any reaches a final decision. The judgment does not test OpenAI Ireland against the “effective, proven, lasting purpose” standard at all. It treats the recognition of 15 February 2024 as a brute fact that mechanically triggers the transfer. Our concern is structural and prospective, not an accusation. Choosing Ireland as an EU base is entirely ordinary for a US company and implies nothing improper, and OpenAI’s Irish subsidiary was in fact incorporated as early as March 2023, well before its recognition as the single establishment in February 2024. The point is only that the Court’s reading rewards the timing of establishment whether or not any such strategy was at work here.
The second is the disincentive to enforce. If a concerned authority knows that years of investigative effort can be neutralised the moment a controller establishes a presence in the Union, the rational authority may hesitate to open a deep investigation, or slow it, while it waits to see whether an establishment materialises. That sits uneasily with the good-administration and effectiveness objectives that the Opinion invokes through Article 41 of the Charter and Recital 11. The Opinion does soften the blow, by preserving the validity of the initial authority’s acts and evidence and by requiring the new lead authority to involve the former one as a concerned authority. Yet that mitigation is partial. The first mover keeps its file but loses control of the timing, the outcome and the fine. For an authority such as the Garante, which has been the most forward-leaning data protection authority in Europe on AI, that is a real reason to think twice before being first. The counter-case is also real, and we return to it below: if the prospect of enforcement nudges providers toward establishing in the Union, where they can be supervised effectively, that may be a feature of the system rather than a flaw.
The third question is the one we find conceptually deepest, and the one the judgment most clearly leaves unanswered. Can a newly created lead authority have jurisdiction over facts that occurred before its competence-creating connection existed, and that are not of a continuing nature? A lead authority’s competence, in the EDPB Opinion’s own words, flows from “the existence of the controller’s main or single establishment on the territory of its Member State in the context of a cross-border processing activity.” Before 15 February 2024 that predicate did not exist for the Irish authority, and if competence flows from the establishment, it is hard to see how it could have attached to conduct that ended before the establishment came into being. Here the Court arguably argues against itself. It dismisses the Garante’s tempus regit actum objection by saying that the relevant change is one of factual circumstances, namely the creation of an establishment, rather than of applicable law. But if the establishment is the fact that creates Irish competence, then the corollary is that, before that fact came into being, the competence did not exist, and conduct completed in that earlier window cannot easily be swept into a competence that postdates it. The same factual-circumstance framing that defeats the law-over-time objection seems to draw a hard line in time, before which the Irish authority had no connection to the conduct at all. We recognise that this is contested ground, and that a serious argument runs the other way; we explain in the notes why we are, on balance, not persuaded.[iv]
This difficulty is sharpest for conduct that was complete before the establishment, and here a distinction the Court did not draw becomes important. Some of the charges plausibly have a continuing character: the lawfulness of the training data still held and processed and the ongoing operation of the model are arguably continuing states of affairs that persisted past 15 February 2024. Others seem discrete and finished. The clearest is the data breach of 20 March 2023 and the failure to notify it within the deadline to the Garante, a single dated event that was over long before any Irish establishment existed and that no characterisation can turn into a continuing infringement straddling the establishment. For the continuing charges the Court’s result is perfectly defensible, because part of the conduct was committed while the Irish establishment already existed and the new lead authority had a real connection to it. For the conduct that was genuinely finished there is no such bridge, and it is here that the retroactive attribution of competence is hardest to justify. The Court treated the whole proceeding alike and addressed neither category in these terms. This, in our reading, is exactly the distinction paragraph 16 was gesturing at when it tied the whole analysis to infringements of a continuing or continuous nature. The Court’s temporal-only reading erases that distinction, and with it the reason the EDPB gave for drawing it.
There is a further oddity, and the judgment never confronts it. The Court holds only that the Garante lost its competence; it nowhere holds that the Irish authority gained competence over the conduct completed before 15 February 2024. It treats the creation of the establishment in Dublin as the conclusion of the argument rather than as a further question to answer. The realistic result is therefore not a tidy relocation of the case but a negative conflict of competence: the Garante is shut out, and it is far from clear that Ireland is brought in for the pre-establishment conduct. That is the enforcement gap in its sharpest form, an actual vacuum rather than a slower forum. Nor is the point met by the Opinion’s statement that “every pending proceeding will be transferred” (paragraph 31): that sentence sits within the continuing-infringement scope set by paragraph 16 and speaks of a proceeding that “will continue” under Article 60, which assumes a live matter rather than the retroactive adjudication of closed conduct. The companion phrase about depriving the first authority of its “role as a competent authority” (paragraph 32) describes losing the lead-authority contest, not losing competence over conduct the one-stop-shop never reached.
A fourth, related, point is that the Opinion’s own practical justification for routing cases to the new lead authority, namely that this authority can actually enforce because the controller is established on its territory, has real force for conduct that continues after the establishment appears, and almost none for conduct that was finished before it existed. The policy rationale for the switch is at its weakest in precisely the configuration the Court was facing.
A side door for DeepSeek? Establishment is not representation
It is natural to ask what this ruling means for the other great enforcement saga of the past year, the pan-European response to DeepSeek. The answer, as matters stand, is: very little, and for a reason that is easy to overlook. The Rome logic only bites when a controller creates a main or single establishment in the EEA. DeepSeek has not done that. What it did, under sustained pressure and only at the end of May 2025, was appoint an Article 27 GDPR representative in Vienna. A representative is not an establishment. It is settled in the EDPB’s territorial-scope guidance, and in the Article 29 Working Party’s WP244 guidelines on identifying the lead authority, that the appointment of a representative does not give the controller a main establishment and does not trigger the one-stop-shop. That is precisely why a dozen national authorities have been able to proceed against DeepSeek in parallel, with no lead-authority anchor to consolidate them, and why the EDPB built its AI Enforcement Task Force around providers operating without a legal establishment in the Union.
So the Rome judgment does nothing for DeepSeek today. Each concerned authority retains its competence; the Italian ban is unaffected; the parallel investigations continue. The forward-looking risk, however, is real, and it is where the two stories meet. The judgment hands any non-EEA provider a playbook: incorporate a genuine EEA subsidiary along the OpenAI Ireland model, have it recognised as the single establishment, and watch every pending national proceeding that has not yet ended in a final decision be funnelled toward a single chosen authority. Given the breadth of the DeepSeek front, the consolidation prize would dwarf the one in OpenAI’s case. Two things temper this. The “effective, proven, lasting purpose” test of paragraph 26, which the Court ignored but a future court might not, would require the establishment to be real rather than a competence-shifting device. And there is an irony that a recent study on DeepSeek already foreshadowed: the providers best placed to exploit the consolidation logic are the cooperative Western ones that actually want to stay in the EU market, while a provider content to serve the unregulated majority of the world and to treat European access as optional has little reason to establish in the Union in the first place. The mechanism built to catch the evasive actor turns out to reward the one that wishes to regularise.
The bigger picture: a launch-period enforcement gap?
Seen from a distance, the ruling crystallises a structural choice about how the Union polices foreign AI providers that begin offering services to Europeans before they establish here. The negative reading is the one that animated the “zero survivors” theme of that earlier post. The judgment creates an enforcement gap at exactly the launch-and-scaling moment when novel AI harms first surface. A provider can enter with no establishment, absorb whatever provisional measures land during the unestablished phase, and then, if it later chooses to establish, relocate the pending sanctions toward a forum of its choosing before any of them concludes. That rewards a “launch first, regularise later” posture and dilutes deterrence, because the worst-case exposure during the launch window becomes both movable and, for the pre-establishment conduct, possibly unenforceable. It may also chill the deep national investigations that produce legal precedent, since the authority that does the work may have to surrender the decision at the end.
The positive reading deserves equal honesty. The alternative is worse in a different way. Without a consolidation rule, a single global AI launch generates dozens of parallel proceedings against the same conduct, with inconsistent outcomes and the constant risk that more than one authority, or none, claims the lead. The one-stop-shop exists to prevent exactly that, and a bright-line cut-off gives controllers and data subjects a single, predictable interlocutor. Routing enforcement to an authority on whose territory the controller is actually established also produces a decision that can be enforced against a real entity, which is more than a provisional measure against a distant foreign company usually achieves. And the rule arguably incentivises establishment, drawing providers into a structured supervisory relationship rather than leaving them as remote contact points. For a regulator, a genuine establishment is a far better lever than a representative.
One objection to our concern should be met head-on: that our own reading simply creates a different gap, leaving the pre-establishment conduct unpunished. It does not. On our reading that conduct stays where it always sat, with the concerned national authorities acting in parallel under Article 55(1), which is how every provider without an EU establishment is handled today, DeepSeek included. The Opinion adopts the same logic in the mirror-image case: when an establishment disappears, the Board says each concerned authority “regains full jurisdiction” (paragraph 34), treating the absence of an establishment as the trigger for national competence, not for lead-authority competence. The trade, in other words, is consolidation against enforceability, not enforcement against impunity. If anything, it is the temporal-only reading that has the harder asymmetry to defend: a provider could switch off that parallel national competence simply by establishing later, while an identically placed provider that never establishes stays fully exposed to every concerned authority, so that establishment would purchase a retroactive immunity that non-establishment does not. The provisional tools that remain, Article 66 urgency measures and the local competence preserved by Article 56(2), do not close the gap, since neither can deliver a final cross-border sanction.
The honest conclusion is that the judgment optimises for legal certainty and procedural coherence, together with potential global enforcement benefit in the long run (depending on a potential incentivisation to create new establishments by non-EEA companies), at the cost of enforcement vigour during the very window when vigour matters most. Whether that trade is acceptable is a policy judgment that the text of the GDPR does not clearly resolve, which is itself the best argument that the question belongs before the Court of Justice rather than being settled by a first-instance reading of a soft-law opinion. It also exposes an architectural seam that neither the Regulation nor Opinion 8/2019 was drafted to handle: the one-stop-shop was conceived for controllers already established in the Union, and bolting it onto extraterritorial AI providers through a later-created establishment stretches it in ways its authors did not anticipate. We are not the first to find the Opinion less than fully clear on jurisdictional questions. When it appeared, it was received by some commentators as falling short of the clarity they had hoped for on exactly these issues; the present case exposes a question it did not anticipate.
Precedent, and what may come next
Is this the first time the issue has arisen? On the precise point at stake, the retroactive transfer of a pending proceeding over pre-establishment, non-continuing conduct to a later-created lead authority, we are not aware of any earlier national court ruling applying section 4.3.2 of Opinion 8/2019. There are adjacent authorities. The Court of Justice in Facebook Ireland (C-645/19), which the Rome judgment itself cites, mapped the limits of the one-stop-shop and the conditions under which a non-lead authority may act, but it did not address the establishment-creation timing question. The EDPB’s Opinion 28/2024 on AI models speaks to the substance of training and deployment, not to allocation of competence. To our knowledge, the Rome decision is the first reasoned judicial attempt to decide whether the Opinion’s third-country-to-EEA scenario reaches conduct that was completed before any establishment existed.
Two cautions follow. First, this is a first-instance judgment of a single judge of the Tribunale di Roma, not an appellate or supreme ruling, and the Garante may yet appeal before the Corte di Cassazione (Italian Supreme Court). Second, the reach of Article 56 over pre-establishment conduct seems to us unsettled rather than acte clair, and we are conscious that serious arguments run both ways: the Court’s reading serves legal certainty and the avoidance of fragmented competences, while the textual and structural objections set out above pull in the other direction. It is precisely because the question is balanced, and because it now bears on every non-EU AI provider weighing whether and where to establish, that a preliminary reference to the Court of Justice under Article 267 TFEU would be appropriate. The timing only sharpens the point. The Rome ruling came within days of the Luxembourg Administrative Court’s annulment of the €746 million Amazon fine, another case in which a court set aside the penalty, faulting the regulator for not assessing fault and proportionality before fining.[v] Within a single week, one of the largest GDPR fines in European history and the only fine ever imposed on a generative-AI provider at launch were both struck down, on grounds that had nothing to do with whether the controllers had complied with the GDPR.
That is the wider current into which this decision flows. The proliferation of regulatory guidance on AI training and web scraping continues, even as formal enforcement against the launch of generative AI in Europe has produced, on the final count, a single decision, now annulled on a controversial question of competence. Whether the European data protection system is experiencing a temporary procedural recalibration or a deeper loss of enforcement appetite is, for now, an open question. The Court of Rome has answered the narrow question it was asked with care. It has, in doing so, reopened a far larger one.
Notes:
[i] Tribunale Ordinario di Roma, Sezione Diritti della Persona e Immigrazione, judgment in case R.G. 4785/2025, decided 18 March 2026 (operative part read at the hearing of that date). The Garante received the ruling on 19 March 2026, and the full grounds became publicly available on 28 May 2026. For the original enforcement measure and an initial reaction before the reasoning was known, see Theodore Christakis, “A Lot of Noise, One Fine, Zero Survivors” (Cross-Border Data Forum, 19 March 2026).
[ii] The distinction deserves an explanation. Incorporation is an act of company law that brings a legal entity into existence (without necessarily having yet an operational team in place), whereas “main” or “single establishment” is an autonomous concept of EU data protection law (Article 4(16) GDPR, read with Recital 22), turning on the effective and real exercise of activity through stable arrangements and, for the main establishment, on the place of central administration where decisions on the purposes and means of processing are taken. The two need not coincide in time: a subsidiary may be incorporated well before it is recognised as the controller’s single or main establishment for one-stop-shop purposes, as the gap between OpenAI Ireland’s incorporation (24 March 2023) and its recognition as the single EEA establishment (15 February 2024) illustrates.
[iii] Opinion 8/2019 is an opinion adopted under Article 64(2) GDPR and operates as soft law. For early scholarly analysis questioning the clarity of its guidance on jurisdictional questions, see D.J.B. Svantesson, “An Analysis of EDPB’s Opinion 8/2019 on the Competence of a Supervisory Authority in Case of a Change in Circumstances Relating to the Main or Single Establishment” (2019; published in EDPL, vol. 6, no. 1, 2020). The full text of the Opinion is available here.
[iv] Commenting on an earlier draft, Peter Swire pressed the objection that, before the establishment, the relevant authority simply exercises “the same authority the Garante used”, so that the one-stop-shop can later absorb the whole matter. The objection, we think, reinforces our reading rather than undercutting it. Before any establishment existed, Article 56 did not apply and competence rested on Article 55(1), under which each authority is competent only in respect of the data subjects on the territory of its own Member State; the Garante’s decision says as much, treating itself as competent “with regard to its own territory” for the conduct preceding 15 February 2024 (Decision No. 755, section 5). Had the Irish authority exercised that same competence before that date, it would have reached only the Irish dimension of the conduct, not the Italian. The one-stop-shop, once triggered, allocates competence over cross-border processing carried out in the context of the establishment’s activities; it does not hand the new lead authority the historic, territorially grounded competence another authority validly exercised before the establishment existed, and a transfer of a pending proceeding in any event presupposes a competent transferee. The data-breach charge makes the point concrete. The breach occurred on 20 March 2023 and the duty to notify the Garante under Article 33 fell due seventy-two hours later, when OpenAI had no EU establishment and OpenAI Ireland had not yet even been incorporated; the Garante classified that infringement as consumed and retained it, forwarding to Ireland only the continuing matters (Decision No. 755, sections 6.1 and 6.6). It is hard to see how the Irish authority, whose competence postdates and flows from an establishment that did not exist when the duty arose, could adjudicate a notification owed to the Garante in respect of Italian data subjects. We acknowledge the contrary view that, the GDPR being a single Union-wide instrument, any authority that becomes lead might enforce it whenever the facts arose; we are not persuaded, since the Regulation allocates competence by establishment and territory rather than treating every authority as interchangeable, but the point is arguable and is among the reasons the question warrants authoritative resolution.
[v] Cour administrative du Luxembourg, annulment of the €746 million fine imposed on Amazon by the CNPD; see the CNPD’s statement(March 2026). On the DeepSeek enforcement landscape and the distinction between an Article 27 representative and an establishment, see Theodore Christakis and Pankaj Raj, “DeepSeek One Year Later: Regulatory Storm, Global Surge”; and on the DSA Article 16 question raised by the Berlin authority, see this article of the European Law Blog.