Michael is a member of the golf club, Potters Bar. This company has branches in many EU member states, but for the purposes of the GDPR maintains its primary establishment in Spain.
Michael lives in Derry, Northern Ireland (part of the U.K.), and commutes across the border to work in Lough Foyle, Ireland. Two years ago while on a business trip, Michael was photographed during a Potters Bar golf tournament in Stockholm, Sweden. At the time, Michael gave his consent to being included in the photograph, since he was told that it would be used for promotional purposes only.
Since then the photograph has been used in the club's U.K. brochures, and it features in the landing page of its U.K. website. However, the golf club has recently fallen into disrepute due to widespread mistreatment of members at various branches of the club in several EU member states.
As a result, Michael no longer feels comfortable with his photograph being associated with the golf club.
After numerous failed attempts to book an appointment with the manager of the local branch to discuss this matter, Michael sends a letter to Potters Bar requesting that his image be removed from the website and all promotional materials.
Months pass and Michael, having received no acknowledgment of his request, becomes very anxious about this matter. After repeatedly failing to contact Potters Bar through alternate channels, he decides to take action against the company.
Michael reports to a Data Protection Authority.
5) Under the cooperation mechanism, what should the lead authority do after it has formed its view on the matter?