What happened to the one-stop shop?
At the time of the adoption of the EU General Data Protection Regulation, the European Commission touted as the benefit for companies that the GDPR would bring a one-stop-shop enforcement mechanism, whereby in respect of controllers or processors with more establishments in the EU, the supervisory authority of the “main establishment” of such controller or processor in the EU will serve as the “lead SA” in respect of its “cross-border processing” activities.
In the first landmark enforcement decision under the GDPR, the CNIL fined Google 50 million euros, despite the fact that the complaints concerned cross-border processing in the EU, which calls for one-stop shop enforcement.
Full article: What happened to the one-stop shop?
