Data Protection: ‘One-Stop Shop’ Reimagined?

One of the central pillars of the General Data Protection Regulation (the "Regulation") is the concept of the 'one-stop shop'. As the Regulation slowly works its way through the European legislative process, the proposition that large tech companies with presences in many member states will be required to deal only with a single data protection authority has remained at the core of the proposal. However, a recent proposal from the Italian Presidency of the European Union has suggested significant changes to the 'one-stop shop' concept.

Still Standing

In its Paper dated 28 November 2014 (the "Paper"), the then Italian Presidency of the Council of the European Union, stated that other EU  data protection authorities ("DPAs") should be able to pass their concerns to the lead regulator who is investigating a company or organisation. These DPAs are known as 'concerned regulators'. The lead regulator will remain as the only regulator empowered and entitled to interact