Whose Law Is It Anyway? How Closely Aligned Is The Data Protection Directive With One-Stop-Shop?

The Google Spain case is most commonly recognised for introducing the 'right to be forgotten'. However, the judgment has had a more subtle but no less significant side effect. The case also extended the territorial application of EU data protection law to entities located outside the EU but which have some presence – like a marketing subsidiary – in Europe. Following Google Spain, certain EU data protection authorities ("DPAs") have taken an aggressive interpretation of this aspect to the case. DPAs have argued that Google Spain should be read as meaning that a pan-EU business should be simultaneously subject to the data protection laws of all EU Member States where it – or one of its affiliates – has a presence, even if that in-country affiliate has little to do with data processing. This has led to conflicting interpretations as to which national data protection law applies to a single set of processing activities under the Data Protection Directive. Helpfully, this