The EU Council of Ministers has reached a preliminary agreement on the “One Stop Shop” mechanism, one of the most hotly debated items under the EU Data Protection Regulation.
On 13 March, the Ministers debated the proposed One Stop Shop framework as proposed under the EU Data Protection Regulation. It was agreed by the Council that the One Stop Shop mechanism should only play a role in important cross-border cases allowing for cooperation between Data Protection Authorities. The European Data Protection Board a body yet to be established, will preside over the One Stop Shop and will arbitrate in disputes between DPAs. Furthermore any concerned authority can object to any ruling made by a DPA and have the case referred for review to the EDPB.
As it stands, the proposal could result in a case being referred to the EDPB on the basis of only one DPA’s disagreement with the original decision reached by a lead DPA. It had been proposed by Member States such as Ireland, the UK and the Netherlands that decisions would only be referable to the EDPB on the basis of a quantitative threshold by which an objection would need to be supported by 1/3 of the concerned DPAs before the lead DPA is obliged to refer the matter to the EDPB.
The One Stop Shop was originally proposed by the EU Commission as a way to address fragmentation and incoherence faced by companies operating across Europe. It was intended that one lead DPA (determined by the company's “main establishment” in the EU) would be responsible for taking legally binding decisions against that company.
Under the current Data Protection Directive, a company operating in more than one EU country may have to deal with several DPAs where concerns have been raised over a particular business activity or operation. This leads to multiple investigations and uncertainty for the business and can result in a situation where different rules can apply in each Member State for the same business operation.
The Council agreement is tentative and much can still change when it meets again in June to establish agreement on the rest of the Regulation. It is important to note that the Council does not have the final word on the One Stop Shop or any other proposed provision under the Regulation. Once a general approach is agreed by the Council on the Regulation, the Council must then enter trilogue discussions with the European Commission and Parliament before the Regulation can come into force.
The One Stop Shop will continue to be a thorny issue at European Level. Companies seeking clarity and consistency under the proposed Regulation can only wait and see if a true streamlined approach to dealing with pan-European issues can be achieved.
Contributed by: John Magee and Niamh Gavin