EU Court Clarifies GDPR Enforcement
A recent Court of Justice of the European Union judgment clarified that while the GDPR's "one stop shop" principle remains, national courts are empowered to act if the system's objectives are at risk. The ruling reinforces the authority of local courts to ensure robust privacy enforcement across the EU.
The "one-stop-shop" principle was a cornerstone of the GDPR, designed to let companies deal with a single lead data protection authority (DPA) in the EU member state of their main establishment. For many large tech firms, including Apple, this designated the Irish Data Protection Commission as their primary regulator for cross-border data processing activities. This centralized model was tested in a case originating in 2015, where the Belgian Data Protection Authority took action against Facebook concerning its use of cookies and social plug-ins to track users. Facebook argued that under the GDPR's one-stop-shop, only the Irish DPA (its lead authority) could bring such an enforcement action. The pivotal Court of Justice of the European Union (CJEU) judgment in Case C-645/19, issued on June 15, 2021, clarified the limits of this principle. The court affirmed that national DPAs can indeed initiate legal proceedings in their own country's courts for GDPR infringements, even if they are not the lead authority. This power for national courts to intervene is not unlimited. It is permissible when the GDPR allows for it, such as in cases with a purely local impact or when there is an "urgent need" to act to protect individuals' rights and freedoms. The ruling ensures that the lead authority, like the one in Dublin, must cooperate closely with other national authorities. For distributed systems design, this ruling underscores the need for robust, localized compliance mechanisms. It invalidates any architectural assumption that all GDPR enforcement would be bottlenecked through a single lead regulator. National courts and data protection authorities across the EU remain a relevant and empowered part of the enforcement landscape.
