The one-stop-shop and the European Data Protection Board’s role in combatting data supervision forum shopping

One of the key objectives of the European Union’s (EU) General Data Protection Regulation (GDPR) is to promote harmonized practices between national data protection supervisory authorities, whose different legal traditions render them prone to fuelling forum shopping among data controllers. To combat these practices, and to promote cohesive data protection supervision, the Regulation developed the one-stop-shop mechanism and established the European Data Protection Board (EDPB) to promote cooperation and cohesion between national supervisory authorities.

This article assesses the one-stop-shop mechanism and the EDPB’s efforts in mitigating supervisory authority forum shopping practices, while also highlighting the phenomenon’s impact on other issues associated with the harmonization of data protection supervision.

It discusses the European legislature’s goal of creating a centralized European data protection authority, which was considered not to be a feasible solution at the time the GDPR was drafted. Despite this, the article highlights the EDPB’s pivotal role in promoting and creating a legal framework for the centralization of data protection supervision, acknowledging it as the legislature’s ultimate goal. It also advocates for the EDPB to become more proactive in promoting cooperation and coherence between data protection supervisory authorities, as well as interoperability between sectorial supervisory authorities.

The conclusions are based on a textual analysis of the Regulation’s norms and recitals, scholarly contributions, studies conducted by public institutions, and decisions from the Court of Justice of the EU.