Ms Helen Dixon:

----- rather than Facebook, but Google is also headquartered in Ireland. The Chairman has hit on what is a very complex issue - the issue of the French authority's action in respect of Google. Under the GDPR the one-stop shop is a benefit to multinationals and it is designed as a benefit. Ultimately, they are subject to one decision by one enforcer and there is one appeal that can be taken and one fine ultimately. If they are not availing of the one-stop shop where they are supervised by one authority, they are, per the previous regime, subject to the jurisdiction of every individual data protection authority where they are supplying services.

The one-stop shop is a benefit and there are conditions that organisations have to meet in order to avail of that benefit. One of the specific conditions is that the data controller must be EU territorially based to avail of the one-stop shop. At the time that the French authority investigated Google, its controllership was not located territorially in Ireland or the EU. Google could have been investigated and subject to sanctions by any of the data protection authorities in the EU. As it was, the French data protection authority conducted an investigation.

Sorry, the case the Chairman is referring to, the right to be forgotten case, predates the GDPR completely so there was no one-stop shop applicable at that time.