Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

Alex van der Wolk, Lokke Moerel, and Ronan Tigner authored an article for Law360 covering the decision made by the French Council of State,

In Defense of the One-Stop Shop: CNIL Stands Corrected

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

Alex van der Wolk, Lokke Moerel, and Ronan Tigner authored an article for Law360 covering the decision made by the French Council of State, which confirmed French data protection authority CNIL’s decision fining Google €50 million, and also corrected CNIL on a key element of General Data Protection Regulation (GDPR) enforcement: how to rightfully apply the “one-stop-shop” mechanism (OSS).“The French Council of State corrects CNIL where it required that, for the EU headquarters of Google in Ireland to qualify as the ‘main establishment’ under the OSS provided in the GDPR, it also has to determine ‘the purposes and means’ of the relevant cross-border processing (and therefore also has to qualify as the controller for the relevant processing),” the authors said.“If that were correct, the OSS mechanism would de facto not be available for non-EU-based companies (such as Google), as their EU administrative headquarters will rarely independently decide on the purposes and means of its cross-border processing activities in the EU. This would entail that these companies be exposed to a potential accumulation of fines for their cross-border processing activities in the EU, as each and every national data protection authority, or DPA, would be able to fine the company up to the maximum allowed under GDPR.”Read the <a href="https://media2.mofo.com/v3/assets/blt5775cc69c999c255/bltee5da861dd0b1870/6273ef580d4d8e1d7f110b8b/200708-one-stop-shop.pdf" target="_blank">full article</a>.