… As I have already made clear, Directive 95/46 does not provide for a country-of-origin principle or for a one-stop-shop mechanism of the kind that appears in
Regulation
No
2016
/
679
. A controller which has establishments in several Member States is, consequently, fully subject to the supervision of several supervisory authorities if the laws of the Member States to which those authorities belong are applicable. …
… (EU)
2016
/
679
of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (OJ 2016 L 119, p. 1).
61 See, on this point, Hawkes B., ‘The Irish DPA and Its Approach to Data Protection’, in Enforcing Privacy: Regulatory, Legal and Technological Approaches, Springer, Berlin, 2016, pp. 441 to 454, especially p. 450, footnote 11. …
… working party, 16 December 2015, pp. 6 and 7.
58 As regards the possible application of the laws of several Member States, see Opinion 8/2010: ‘the reference to “an” establishment means that the applicability of a Member State’s law will be triggered by the location of an establishment of the controller in that Member State, and other Member States’ laws could be triggered by the location of other establishments of that controller in those Member States’ (p. 29).
59 C-191/15, EU:C:2016:612.
60
Regulation
…