Instead of allowing businesses to deal with the data-protection authority in the country where they are headquartered or have their main European base, member states are insisting that national regulators maintain control. Under the newly proposed rules, any “concerned” authority could object to a decision by another national regulator, triggering a complex arbitration procedure involving all 28 agencies.