Articles

European Data Protection Board provides welcoming guidance on the territorial scope of the GDPR

European Data Protection Board provides welcoming guidance on the ter

European Data Protection Board provides welcoming guidance on the territorial scope of the GDPR

24.01.2019 EU law

“If personal data of a Korean employee working for a U.S. company is processed in the HR department in London, does the GDPR apply?” “Is the GPDR applicable to a Dutch customer visiting the website of a Canadian company?”

This and many other similar questions are often raised in practice. The territorial scope of application of the GDPR can be a mind-boggling exercise. The territorial applicability of the GDPR is however the first step that needs to be conducted in the GDPR analysis. Aware of the need for guidance on this topic, the European Data Protection Board (“EDPB”, the former “Article 29 Working Party”) has published its “Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)” on 16 November 2018, adapted on 12 November 2019 after public consultation. With these Guidelines, the EDPB focusses on a harmonious interpretation and uniform application of article 3 GDPR by companies active on the EU market, in order to ensure a comprehensive protection of the rights of data subjects in the EU. The EDPB underlines that the application of article 3 aims at determining whether a particular processing activity, rather than a natural person or legal entity itself, falls within the territorial scope of the GDPR. Consequently, certain processing activities by a controller or processor might fall within the scope of the GDPR, while other processing activities might not, depending on the processing activity.

By referring to existing case law of the CJEU and other European legislation, the EDPB extensively interprets the two criteria of article 3 GDPR: i) the establishment criterion, as set out in article 3 (1) GDPR; and ii) the targeting criterion, as set out in article 3 (2) GDPR. In short, the establishment criterion determines whether an entity is sufficiently rooted within the EU, regardless of whether the processing takes place in the EU or not. Any real and effective activity, even a minimal one, in the context of the entity’s activities can be enough to satisfy the establishment criterion. The targeting criterion, on the other hand, sets out whether the GDPR applies when personal data of data subjects in the EU are processed while offering goods or services to the data subjects, or when their behavior in the EU is monitored.

When either the establishment criterion or the targeting criterion is met, the provisions of the GDPR will apply to the relevant entity for that processing activity in question. Also the processing in a place where Member State Law applies by virtue of public international law (article 3 (3) GDPR) has been touched upon shortly.

Aware of the complexity of the issue given the worldwide data flows and international (e-)businesses, the EDPB stresses the importance of an analysis based on the specific situation. The EDPB develops a multifold approach in determining whether or not one of the two above criteria is applicable and provides many practical examples. In addition, the EDPB has also set out different paths for data controllers and data processors, whether or not in the EU, as the processing by each entity must be considered separately. Lastly, the EDPB also provides clarification on the process for the designation of a representative within the EU for non-EU companies, as set out in article 27 GDPR.

The link to the Guidelines can be found here.

Team

Related news

10.03.2022 EU law
De Dataverordening (“Data Act”)

Short Reads - De Europese Commissie heeft op 23 februari 2022 de Europese dataverordening (“Data Act”) voorgesteld, die het delen van data beoogt te bevorderen. Steeds meer gegevens worden door mensen en machines gegenereerd, bewaard en hergebruikt. Data en data-analyse kan een bijdrage leveren aan de efficiëntie van maatschappelijke processen, onderzoek en innovatie stimuleren en het concurrentievermogen van industrieën versterken. Veel data is echter niet vrij toegankelijk.  

Read more

11.05.2022 NL law
De afweging van grondrechten in het kader van corona

Articles - COVID-19 heeft de maatschappij voor dilemma’s geplaatst bij de afweging van volksgezondheid en bescherming van kwetsbaren tegenover vrijheden van het individu. In Tijdschrift voor Arbeidsrecht in Context schetsen Frederiek Fernhout en Judica Krikke de onderliggende rechten en vrijheden die vastgelegd zijn in het Europese grondrechtenkader, de AVG en nationale arbeidswetgeving en bespreken zij hoe deze tegen elkaar moeten worden afgewogen in de context van coronamaatregelen.

Read more

26.04.2022 EU law
Digital Law Up(to)date: Further clarification by the CJEU on the retention of traffic and location electronic communications data for the purpose of combating serious crime

Articles - On 5 April 2022, the Grand Chamber of the Court of Justice of the European Union first confirmed that EU law precludes national legislative measures which provide, as a preventative measure, for the general and indiscriminate retention of traffic and location data relating to electronic communications, for the purpose of combating serious crime.

Read more