Articles

European Data Protection Board provides welcoming guidance on the territorial scope of the GDPR

European Data Protection Board provides welcoming guidance on the ter

European Data Protection Board provides welcoming guidance on the territorial scope of the GDPR

24.01.2019 EU law

“If personal data of a Korean employee working for a U.S. company is processed in the HR department in London, does the GDPR apply?” “Is the GPDR applicable to a Dutch customer visiting the website of a Canadian company?”

This and many other similar questions are often raised in practice. The territorial scope of application of the GDPR can be a mind-boggling exercise. The territorial applicability of the GDPR is however the first step that needs to be conducted in the GDPR analysis. Aware of the need for guidance on this topic, the European Data Protection Board (“EDPB”, the former “Article 29 Working Party”) has published its “Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)” on 16 November 2018, welcoming comments until 18 January 2019. With these Guidelines, the EDPB focusses on a harmonious interpretation and uniform application of article 3 GDPR by companies active on the EU market, in order to ensure a comprehensive protection of EU data subjects’ rights.

By referring to existing case law of the CJEU and other European legislation, the EDPB extensively interprets the two criteria of article 3 GDPR: i) the establishment criterion, as set out in article 3 (1) GDPR; and ii) the targeting criterion, as set out in article 3 (2) GDPR. In short, the establishment criterion determines whether an entity is sufficiently rooted within the EU, regardless of whether the processing takes place in the EU or not. Any real and effective activity, even a minimal one, in the context of the entity’s activities can be enough to satisfy the establishment criterion. The targeting criterion, on the other hand, sets out whether the GDPR applies when personal data of data subjects in the EU are processed while offering goods or services to the data subjects, or when their behavior in the EU is monitored.

When either the establishment criterion or the targeting criterion is met, the provisions of the GDPR will apply to the relevant entity. Also the processing in a place where Member State Law applies by virtue of public international law (article 3 (3) GDPR) has been touched upon shortly.

Aware of the complexity of the issue given the worldwide data flows and international (e-)businesses, the EDPB stresses the importance of an analysis based on the specific situation. The EDPB develops a multifold approach in determining whether or not one of the two above criteria is applicable and provides many practical examples. In addition, the EDPB has also set out different paths for data controllers and data processors, whether or not in the EU, as the processing by each entity must be considered separately. Lastly, the EDPB also provides clarification on the process for the designation of a representative within the EU for non-EU companies, as set out in article 27 GDPR.

The link to the Guidelines can be found here

Team

Related news

02.07.2019 NL law
Debate night: HR Analytics: opportunity or threat?

Seminar - On 2 July 2019, Stibbe's Digital Economy Group will host a debate night in Amsterdam on the hot topic of HR analytics. During Stibbe's debate night, speakers from the world of business, politics, science and law will exchange views on HR analytics, how they can be used in practice, and their development in the context of employment and privacy law.

Read more

06.06.2019 NL law
Masterclass: Alcohol and drug testing in the workplace

Masterclass - Stibbe will host a masterclass entitled 'Alcohol and drug testing in the workplace' on 6 June in Amsterdam. During this masterclass, employment law expert Johan Zwemmer and privacy experts Frederiek Fernhout and Judica Krikke will discuss the Dutch Data Protection Authority's general prohibition of these tests and discuss whether and how employers should implement.

Read more

21.06.2019 NL law
Nieuw boetebeleid van de Autoriteit Persoonsgegevens

Short Reads - Op 14 maart 2019 zijn de nieuwe Boetebeleidsregels Autoriteit Persoonsgegevens 2019 ("Boetebeleidsregels") van de Autoriteit Persoonsgegevens ("AP") gepubliceerd. Dit boetebeleid heeft de AP opgesteld vanwege de inwerkingtreding van de Algemene verordening gegevensverwerking ("AVG") en omdat er op Europees niveau nog geen boeterichtsnoeren zijn opgesteld.

Read more

06.06.2019 NL law
Masterclass: Alcohol- en drugstesten op de werkvloer

Masterclass - Stibbe in Amsterdam organiseert op 6 juni de masterclass 'Alcohol- & drugstesten op de werkvloer'. Tijdens deze masterclass bespreken arbeidsrechtexpert Johan Zwemmer en privacydeskundigen Frederiek Fernhout en Judica Krikke het algemene verbod van de Autoriteit Persoonsgegevens op deze testen voor werkgevers en leggen zij onder meer uit hoe hiermee moet worden omgegaan.

Read more

07.06.2019 BE law
Part three - GDPR and public law: To retroact or not?

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss the retroactive application of GDPR.

Read more

05.06.2019 BE law
Part two - GDPR and Public Law: Data protection in public procurement

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss some GDPR-related aspects of public procurement.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring