Chapter 4: Territorial application – Unlocking the EU General Data Protection Regulation

Under the GDPR, the position on this issue has materially changed (e.g., the GDPR has introduced a new obligation that did not previously exist).

Under the GDPR, the position on this issue has not materially changed (e.g., although the wording may be different in the GDPR, the nature of the relevant obligation is unchanged).

The impact of the GDPR on this issue is likely positive for most organisations (e.g., because the GDPR provides certainty in relation to a previously unclear issue).

The impact of the GDPR on this issue is likely neutral for most organisations (e.g., because the requirements under the GDPR and the Directive are essentially the same).

The impact of the GDPR on this issue is likely negative for most organisations (e.g., because the GDPR introduced a new obligation on organisations).

The impact of the GDPR on this issue is unknown at this stage (e.g., because the impact on organisations is dependent upon secondary guidance that has not yet been written).

Establishment

Organisations are subject to EU data protection law if they have an establishment in thenEU. The word "establishment" is not precisely defined. The key question is whether there is effective and real exercise of activity through stable arrangements (e.g., a branch or subsidiary can be an "establishment", but a travelling salesperson is unlikely to constitute an "establishment").

Rec.19; Art.4(1)(a)

The Directive (as implemented via the national law of a Member State) applied to organisations that:

• were established in one or more Member State(s); and
• processed personal data (whether as controller or processor and regardless of whether or not the processing takes place in the EU) in the context of that establishment.

 Rec.22; Art.3(1)

The GDPR applies to organisations that:

• are established in one or more Member State(s); and
• process personal data (either as controller or processor, and regardless of whether or not the processing takes place in the EU) in the context of that establishment.

 The GDPR and the Directive both apply to organisations that have an establishment in the EU and process personal data in the context of that establishment.

Application of Public International Law

EU data protection law applies to an organisation if the laws of any Member State apply to that organisation by virtue of public international law.

Art.4(1)(b)

An organisation that is not established in any Member State, but is subject to the laws of a Member State by virtue of public international law was also subject to the Directive.

 Rec.25; Art.3(3)

An organisation that is not established in any Member State, but is subject to the laws of a Member State by virtue of public international law is also subject to the GDPR.

 The GDPR does not amend this principle. In practice, the circumstances in which the laws of a Member State apply by virtue of public international law are rare, and so this issue is unlikely to materially affect many organisations.

Activities in Member States

EU data protection law may apply to an organisation if offering goods or services is the nature of the organisation's activities in a Member State, or in relation to the individuals in that Member State.

Rec.20; Art.4(1)(c)

The Directive (as implemented via the national law of a Member State) applied to organisations established outside the EU if they made use of a "means of processing" (e.g., equipment or a processor) located in a Member State, for the purposes of processing personal data (other than mere transit of those data through the EU).

 Rec.23; Art.3(2)(a)

The GDPR applies to organisations established outside the EU if they (either as controller or processor) process the personal data of individuals in the EU when offering them goods or services (whether or not in return for payment). The question of what constitutes "offering" goods or services to individuals in the EU is determined on a case-by-case basis:

• Mere website accessibility of a service in the EU is not sufficient to trigger application of the GDPR.
• Factors such as offering a service in the languages or currencies used in a Member State (if not also used in the third country), or mentioning customers or users in a Member State may trigger application of the GDPR.

 For any organisation that was already using a "means of processing" in the EU to offer goods or services to individuals in the EU, these changes are unlikely to have any practical impact.

 For any organisation that was not subject to the Directive (e.g., because it is established outside the EU and does not use a "means of processing" in the EU) but offers goods or services to individuals in the EU, these changes mean that such an organisation is subject to the full range of compliance obligations under the GDPR, in relation to the relevant processing activities.

Monitoring of individuals in the EU

EU data protection law may apply to an organisation if that organisation monitors the behaviour of individuals in the EU.

N/A

The application of the Directive was not affected by the question of whether an organisation monitored the behaviour of individuals in the EU.

 Rec.24; Art.3(2)(b)

The GDPR applies to organisations established outside the EU if they (whether as controller or processor) monitor the behaviour of individuals in the EU (to the extent that such behaviour takes place in the EU). The question of what constitutes "monitoring" is determined on a case-by-case basis:

• "monitoring" may include tracking an individual in the EU on the internet; and
• "monitoring" may also include the use of data processing techniques to profile individuals, their behaviours or their attitudes (e.g., in order to analyse or predict personal preferences).

 For any organisation that was already monitoring the behaviour of individuals in the EU either through an establishment in the EU or a "means of processing" in the EU, these changes are likely to make little practical difference.

 For any organisation that was not subject to the Directive (or applicable national laws of Member States) but monitors the behaviour of individuals in the EU, these changes mean that such an organisation is subject to the full range of compliance obligations under the GDPR, in relation to the relevant processing activities.