Source: https://www.bakermckenzie.com/en/insight/publications/2019/12/guidelines-on-the-territorial-scope-of-gdpr
Timestamp: 2020-04-06 05:59:29
Document Index: 166618831

Matched Legal Cases: ['Art. 3', 'Art. 27', 'Art. 3', 'Art. 3', 'Art. 44', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art 3', 'Art. 3', 'Art. 27', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3', 'Art. 3']

EDPB Guidelines on Territorial Scope of GDPR | Insight | Baker McKenzie
EDPB - Guidelines on the Territorial Scope of the GDPR (Art. 3) and on Representatives (Art. 27) - Now adopted after public consultation
The European Data Protection Board ("EDPB") has published the adopted version of its guidelines on the territorial scope of the General Data Protection Regulation ("GDPR"). The guidelines were first published in November 2018 for public consultation. After completion of the public consultation process, the guidelines had been updated and thereafter adopted as final guidelines by the EDPB in November 2019. Unfortunately, the guidelines leave several questions relating to the territorial scope unanswered, especially when it comes to non-EU processors.
I. "Establishment" Criterion - Art. 3(1)
The EDPB confirms that "establishment" requires both a degree of stability of the arrangement, and the effective exercise of activities in the EU and clarifies other questions around "establishment":
A "stable arrangement" in the EU can be fulfilled even if just a single employee or agent acts with a sufficient degree of stability. However, the mere fact that an employee resides in the EU and works for a non-EU company does not automatically result in an "establishment" being created (see example 15 of the guidelines) as there must also be processing of personal data carried out in the context of activities of the EU-based employee.
In addition to an "establishment" in the EU, there must be a link between the activity the data is being processed for and activities of the establishment in the EU. The nature of any such link is key in determining whether the GDPR applies under Art. 3(1), as such link must be "inextricable." One key aspect for an "inextricable link" may be the raising of revenue in the EU.
Having a website accessible in the EU is not, by itself, sufficient to create an "establishment" in the EU.
If a controller outside of the EU uses a processor located in the EU, the processor is not an "establishment" of the controller and this fact is not, by itself, sufficient for the GDPR to apply directly to the controller. This is relevant to non-EU data controllers which outsource data processing to the EU.
However, a processor located in the EU is subject to the processor requirements of the GDPR in relation to its processing activities, including the requirements for international data transfers under Art. 44 et seq. GDPR. Hence, the processor must put in place appropriate safeguards (e.g. EU Model Clauses) to transfer the personal data back to the non-EU controller. Processors will have difficulties to comply with this requirement as no "Processor to Controller" EU Model Clauses currently exist. Further, limiting the services to controllers which are either in a country with an adequacy decision, or are Privacy Shield certified, is not an option from a business perspective. The EU Commission should adopt EU Model Clauses for this scenario urgently.
II. Offering Goods/ Services and Monitoring Behavior – "Targeting" Criterion under Art. 3(2)
The guidelines clarify that "targeting" is required under both – Art. 3(2)(a) – Offering Goods or Services and Art. 3(2)(b) – Monitoring Behavior. Although the guidelines specifically mention the criterion of "targeting" individuals in the EU only in respect to the offering of goods or services, the EDPB considers targeting to be an integral part of "monitoring". In the absence of targeting, mere processing of personal data of individuals in the EU is not, by itself, sufficient for the GDPR to apply under Art. 3(2).
The EDPB thus recommends a twofold approach to determine whether the processing relates to: (a) data subjects in the EU; and (b) offering goods or services or to monitoring data subject's behavior in the EU in a targeted manner as follows:
1. The "Targeting Criterion"
To determine whether the "Targeting" criterion is fulfilled, the guidelines provide various factors which have been adopted from European consumer protection law and which, in combination, may amount to targeting data subjects in the EU. These include, inter alia: (a) paying a search engine to provide a referencing service to facilitate access to its site by consumers in the EU, or launching marketing and advertisement campaigns directed at an EU country; (b) the international nature of the activity, such as certain tourist activities; (c) use of language/currency other than that generally used in the trader's country, especially the language/currency of one or more EU Member States; and (d) offering the delivery of goods in EU Member States. The guidelines note that the mere accessibility of a website in the Union is not sufficient to amount to targeting.
2. The Offering of Goods/Services - Art. 3(2)(a)
The offering of services also includes the offering of "information society services", which are defined as "any information society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of the services".
3. Monitoring Behavior - Art. 3(2)(b) GDPR
The guidelines state that although the recitals to the GDPR mention monitoring in relation to tracking behavior on the internet, tracking through other technologies or networks involving personal data processing should also be taken into account when deciding whether the processing amounts to "monitoring behavior" and provides examples such as wearable and smart devices.
The guidelines clarify that the term "monitoring" in this context requires a specific purpose for the collection and reuse of the relevant data about the individual's behavior in the EU. Sensibly, the EDPB confirms that online collection or analysis of personal data of individuals in the EU does not automatically amount to "monitoring" for the purposes of Art. 3(2) of the GDPR. The purpose of the processing and any subsequent behavioral analysis or profiling in relation to that personal data is relevant.
The guidelines provide some examples of what activities amount to "monitoring" for these purposes, including: (a) behavioral advertising; (b) geolocation, in particular for marketing purposes; (c) online tracking through use of cookies or other tracking techniques (e.g. fingerprinting); (d) personalized diet and health analytic services online; (e) CCTV; (f) market surveys and other behavioral studies based on individual profiles; and (g) monitoring or regular reporting on the status of an individual's health.
The guidelines state that to determine whether a processor located outside of the EU is subject to the GDPR under Art 3(2), it is necessary to determine whether the processing by the processor is "related" to the targeting activities of a controller outside of the EU. This assessment involves examining the connection between the processing carried out by the processor and the targeting activity undertaken by the controller. In the EDPB’s view, where the processing by a controller outside of the EU relates to offering goods/services or monitoring the behavior of individuals in the EU ("targeting"), if a processor is instructed to carry out such processing activities, the processor will be within the scope of the GDPR in respect of that processing activity. It appears that the EDPB wants to apply the GDPR to a service provider who offers a tool or software to a business customer (legal entity) for purposes of enabling the business customer to offer goods/services via the tool to end-users in the EU (or to monitor end-users in the EU), even though it is not the service provider but the business customer that is ultimately offering the goods/services to (and/or carries out the monitoring of) individuals.
The guidelines expressly require controllers or processors outside of the EU and subject to the GDPR pursuant to Art. 3(2) to appoint a representative under Art. 27. It follows that controllers or processors subject to the GDPR under Art. 3(1) are not required to appoint a representative. The EDPB also confirms that the appointment of a representative does not result in an "establishment", and thus does not trigger the application of the GDPR through Art. 3(1). In addition, where several processing activities of a controller or processor are subject to the GDPR under Art. 3(2), the controller is not required to designate a separate representative for each separate processing activity.
Scenarios where a non-EU parent entity receives personal data of employees of an EU affiliate raise the issue (i) whether the EU affiliate qualifies in this context as an "establishment" of the non-EU parent entity; and/or (ii) whether the offering of benefits to EU employees by the non-EU parent entity triggers the GDPR under Art. 3 (2)(a).
The EDPB's broad territorial application of the GDPR to non-EU processors pursuant to Art. 3(2) seems to be limited to scenarios where the controller is located outside of the EU and subject to the GDPR pursuant to Art. 3(2). However, it is unclear whether the EDPB's broad territorial application of the GDPR to non-EU processors pursuant to Art. 3(2) shall also be triggered if the controller is located within the EU and subject to the GDPR pursuant to Art. 3(1).
Regarding the appointment of representatives, the guidelines do not clarify whether the term "represent" means that the representative must receive a power of attorney to represent the controller or processor. If one is required, it is unclear how far reaching the power of attorney of the representative must be. If one is not required, it is unclear whether this means that the representative acts as a "communicating messenger" only. One interpretation (in particular for tax reasons) would be that it is not necessary that the representative has (full) power of attorney, e.g. to legally bind the non-EU company.
Magdalena Kogut-Czarkowska
+ 48 22 4453452 Email
+ 49 69 2 99 08 508 Email
+ 44 20 7919 1357 Email