Material and Territorial Scope of the GDPR (Chapter 1, Section 2) — Guide to the GDPR

The material and territorial scope of the GDPR is provided for in Articles 2 and 3.

Under Article 2(1), the GDPR applies to processing of personal data (a) wholly or partly by automated means and to (b) other processing (e.g., in paper files) of personal data which form part of a filing system or are intended to form part of a filing system (i.e., if the data are catalogued in a manner allowing to find particular persons, e.g. alphabetical files of individual clients).

To understand the provision on the material scope of the GDPR, Article 1, which states the subject matter and objective of the GDPR, Article 3, which states the territorial scope and the section on definitions need to be consulted. To determine whether the GDPR applies to a particular business (an organisation of any kind) or a particular process, an understanding is needed of the individual elements of the provision stipulating the material scope of the GDPR, i.e.:

However, at the end of 2018 when we are writing this book, not everything about processing data ‘by automated means’ is clear. In particular scope of applicability of the GDPR to so-called unstructured data is unclear. Is a lawyer writing a pleading in a text editor on her laptop processing data of persons mentioned in that pleading ‘by automated means’? Is a general file server or Sharepoint like resource or other common computer space for an organisation an automated means of processing even if filing and sharing are not governed by any centralised filing system based on personal data? Does a personal address book created and kept by an employee amount to processing data of contacts by automated means by her employer? Is a practice of identifying and indexing of all personal data in an organisation’s systems (as promoted by certain IT vendors) a good or bad thing? To a certain extent Article 11 GDPR treating about processing personal data for which identification is not needed (called by us ‘unidentified data’) and Article 14(5) GDPR describing exemptions from informing a person (data subject) about processing her personal data help to reconcile duties of data controllers and rights of data subject with specific situations, without claiming that the GDPR does not apply at all. In any case, breaking the GDPR Code is not easy.

There are certain cases in which the GDPR does not apply even though an organisation performs operations on personal data that fall within the material scope specified in Article 2(1):

Article 3(1) GDPR specifies the territorial scope:

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

The territorial scope is formulated in a very broad way, and this is intended to ensure the greatest personal data protection possible regardless of where the technical means used to process data are in fact located.

First, if you are located in the EU. the GDPR applies to you whether you are a controller or you act as a processor, even if you are processing personal data of non-EU residents.

The processing alone may be performed outside of the EU, which is a significant departure from the old rules.

A notion of ‘establishment in the Union’ refers to any type of organisational presence on the territory of the EU, not necessarily a subsidiary or a branch, representative office. For example it may cover having agents in the EU.

Processing data ‘in the context of the activities of an establishment’ does not need to take place in the establishment of a particular economic organism. In a decision imposing an administrative fine on Google LLC, CNIL found that Google Ireland Limited is not a main establishment of Google in the meaning of Recital 36 GDPR as decisions relating to processing do not take place in Ireland but in Google LLC’s headquarters in Mountain View, California, United States (US). Though the CNIL’s decision tackles directly another issue – competence of supervisory authorities – and waters down the so-called one-stop-shop principle (Article 56 GDPR), it is not a bad example of processing and deciding outside of the EU while having an EU establishment.

Under Article 3(2) GDPR, the territorial scope of the GDPR is also extended to cover the following cases:

The processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union, where the processing activities are related to:

This means that even entities located outside of the EU may have to apply European personal data protection laws when processing data of EU residents. This is a major departure from the former regulations. Under the former regulations, entities established in a third country and which processed personal data outside of the European Economic Area (EEA) or used technical means located in the EU solely to transfer data to a third country would not have been subject to the data protection rules.

The offering, in any form, of goods or services to persons in the EU, even at no charge, regardless of the location of the registered office of the controller and place of data processing, must be in compliance with the GDPR. Offering of goods or services ‘irrespective of whether a payment of the data subject is required’ is a particularly puzzling expression, knowing that EU regards just having a website as offering an electronic service. Therefore an actual target audience of a particular offer, service or electronic service will decide on whether the GDPR applies or not. If your site has an EU language version (beware of using ‘s’ instead of ‘z’ when writing in English [a joke]) or it offers delivery to the EU, the GDPR) may apply to your business. But moving from scaring to caring, ‘offering of goods or services to data subjects in the Union’ concerns truly addressing your offer to EU residents. If you are addressing your offer to the whole world (e.g., you provide an app or a web service useful in any place on Earth and you place it on a global marketplace platform such as App store or Google Play or like you are subject to the GDPR). In contrast if you are operating a website offering fishing equipment and you ship only to the US and Canada (with the exception for fishing rods, which you do not ship to Canada) you are not subject to the GDPR and you do not need to implement geofencing, even if an EU resident while visiting the US decides to go fishing and buys equipment through your website.

Seemingly the most intriguing is a premise of say ‘monitoring EU behaviour of EU residents’ (Article 3(2)(b) GDPR). In cases where the behaviour of persons within the EU is monitored by third-country organisations, these organisations have to conduct this process in accordance with the GDPR. In the age of cookies, Google Analytics, affiliate marketing, and retargeting, it is hard to say we are not monitoring our website guest base. Would a simple use of web traffic analysis tools amount to monitoring EU residents? We do not think so. However, the more we are interested in the geographical analysis of our traffic and preferences of our EU-based guests the more likely we fall under the GDPR. The EDPB guidelines on the territorial scope of the GDPR are here (as usual in problematic situations) rather useless. Let us try to be more practical.

The EDPB theoretically agrees that not all ‘online collection or analysis of personal data of individuals in the EU would automatically count as “monitoring”’. Though immediately after that statement it is getting strange. The EDPB lists probably all possible marketing uses of online data (behavioural advertisement, geolocalisation, online tracking in particular through cookies) going even farther to include closed circuit television (CCTV). We end up between dimming and pure nonsense – making the whole world subject to the GDPR if they are using behavioural online advertising or just marketing cookies. Here goes to the EDPB the same ‘facepalm’ as the ‘facepalm’ for Facebook relying on consent to suck up all data on our online behaviour in exchange for allowing us to use our Facebook profile (with a slight difference that Facebook is slightly more effective than the EDPB).

In our opinion, simple retargeting does not amount to monitoring as the goal is to display an advertisement or another message to a user wherever s/he/neutral goes and not to register and analyse what other websites she visits, etc. Affiliate marketing – likewise. However, if you are analysing your individual website guests’ behaviours online, you are probably monitoring them even if you do not know their identity. If you apply also a location criterion, you might fall under the GDPR even if you refrain from further analysing data gathered on EU residents. In practice only when your activity is, to say, ‘EU significant’ (e.g., you do not sell to the EU, but if you help to sell to the EU, you are a data analytics factory) you might fall under the ‘monitoring extension’. Otherwise our US fishing equipment start-up delivering to the US and Canada is in serious trouble.

Paragraph 3(3) GDPR says meanwhile that the GDPR also applies to the processing of personal data by a controller which is not established in the EU but in a location in which the laws of a Member State apply under international public law, such as embassies, consulates, seagoing vessels, and aircraft.

#2.1 Applicability of the GDPR

#2.1.1 Material Scope

#2.1.2 Exclusion of Applicability of the GDPR

#2.1.3 Territorial Scope