Draft Guidelines on the Extra-Territorial Scope of the GDPR

By‎ Adv. Dotan Hammer

Partner at the Cyber, Privacy & Copyright Group, Pearl Cohen Zedek Latzer Baratz

Reading time: 1 Minute
Save to "My Content"

The European Data Protection Board (EDPB) – the panel of EU privacy regulators – has published long-awaited guidance on the territorial scope of the General Data Protection Regulation (GDPR). The draft guidelines explain that according to Article 3 of the GDPR, the GDPR’s applicability is triggered into effect on one of two criteria – the “establishment” criterion and the “targeting” criterion.

Under the “establishment” criterion, the GDPR applies when an organization exercises real and effective activities through stable arrangements within the European Union, such as an EU branch, subsidiary or even just an agent. Yet merely having a website that is accessible to EU audience does not amount to an ‘establishment’ in the EU. If the processing of personal data is done in connection with the EU establishment, then the ‘establishment’ criterion is triggered into effect and the GDPR applies to the organization.

Under the “targeting” criterion, the GDPR applies to non-EU organizations that process personal data, either in relation to the offering of good or services (regardless of payment) to individuals who are in the EU at the time of the offering, or in relation to the monitoring of the behavior of individuals who are in the EU at the time of monitoring.

According to the “offering of goods or services” prong, the GDPR will apply where there is a clear intention of the organization to offer goods or services to individuals in the EU. The guidelines suggest a number of factors that may indicate such intention, including marketing campaigns directed at EU audience, the use of a website with top-level domain names attributable to the EU (such as .DE); Use of a language or a currency of an EU country.

Under the “monitoring” prong, the GDPR will apply when the organization has a specific purpose in mind for the collection and subsequent reuse of the relevant data about an individual’s behavior within the EU, such as online tracking, behavioral advertising, and CCTV.

The draft guidelines are open for public comments until January 18, 2019.

CLICK HERE to read the draft guidelines.