- EDPB adopts final guidelines on Art. 3 GDPR on the territorial scope.
- Offer targeting only concerns deliberate, intentional targeting of persons in the EU, not purely incidental services.
- GDPR may apply to processors outside the EU if the controller’s activity triggers its application.
- EU representative is not liable in lieu of the responsible party; liability limited to breach of own obligations.
The European Data Protection Board (EDSA or EDPB in English) has issued its opinion on the international scope of the GDPR following a public consultation (in which we participated have participated) was adopted in a definitive version (Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)). In large parts, the definitive version corresponds to the draft version (cf. Deltaview).
However, the following points are worth noting:
Offer orientation
In connection with the orientation of the offer within the meaning of Art. 3(2)(a) of the GDPR, the EDPB states, in a slightly restrictive or more precise manner, that it is only about conscious alignment goes (“the provision is aimed at activities that intentionally, rather than inadvertently or incidentally, target individuals in the EU”)..
This would exclude the application of the GDPR, for example, if a continuous service is provided to persons outside the EU and this service is subsequently also provided within the EU: “In this case the processing is not related to the intentional targeting of individuals in the EU but relates to the targeting of individuals outside the EU which will continue whether they remain outside the EU or whether they visit the Union.”
Behavioral observation
In this context, there is an interesting, further section on the Application of the GDPR to the Processor with its registered office outside the EU. The EPDB takes a position here on the wording of Art. 3(2) GDPR, which is unclear in its meaning, according to which the GDPR applies to the controller under the conditions of Art. 3(2)(a) and (b). or the processor find application.
Here, the EDPB makes it clear – more or less – that the Applicability of the GDPR to the Processor from the activity of the Controller If an activity of the controller falls within the scope of the GDPR and the controller involves a processor in the process, then the processor can this Processor also fall under the GDPR. The starting point is the Activity of the responsible personThe Processor can only make the corresponding decision (which, conversely, probably also means that this decision establishes the Controller property). From the Processor’s point of view, the question therefore arises as to which is its Connection to the corresponding activity of the controller is. An activity such as data storage shall be sufficient (see the new example 20). It is therefore not necessary (but of course also sufficient) for the controller to be specifically involved in the activity that triggers the application of the GDPR.
To the EU representative
The Guidelines contain some clarifications on the EU representative, for example in relation to the processing list. Also welcome is the clarification that the representative shall is not liable as a substitute for the responsible person (“The GDPR does not establish a substitutive liability of the representative in place of the controller or processor it represents in the Union.”). Rather, the representative himself is liable only for violations of his own duties.