View source for Article 3 GDPR

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 2 GDPR|←]] Article 3: Territorial scope [[Article 4 GDPR|→]]
|-
| style="padding: 20px; background-color:#003399;" |[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

==Legal Text==
<center>'''Article 3 - Territorial scope'''</center><span id="1">1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.</span>

<span id="2">2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</span>

::<span id="2a">(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</span>

::<span id="2b">(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.</span>

<span id="3">3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.</span>

<br />

==Relevant Recitals==
<span id="r14">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 14:''' the determination of data subjects in the Union</div>
<div class="mw-collapsible-content">The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.
</div></div>

<span id="r22">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 22:''' the determination of an establishment of a controller or a processor in the Union</div>
<div class="mw-collapsible-content">
Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.
</div></div>

<span id="r23">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 23:''' the determination of the offer of goods or services</div>
<div class="mw-collapsible-content">
In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
</div></div>

<span id="r24">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 24:''' the monitoring of behaviour criterion</div>
<div class="mw-collapsible-content">
In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
</div></div>

<span id="r25">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 25:''' the application of the GDPR by virtue of public international law</div>
<div class="mw-collapsible-content">
Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State's diplomatic mission or consular post.
</div></div>

<span id="r80">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 80:''' the representative's designation</div>
<div class="mw-collapsible-content">
Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union, the controller or the processor should designate a representative, unless the processing is occasional, does not include processing, on a large scale, of special categories of personal data or the processing of personal data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing or if the controller is a public authority or body. The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority. The representative should be explicitly designated by a written mandate of the controller or of the processor to act on its behalf with regard to its obligations under this Regulation. The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation. Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation. The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.
</div></div>

<span id="r122">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 122:''' the territorial competence of each supervisory authority</div>
<div class="mw-collapsible-content">
Each supervisory authority should be competent on the territory of its own Member State to exercise the powers and to perform the tasks conferred on it in accordance with this Regulation. This should cover in particular the processing in the context of the activities of an establishment of the controller or processor on the territory of its own Member State, the processing of personal data carried out by public authorities or private bodies acting in the public interest, processing affecting data subjects on its territory or processing carried out by a controller or processor not established in the Union when targeting data subjects residing on its territory. This should include handling complaints lodged by a data subject, conducting investigations on the application of this Regulation and promoting public awareness of the risks, rules, safeguards and rights in relation to the processing of personal data.
</div></div>

==Commentary on Article 3==
===(1) Controller or processor established in the Union ===

The GDPR does not define the term "establishment." Recital 22 states that:  <blockquote>“''[e]stablishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect''”. </blockquote>This very closely resembles the [[CJEU - C-230/14 - Weltimmo]] case, according to which an establishment extends “''to any real and effective activity — even a minimal one — exercised through stable arrangements''”<ref>C-230/14, Weltimmo, 1 October 2015, paragraph 31.</ref>. In its guidelines,<ref>EDPB guidelines 3/2018on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p.8.</ref> the EDPB reminded that the wording was not new as it was identical to Recital 19 of [https://eur-lex.europa.eu/eli/dir/1995/46/oj Directive 95/46/EC]. It also pointed out that although the threshold for “stable arrangement” is quite low in the context of online activities and that the notion of “establishment” is broad, it cannot lead to the conclusion that a “''non-EU entity has an establishment in the Union merely because the undertaking’s website is accessible in the Union''”.<ref>C‑191/15, Verein  für  Konsumenteninformation  v.  Amazon  EU  Sarl,  28  July  2016,  paragraph  76.</ref>

The meaning of “''in the context of the activities''” has to be interpreted broadly, as confirmed by judgments of the CJEU:

In [[CJEU - C-131/12 - Google Spain]] the Court determined with regard to Directive 95/46/EC that the activity of a search engine is to be classified as “processing of personal data”. It found that <blockquote>“''inasmuch as the data processing carried out in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites and affects the data subject’s fundamental rights additionally, the operator of the search engine as the controller in respect of that processing must ensure, within the framework of its responsibilities, powers and capabilities, that that processing meets the requirements of Directive 95/46, in order that the guarantees laid down by the directive may have full effect''”.<ref>C-131/12, Google Spain, 13 May 2014, paragraph 83.</ref></blockquote>The Court explained that both terms “processing” and “controller” must be interpreted broadly as to not "''largely deprive the Directive of its effect''”<ref>C-131/12, Google Spain, 13 May 2014, paragraph 30.</ref> and "''to ensure effective and complete protection of data subjects''”.<ref>C-131/12, Google Spain, 13 May 2014, paragraph 34.</ref>

In [[CJEU - C-230/14 - Weltimmo]], the Court stated with regard to Directive 95/46/EC that "''<nowiki/>'in the context of the activities of an establishment’ cannot be interpreted restrictively''".<ref>C-230/14,Weltimmo, 1 October 2015, paragraph 25.</ref>

In [[CJEU - C-210/16 - Wirtschaftsakademie Schleswig-Holstein]], the Court stated with regard to Directive 95/46/EC that processing carried out in the context of the activities of the controller’s establishment “''cannot be interpreted restrictively''”<ref>C-210/16, Wirtschaftsakademie, 5 June 2018, paragraph 56.</ref> and that processing “''does not require that such processing be carried out ‘by’ the establishment concerned itself, but only that it be carried out ‘in the context of the activities of’ the establishment''”.<ref>C-210/16, Wirtschaftsakademie, 5 June 2018, paragraph 57.</ref>

At the same time, the EDPB has stated that the requirement "''should not be interpreted too broadly to conclude that the existence of any presence in the EU with even the remotest links to the data processing activities of a non-EU entity will be sufficient to bring this processing within the scope of EU data protection law''".<ref>EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 7.</ref> The EDPB suggests that (i) the relationship between a data controller or processor outside the Union and its local establishment in the Union and (ii) revenue raising in the Union by a local establishment may help in determining whether processing by a non-EU entity occurs in the context of its establishment in the Union.<ref>EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 8.</ref>

The location of the processing itself is irrelevant to determine the geographical scope of Article 3(1). As explained by the EDPB, geographical location is only relevant to answer whether a controller or processor is established inside or outside the Union and whether a non-EU controller or processor has an establishment in the Union.<ref>EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 10.</ref>

===(2) Targeting the Union market===
If the controller or the processor is not established in the Union, the GDPR can be triggered if personal data of data subjects located in the Union is being processed. In light of Recital 14 and as supported by the EDPB guidelines,<ref>EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 14.</ref> targeting criterion is neither limited by residence nor nationality, but covers any natural person located in the Union to the extent that they are subject to processing as described in Article 3(2)(a) and (b).
====(a) Offering of goods or services====
The concept of "''goods and services''" has been clarified in EU law (such as [https://eur-lex.europa.eu/eli/dir/2006/123/oj Directive 2006/123/EC on services in the internal market]) and case law, ''inter alia'' on the interpretation of Articles 28 to 37 and 56 to 62 [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012E%2FTXT TFEU]. 

“''Goods''” are products which can be valued in money and which are capable, as such, of forming the subject of commercial and lawful transactions.<ref> Eg: C-7/68 European Commission v. Italy, 10 December 1968; C-50/80 Horvath, 5 February 1981; C-421/09 Humanplasma, 9 December 2010.</ref>

“''Services''” are activities agreed upon by the provider and the recipient in exchange for, typically, remuneration.<ref> Eg C-263/86 Humbel, 27 September 1988.</ref> In addition, the service provider must be independent and pursue its activity on a stable and continuous basis.<ref> Eg. C-55/94 Gebhard, 20 November 1995.</ref> This definition includes “''any Information Society service,  that  is  to  say,  any  service  normally  provided  for  remuneration,  at  a  distance,  by electronic means and at the individual request of a recipient of services''”,<ref>[https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32015L1535U Article 1(1)(b) of Directive 2015/1535/EU].</ref> as also supported by the EDPB.<ref>EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p.16 referring to Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services.</ref> 

The processing is covered "''irrespective of whether a payment of the data subject is required''". 

====(b) The monitoring of data subjects' behaviour====
Processing related to the monitoring of the behaviour of data subject is not defined in the GDPR. Recital 24 clarifies that <blockquote>“''[i]n order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.''”</blockquote>

===(3) The public international law criterion===

The GDPR applies to the processing of personal data by a controller not established in the Union if the Member State’s legislation applies by virtue of public international law.

Recital 25 gives the example of processing taking place in a “''Member State’s diplomatic mission or consular post''”. The EDPB gives as a further example the case of a German cruise ship travelling in international waters. By virtue of public international law, the GDPR will apply even though the ship is in international waters.<ref>EDPB, guidelines 3/2018 on the territorial scope of the GDPR, versions 2.1., 12 Novembre 2019, p. 23.</ref>

==Decisions==
→ You can find all related decisions in [[:Category:Article 3 GDPR]]

==References==
<references />

[[Category:GDPR Articles]]