Article 4 GDPR

← Article 4: Definitions →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 4 - Definitions

For the purposes of this Regulation:

1. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

3. ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;

4. ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

5. ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

6. ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

7. ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

8. ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

9. ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

10. ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

11. ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

12. ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

13. ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

14. ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

15. ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

16. ‘main establishment’ means:

(a) as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment;

(b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;

17. ‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;

18. ‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;

19. ‘group of undertakings’ means a controlling undertaking and its controlled undertakings;

20. ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;

21. ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51;

22. ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because:

(a) the controller or processor is established on the territory of the Member State of that supervisory authority;

(b) data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or

(c) a complaint has been lodged with that supervisory authority;

23. ‘cross-border processing’ means either:

(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or

(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

24. ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;

25. ‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council;

26. ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.

Commentary

Article 4 GDPR provides a list of definitions used to further specify relevant notions used throughout the GDPR.

Some definitions are taken from the preceding Directive 95/46/EC, allowing an understanding to build on the already existing terms. Others definitions, however, are newly introduced, modified or complemented with additional elements and therefore require a new interpretation.

In order to avoid linguistic inconsistencies leading to an inconsistent application of the law, it should be noted that the Regulation is legally binding in all official languages of the EU. Therefore, whenever in doubt of the interpretation other language versions may be consulted to identify and resolve discrepancies.

(1) Personal Data

The principal concept of the GDPR is that of ‘personal data’.

Its definition is an extension of the previously existing definition under Article 2 (a) Directive 95/46/EC. The Directive itself derives the definition from Article 2 (a) Convention 108, according to which “personal data” means any information relating to an identified or identifiable individual.

The definition can be divided into the four requirements of (1) ‘any information’ (2) ‘relating to’ (3) ‘an identified or identifiable’ (4) 'individual' requiring their cumulative fulfilment in order to satisfy the notion of personal data.

Any Information

With the expression of ‘any information’, the legislator underlines the willingness to keep the term ‘personal data’ as broad as possible.

In this regard, the German Constitutional Court already in 1983 stated that "Under the conditions of automatic data processing, there is no longer meaningless data." This position is supported by the Commission, stating that "any item of data relating to an individual, harmless though it may seem, may be sensitive", thereby also following the wish of the Council to keep the definition as general as possible. Already the European Court of Human Rights stated that:

“private life” must not be interpreted restrictively. In particular, respect for private life comprises the right to establish and develop relationships with other human beings [...] there is no reason of principle to justify excluding activities of a professional or business nature from the notion of “private life”

Accordingly, personal data includes information both regarding the individual’s private and family life and information regarding the working, economic or social behaviour of the individual regardless of its position or capacity. The Information can either be ‘objective’ such as unchangeable characteristics of a data subject as well as ‘subjective’ in the form of opinions or assessments. It is thereby not necessary for the information to be true, proven or complete.

With regards to the format or medium of the information, data of any type, may it be alphabetical, numerical, (photo)graphical, acoustic, is concerned. This includes information on paper as well as information stored on a computer in binary form or on tape, such as videosurveillance, telebanking, medical prescriptions or even child's drawings.

Relating To

The information needs to relate to an individual. In accordance with the WP29 the CJEU assesses this requirement based on three different criteria, i.e. “where the information, by reason of its content, purpose or effect, is linked to a particular person.”

The content of the information is 'relating to' a person when it is about a particular individual. On the contrary, information relating to a bigger group of person without any possibility to single out a individual is not related to a particular person. Similarly, information exclusively linked to objects or events may not be considered as related to a particular person. However, when information on objects also concerns individuals, it can relate to them indirectly. For example, the objective value of a house allows to infer the owners wealth and income situation while car service records allow conclusions towards their driving behaviour. In this regard, also Geodata (like GPS data and coordinates) allows to derive locations and movement patterns of individuals. Especially, considering information on the growing amount of personal devices, wearables and RFID-Chips increasingly becomes related to their carrying person.

Furthermore, the purpose of the information cause a relation to a person where used to change its particular status or behaviour. Accordingly, data is related to an individual where it is used to determine or influence the way a person is treated or evaluated by the processing entity. The purpose is therefore closely connected to the effects of the processing of the information. Especially, the impact on a particular person’s rights and interests determines whether information is related to a person or not. For example, the deployment of a system to determine the position of available taxis would also allow for a monitoring the performance of respective drivers, strongly impacting their employment situation.

Identified or Identifiable

The person to which the information relates must also be identified or identifiable.

A person is “identified” where it can be distinguished or 'singled out' from a bigger group of persons from the information directly. This is usually achieved through several 'identifiers' listed by Article 4(1) GDPR, such as the name, identification number, locations, online identifiers, physical, physiological, genetic, mental, economic, cultural or social identity of a particular person. Other examples are provided by the Working Party 29 like telephone, car registration, social security numbers and passport numbers as well as a person’s height, hair colour, clothing or professional qualities. Note that the name of a person is therefore not necessarily required to identify an individual given such typically more unique identifiers.

A person is “identifiable” when it has not been identified yet but where identification is possible through a combination of available pieces of information. In this regard, Recital 26 sentence 3 GDPR states “to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used [...] either by the controller or by another person to identify the natural person.” Starting point is therefore an absolute (objective) approach that generally considers both information of the controller as well as information from other entities to identify a person. However, the “reasonable likeliness” of such information being used by the controller, narrows the approach to a relative (subjective) one. In this regard, Recital 26 sentence 4 GDPR adds that in order “to ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, [...] the available technology at the time of the processing and technological developments.”

In other words, while not all of the information required to identify the person needs to be in the hands of the controller the mere hypothetical possibility to identify the person with the information from other entities is not sufficient either. Thus, the assessment requires a case-to-case decision on the reasonable likeliness to identify an individual taking into account state-of-the art tools, available sources, costs, time and effort required to perform the identification. In the case of collecting IP-addresses from visitors of governmental websites, for example, each address relates to an identifiable person given the state’s legal power to access additional information required to link the IP-address to the respective visitor.

Furthermore, taking the increasing accessibility of information through big data technologies into consideration, measures to successfully identify individuals become increasingly reasonable. Especially, where information is stored over a long period of time, persons become more likely to be identified as continuously more pieces of information are added to their data set. In this regard, even pseudonymised data shall explicitly remain considered as information on an identifiable person, according to Recital 26 GDPR. For further information, see also the commentary on Article 4(5) GDPR.

Natural Person

The right to data protection is not restricted to certain nationals or citizens of specific countries but granted to all natural persons according to Article 6 of the Universal Declaration of Human Rights, according to which “Everyone has the right to recognition everywhere as a person before the law”.

Starting from this definition, national legislators usually limit it from to moment of birth to the death of a person. Following up with the GDPR, information relating to deceased persons is then not considered personal data. However, member states may provide alternative rules for the protection of deceased persons which is usually achieved through further data protection, constitutional or personality rights. Another exception can apply for genetic data, where data of deceased persons may be indirectly protected through its relatives. For more information, see also the commentary on Article 4(13) GDPR.

As the definition is limited to natural persons, also information on legal persons is generally not covered by the definition of personal data. However, related provisions from the ePrivacy-Directive, national data protection laws or constitutional laws can grant alternative protection.

Furthermore, information regarding legal persons is also protected by the GDPR where it equals information on natural persons. Especially, where the information to on legal person allows to derive information on the natural person behind, such as a company’s name or mail address, it may be related to a natural person and therefore personal data. This is especially common for smaller businesses, family run or one person enterprises.

Further Examples of Personal Data Subject to the CJEU

• Name, date of birth, nationality, gender, ethnicity, religion and language
• Place of birth, nationality, marital status, sex, record of entries into and exits from a country, residence status, particulars of passports issued, previous statements as to domicile, reference numbers issued by an authority, reference numbers used by authorities
• Municipality of residence, information concerning the earned and unearned income and assets of that person

• Data which relate both to the monies paid by certain bodies and the recipients

• Name of a person in conjunction with his telephone coordinates or information about his working conditions or hobbies

• The times when working hours begin and end, as well as the corresponding breaks and intervals
• Telephone numbers, employment and hobbies

• Dynamic IP address
• Video surveillance
• Written exams
• Fingerprints

Relevant Recitals

Recital 14: Not Applicable to Legal Persons

The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.

Recital 15: Technologically Neutral Protection

In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used. The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system. Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.

Recital 26: Applicable to Pseudonymous Data, Not Applicable to Anonymous Data

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Recital 27: Not Applicable to Deceased Persons

This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.

Recital 29: Conditions for Pseudonymisation

In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. The controller processing the personal data should indicate the authorised persons within the same controller.

Recital 30: Online Identifiers

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

(2) Processing

Processing is another central requirement for the application of the GDPR. To be considered as 'processing' the operation in question has to relate to personal data, according to Article 4(1) GDPR. It can either be a single operation or part of a set of sequential operations that together form the processing. Processing can be carried out by full-, semi or non-automated means. It does not require the use of any electronic means and can also be carried out completely manually.

The notion of processing is formulated broadly by the GDPR through an enumeration of several operations:

• Collection (targeted procurement of single pieces of data), such as offering online registrations or contact forms
• Recording (continuous procurement of data flows), such as operating surveillance cameras or similar sensors
• Organisation (systematic ordering that enhance access and evaluation of information), such as the allocation of information within databases
• Structuring (ordering data according to certain criteria), e.g. in numerically or alphabetical order
• Storage (saving information to a physical and readable format), such as on information on paper, files, disks, drives or cloud servers
• Adaptation (adjustments to the content of information according to specific criteria), e.g. updating to information on age, address or income
• Alteration (changes to the form or content of data), such as corrections, pseudonymisation or anonymization
• Retrieval (accessing stored information), for example loading information to be displayed on a device
• Consultation (accessing stored information through targeted searches), such as using search routines to find and display data
• Use (catching term for all active operations conducted on personal data), e.g. using addresses to deliver orders or mails
• Disclosure by transmission (“pushing” information to recipients or other third parties), such as sharing customer information with another company
• Disclosure by dissemination (untargeted distribution of information to unlimited recipients), e.g. in newspapers, radio or tv broadcasting
• Disclosure by otherwise making available (generally any other form of disclosure), such as providing information on websites or search engines
• Alignment (comparison of information with other, specific requirements), such as grid investigations or ‘dragnet’ actions
• Combination (merging information), such as profiling (see also Article 4(4) GDPR)
• Restriction (marking for limited further processing, see also Article 4(3) GDPR), such as deactivation of information on a website
• Erasure (irreversible rendering of information impossible to access), such as overwriting data multiple times
• Destruction (physically destroying the data carrier), such as shredding of files

Note that this list is non-exhaustive and non-selective. The broad notion of processing allows for an extensive application of the GDPR to any kind of operation conducted on personal data. The only major exception is where controller remains completely passive without taking any active action towards information that is imposed by the data subject.

Relevant Recitals

Recital 15: Technologically Neutral Protection

In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used. The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system. Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.

(3) Restriction of Processing

The restriction of processing means neither a complete prohibition to process nor an erasure of personal data. It is a limitation for the controller to process certain personal data only for very limited purposes. Usually, restrictions to the processing of personal data occur when the data is not required for its purpose originally collected for any more, but cannot be deleted due to legal obligations.

Technically, the restriction is realized through markers on the data in question that ‘locks’ it from further processing in the future. In terms of automated systems, the restriction shall be ensured by technical safeguards to ensure the personal data is not subject to further processing or changes. In terms of non-automated systems, marking the data is typically not sufficient but requires a relocation to a separate storage with access restrictions.

Restrictive methods could include temporarily moving selected data to another processing system, making it unavailable to users, or temporarily removing published data from a website. In case, the data subject needs to be informed about the restriction of processing of their personal data according to Article 18(3) GDPR.

The restriction of processing can also be initiated by request of a data subject under the requirements of Article 18(1) GDPR or a data protection authority according to Article 58(2)(g) GDPR. For more information see the commentary on these provisions.

Relevant Recitals

Recital 67: Right to Restriction of Processing

Methods by which to restrict the processing of personal data could include, inter alia, temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website. In automated filing systems, the restriction of processing should in principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed. The fact that the processing of personal data is restricted should be clearly indicated in the system.

(4) Profiling

With the explicit mentioning of profiling the GDPR reacts to recent risks and dangers origination from new forms of data processing. In this regard, it refers to the increased creation, maintenance and use of profiles on personal traits and behaviour of natural persons. These profiles are typically generated through the application of statistical-mathematical measures to personal data that produce predictions on the future behaviour of the data subject.

Profiling does not require knowledge on the civil identity of the data subject. It already occurs in association with online identifiers, such as IP-addresses, cookie IDs or RFID tags. as well as information automatically collected from smart devices, wearables or cars.

The definition provides a non-exhaustive list over common profiling criteria, such as work performance, economic situation, health or more general personal preferences, interests, behaviour as well as locations and movements. Popular examples are therefore

• Maintaining customer profiles for more efficient marketing
• Operating systems for credit rating/scoring
• Operating e-Recruitment Systems

Besides the economic relevance for controllers, profiling takes effect within many other provisions across the GDPR such as its territorial application, see Article 3(2)(b) GDPR, Recital 24 GDPR, or automated decision making, Article 22 GDPR. In any case, the data subject has to be informed on the existence of profiling by the controller.

Relevant Recitals

Recital 24: Applicable if Monitoring EU Data Subjects

The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

Recital 30: Online Identifiers

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

Recital 60: Information Requirements

The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data. That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.

Recital 71: Right not to be Subject to an Automated Decision

The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as automatic refusal of an online credit application or e-recruiting practices without any human intervention. Such processing includes ‘profiling’ that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her. However, decision-making based on such processing, including profiling, should be allowed where expressly authorised by Union or Member State law to which the controller is subject, including for fraud and tax-evasion monitoring and prevention purposes conducted in accordance with the regulations, standards and recommendations of Union institutions or national oversight bodies and to ensure the security and reliability of a service provided by the controller, or necessary for the entering or performance of a contract between the data subject and a controller, or when the data subject has given his or her explicit consent. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Such measure should not concern a child.

In order to ensure fair and transparent processing in respect of the data subject, taking into account the specific circumstances and context in which the personal data are processed, the controller should use appropriate mathematical or statistical procedures for the profiling, implement technical and organisational measures appropriate to ensure, in particular, that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised, secure personal data in a manner that takes account of the potential risks involved for the interests and rights of the data subject and that prevents, inter alia, discriminatory effects on natural persons on the basis of racial or ethnic origin, political opinion, religion or beliefs, trade union membership, genetic or health status or sexual orientation, or that result in measures having such an effect. Automated decision-making and profiling based on special categories of personal data should be allowed only under specific conditions.

(5) Pseudonymisation

Pseudonymisation is the process of changing personal data in a way that information is either separated or replaced to no longer allow its attribution to a particular data subject without the use of additional information. In order to count as pseudonymised data, this additional information needs to be kept separately and protected through technical and organisational measures to prevent an identification of the data subject through the respective controller.

Examples for the pseudonymisation of personal data include:

• Replacement of names through ID’s, codes or aliases
• Encryption or hashing of data
• Pixelation of video materials

Pseudonymisation has to be distinguished from anonymization. Anonymization is the definite deletion of any information allowing for an identification of the data subject. The GDPR therefore does not apply to anonymized data. Pseudonymisation, on the other hand, generally allows for an identification through the use of additional of information and is therefore invertible.

The distinction between anonymized and pseudonymised data follows the decisive criteria of any reasonable likeliness from Recital 26 sentences 3, 4 GDPR considering the costs, amount of time required and available technology required to identify the data subject. However, considering the recent emergence around big data analytics and data processing capabilities, the process of anonymization becomes increasingly difficult. And while some scholars argue for a ‘subjective anonymisation’, the party undertaking the pseudonymisation is typically able to reassign the data subject.

In any way, the information allowing re-identification of the data subject needs to be stored separately and must secured by technical or organisational measures to prevent identification. In this regard, pseudonymisation helps to reduce risks for the data subjects and helps controllers and processors to meet their obligations from the GDPR.

• Implementing security safeguards (see Article 32(1)(a) GDPR)
• Handling of personal data breaches (see Article 34(3)(a) GDPR)
• Changing purposes of data processing (Article 6(4)(e) GDPR)
• Serving principles of data minimization and security (Article 5(1)(c)(f) GDPR)
• Implementing Data Protection by Design and Default (Article 25 GDPR)

Relevant Recitals

Recital 26: Applicable to Pseudonymous Data, Not Applicable to Anonymous Data

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Recital 28: Pseudonymisation as a Measure of Data Protection

The application of pseudonymisation to personal data can reduce the risks to the data subjects concerned and help controllers and processors to meet their data-protection obligations. The explicit introduction of ‘pseudonymisation’ in this Regulation is not intended to preclude any other measures of data protection.

Recital 29: Conditions for Pseudonymisation

In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. The controller processing the personal data should indicate the authorised persons within the same controller.

(6) Filing System

The notion of ‘file system’ is an important criterion for the application of the GDPR in terms of non-automated data processing (see Article 2(1) GDPR). It is complementing the approach of technological neutrality followed by the GDPR.

A filing system is characterized through a structured set of personal data accessible to specific criteria. The structure of the information must allow a targeted search to personal data. This is already satisfied, when personal data on a particular person is retrievable.

The data can be stored either within a single or multiple data carriers in a centralized or decentralized manner. Also, a filing system does not require to store information in multiple persons. Already storing structured information on a single person may qualify as filing system.

Examples are:

• Salary lists on employees
• Saved letter-correspondence with customers
• Covid-19-Guest-Lists sorted by date

Relevant Recitals

Recital 15: Technologically Neutral Protection

In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used. The protection of natural persons should apply to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system. Files or sets of files, as well as their cover pages, which are not structured according to specific criteria should not fall within the scope of this Regulation.

(7) Controller

The controller is the main addressee to obligations formulated by the GDPR. A controllership can be constituted by any natural or legal person, public authority, agency or other body determining the purposes and means of the processing of personal data. This includes decisions on ‘whether’, ‘why’ and ‘how’ the personal data is processed. In this regard, it the controller is to be distinguished from the processor, which is further explained in Article 4(8) GDPR.

The responsibilities of the controller are defined in Article 24 GDPR. Accordingly, the controller has to ensure to be able to demonstrate that any processing of personal data performed on his behalf is in accordance with the GDPR.

In cases of joint decisions on the means and purposes of the processing of personal data, these responsibilities can be shared with different entities. In such cases of a ‘joint’ or ‘co-controllership’ the entities have to determine their respective responsibilities for the processing within an agreement according to Article 26 GDPR. Important, however, is utlimately the factual influence on the processing of the personal data see Recital 79 GDPR. In this regard, the participation and influence on the purposes and means can be very different among the actors involved in the data processing. In order to ensure an effective and complete protection of the data subject in this regard, the concept of ‘controller’ is interpreted broadly in jurisdiction.

For example, a joint controllership is assumed between

• Search-Engines-Operators and the websites of which information is structured, presented and complemented with advertisements within search results
• Facebook and Administrators of Fan Pages on its social network
• Facebook and Websites that integrated a ‘Like Button’

In each case, however, the responsibility for each entity is strictly limited to the part where it has influence on the purposes and means of the processing. This raises especial relevance to clarify the responsibilities of each controller according to Article 26 GDPR. For further information see the commentary on that provision.

Relevant Recitals

Recital 79: Clear Allocation of Responsibilities

The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.

(8) Processor

The processor is the next entity facing obligations from several provisions across the GDPR, complementing the concept of the controller explained in Article 4(7) GDPR. Any natural, legal person, public authority, agency or body that processes personal data on behalf of the controller qualifies as a processor.

The most important distinction is, that the processor does not determine the purposes and means of the processing. The processor is bound by the instructions given by the controller, solely carrying out the technical operations for the processing of personal data. Whenever the processor acts in its own interest or processes personal data for further purposes, it qualifies as a controller.

Therefore, it can be difficult to distinguish a ‘joint’ or ‘co-controller’ from a processor. In this regard, the Working Party 29 provides some examples as references for controller-processor relationships:

• Outsourcing of Callcenters for Customer Communications
• Outsourcing of Mail Services
• Cloud Hosting and Grid Computing
• A Separated Entity Specialized in Data Processing within a Group of Companies

When qualifying as a processor, many provisions of the GDPR apply to such entities, such as the required implementation of technical organizational measures (see Article 32 GDPR) as well as the possibility of being fined (see Article 82 GDPR). Of additional relevance is Article 28 GDPR, that shall ensure meeting the requirements of the GDPR through binding data processing agreements. For further information, see also the commentary on Article 28(3) GDPR.

A special form of the processor is the ‘sub processor’ engaged by the processor which requires another processing agreement and authorisation through the controller. For further information see the commentary on Article 28(2),(4) GDPR.

Relevant Recitals

Recital 81: Entrusting a Processor

To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing activities, the controller should use only processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. The adherence of the processor to an approved code of conduct or an approved certification mechanism may be used as an element to demonstrate compliance with the obligations of the controller. The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject-matter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject. The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject.

(9) Recipient

Another entity defined in the GDPR is the recipient. The notion of the recipient is kept very broadly, i.e. any party which personal data is disclosed to, independently of whether it is a third party or not. Therefore, whenever a controller sends personal data to another entity, this entity classifies as recipient.

The concept of the recipients is primarily relevant in terms of information obligations of the controller. According to Article 13 to 15 GDPR, the controller has to inform the data subject about recipients or categories of recipients of their personal data. The reasoning behind is, that the controller whenever disclosing personal data to another entity, cannot completely take over responsibility for processing on its own any more.

In this regard, it is discussed, whether a processor is also a recipient. One the one hand, the processor is generally acting on behalf of the controller and therefore not a third party. However, the concept of the recipient is completely independent of that of the third-party. With Article 4(8) GDPR the processor received its own legal identity. Considering the additional risk from any disclosure of data, the processor is also to be considered a recipient. Therefore, Article 28 GDPR does not relieve the controller to inform the data subjects about its processors as recipients according to Article 13 to 15 GDPR.

Not considered as recipient are, on the other hand, particular units within a company, such as the staff council or dependent establishments of the controller. The wording of the provision suggests that the entity requires a particular degree of sovereignty in order to count as recipient. Units that are inseparable part of the internal structure of the controller are therefore not to classify as recipients.

Another exception exists regarding independent financial and administrative public authorities, such as tax or customs authorities receiving personal data on a particular inquiry. These inquiries, however, must be in the general interest and in accordance with Union or Member State law.

Relevant Recitals

Recital 31: Not Applicable to Public Authorities With a Legal Obligation

Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, or financial market authorities responsible for the regulation and supervision of securities markets should not be regarded as recipients if they receive personal data which are necessary to carry out a particular inquiry in the general interest, in accordance with Union or Member State law. The requests for disclosure sent by the public authorities should always be in writing, reasoned and occasional and should not concern the entirety of a filing system or lead to the interconnection of filing systems. The processing of personal data by those public authorities should comply with the applicable data-protection rules according to the purposes of the processing.

(10) Third Party

The concept of a third party complements the previously defined entities. It constitutes a negative delimitation, as any person different from the data subject, controller, processor or any other person authorized to process personal data by the controller. Its notion becomes mainly relevant in terms of evaluating of interests, such as in Article 6 (1)(f) GDPR.

Following from the definition, processors or sub-contractors authorized by the controller for processing are not considered third parties. Also, dependent branches or departments of a controller are not considered third parties, except for where they are located outside the EU. Similarly, internal staff of the controller is not a third party, unless the employee uses personal data for own purposes outside of the employment context. In this case, although considered a third party from the point of the controller, they become controllers themselves for processing the personal data.

Relevant Recitals

Recital 47: Overriding Legitimate Interests

The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

(11) Consent

Consent is the first legal basis mentioned in Article 6(1)(a) GDPR. It manifests the data subject’s agreement to the processing of their personal data. It can be given either by a written, electronic or an oral statement. Examples are ticking a box or actively choosing technical settings that indicate the data subject’s acceptance of the proposed processing of his or her personal data.

The notion of consent within the GDPR is different from its constitutional equivalent in Article 8(2) ECFR. Consent in the GDPR is neither a waiver of fundamental rights, nor a justification for interferences with fundamental rights. Rather, it should be seen as an exception from the general prohibition of processing of personal data under Article 6(1) GDPR.

To ensure that consent is not only a legal fiction, it requires additional and cumulative criteria, regulated within its definition and complemented through Article 7 GDPR. In order for consent to be valid, it has to be freely given, informed, specific and unambiguous. It is the controller’s duty to demonstrate that the data subject has given such consent to the processing of his or her personal data.

Freely Given

Consent has to be freely given, which means that the data subject must have the option to say "no" as well. Whether the option to refuse is genuinely given depends on the processing operation and service as well as the respective roles of the controller and the data subject in a given transaction. For example, if an employee has to consent that his mobile phone is tracked for fraud prevention purposes it is highly unlikely that he or she has a realistic chance to object. In other words, employers, governments or companies (especially those with a dominant market position) will typically be able to force data subjects to consent against their true wishes. In this perspective, Recital 43 GDPR highlights that if there is a "clear imbalance between the data subject and the controller" consent should not be considered a valid legal basis for the processing

Examples where asymmetries of power and bundled consent usually occur are:

• Relationships with public authorities
• Employer-employee-relationships
• Use of major digital services with limited alternatives

Recital 43 and Article 7(4) GDPR further deal with the situation of "bundled consent", i.e. when the performance of a contract is made conditional on consent, or when consent to different processing operations is bundled into one single yes/no option for the data subject. Take the case of a controller which uses a contract form in which the data subject also agrees that personal data can be sold to a third party (without this being necessary for the performance of the core contract). The individual cannot modify the form and must sign it as it is. In these cases, consent shall not be considered freely given. For further indications on the issue of bundled consent and the criteria to assess the freely given requirement, see Article 7(4) GDPR.

Informed

Consent should be sought using clear and plain language and be provided in an intelligible and easily accessible form. The information under Article 13 and 14 GDPR should therefore fully inform the data subject concerning the processing based on such consent. According to the most recent CJEU case-law, however, such information must not only be provided but also “digested” by the data subject. In particular, data subjects must be able to understand the circumstances of the processing of their personal data to estimate the consequences and implications of giving their consent. This seems to give information a more substantive and functional role. Moreover, the information has to be presented in a manner which is clearly distinguishable from other matters, like terms and conditions. For more information, see the commentary on Article 7(2) GDPR.

Specific

In accordance with the principle of transparency from Article 5(1)(b) GDPR consent must be provided for specific and legitimate purposes. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them separately. A blanket consent to all kinds of purposes is therefore not valid. For example, "I agree to the processing of my data for different business purposes" is not specific and therefore invalid.

The principle of specificity of consent (Article 4(11) GDPR) is confirmed by Article 6(1)(a) which requires consent to be given for “for one or more specific purposes”. This seems in line with the case law of the Court of Justice of the EU, according to which consent must refer to specific processing activities, clearly identified, also in order to allow the user to effectively understand the operations being carried out.

Unambiguous

Consent must be given unambiguously in the form of clear and affirmative action. This can be checking a box ("opt-in") or a button in the digital environment. Conversely, silence, pre-ticked boxes or inactivity should not constitute consent. This has been stressed through recent case law by the Court of Justice where a pre-checked checkbox which the user had to deselect in order to refuse their consent cannot show any active behaviour. Similarly, actions which are not clearly affirmative include the simple use of a webpage. A user may simply ignore that a webpage uses data in a certain way. This ambiguity extends to assigning certain actions a legal meaning through a disclaimer (e.g. "by using our webpage you agree to X"). Accordingly, it is in practice impossible to ascertain whether a user had actually given their consent by not deselecting the pre-ticked checkbox or had just not noticed the information provided. In conclusion, if a user clicks a "I agree" button or a person clearly moves into a picture that is taken, these actions are clearly unambiguous. Vice-versa, a user merely visiting a page or walking down a street that is under surveillance, does not necessarily act in an unambiguous fashion and therefore the consent may be invalid.

Withdrawal

Consent can be withdrawn at any time. Withdrawing of consent shall be as easy as it was giving it. The controller has to inform the data subject on the possibility to withdraw consent prior to the processing. For further information, see the commentary on Article 7(3) GDPR.

Capacity

Generally, consent must be given directly by the data subject or a nominated representative. In the case of minors, the ability to consent is based on the individual cognitive faculty of the data subject. In the online context, Article 8(1) GDPR provides a minimum age of 16 while member states may not reduce that age limit to below 13.

Explicit Consent

The more qualified form of ‘explicit’ consent is required within several other provisions across the GDPR. For more information check the commentary on Article 9(2)(a) GDPR, Article 22(2)(c) GDPR and Article 49(1) GDPR.

Relevant Recitals

Recital 32: Conditions for Consent

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Recital 33: Consent for Scientific Research

It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.

Recital 42: Proof and Requirements for Consent

Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

Recital 43: Freely Given Consent

In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.

(12) Personal Data Breach

A ‘personal data breach’ can be considered as any security incident regarding personal data. In this regard, the breach has to concern the processing personal data (for ‘personal data’ see Article 4(1) GDPR, for ‘processing’ Article 4(2) GDPR). Although the transmission and storage of data are explicitly highlighted, any type of processing the concerned data is sufficient.

Moreover, it requires a security breach within that processing. Such are any failures of technical or organizational safeguards implemented by the controller according to Article 32 GDPR. These failures can either be caused through targeted attacks from other parties or through mishandling of personal data through the controller or persons instructed, such as its employees. Some examples for security breaches are:

• Hacking-attacks on systems involving personal data
• Missing access protection to data storages or buildings
• Sending data to unintended recipients
• Employees unlawfully distributing data to third parties
• Accidentally publishing or leaking data on website
• Loss of physical data carriers
• Destruction of data storing infrastructure
• Unrestorable encryption through Ransomware
• Unlocked storage of employee files

As a consequence, the incident has to lead to an accidental or unlawful destruction, loss, alteration of data or the unauthorised disclosure or access thereof. In any case where personal data is disclosed, it qualifies as personal data breach through the mere possibility to access that data. Any real access to the disclosed data is not necessary.

The notion of a personal data breach becomes especially relevant in terms of notification and communication obligations for controllers to data subjects and DPAs according to Articles 33, 34 GDPR. In this regard, the EDPB can issue further guidelines, recommendations and best practices for handling personal data breaches, Article 70(1)(g)(h) GDPR.

(13) Genetic Data

‘Genetic data’ refers to data on the inherited or acquired genetic characteristics of a natural person which gives unique information about their physiology or health. Accordingly, the data must allow for clear conclusions on the growth, metabolism, appearance, diseases or alike, both already existent or entering in the future. Examples for obtaining such data are given in Recital 34 GDPR, mentioning in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analyses.

The classification as genetic data is becoming relevant in terms of Article 9(1) GDPR, that only allows its processing under strict requirements. This is due to the sensitive character of such data, that allows a unique identification of the data subject and at the same time reveals personal health data on them and biological relatives. Especially in terms of heritage diseases, genetic data therefore carries a high risk of abuse in terms of employment and insurances.

Relevant Recitals

Recital 34: Genetic Data

Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained.

(14) Biometric Data

‘Biometric data’ means data referring to the physical, physiological and behavioural characteristics of a natural person obtained from specific technical processing allowing for an unique identification. While this generally includes any means to analyse and measure the characteristics of humans the technical processing and unique identification requirements place higher burdens.

The definition itself gives facial images and fingerprints as examples for biometric data. However, the requirement for specific technical processing, ensures that simple pictures or even passport photographs shall not be considered as such. It is the further processing through the application of facial recognition software, that qualifies the extracted information as biometric data. In this regard, also IRIS Scanners, DNS-Comparisons, voice or gait pattern analyses, as well as typing patterns or even handwritten signatures may be considered as biometric data.

Other data, that does not allow an unique identification, such as the body size or blood type, may not be considered biometric data. However, these could then fall under the definition of ‘health data’ that offers similar protection like for biometric data, according to Article 9(1) GDPR.

Relevant Recitals

Recital 51: Protection of Sensitive Personal Data

Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Those personal data should include personal data revealing racial or ethnic origin, whereby the use of the term ‘racial origin’ in this Regulation does not imply an acceptance by the Union of theories which attempt to determine the existence of separate human races. The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. Such personal data should not be processed, unless processing is allowed in specific cases set out in this Regulation, taking into account that Member States law may lay down specific provisions on data protection in order to adapt the application of the rules of this Regulation for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.

(15) Data Concerning Health

‘Data concerning health’, or simply ‘health data’, means any data related to the physical or mental health of a natural person, especially the procurement of health care services revealing such information. According to Recital 35 GDPR, these include all data referring to the health status of the data subject from the past, current or future. In this regard, any information on diseases, risks, disabilities, their treatment and medical histories of a particular natural person explicitly qualify as health data.

Examples for health data are information about:

• Addictions to alcohol, drugs or medications as well as the participation in self-help groups
• Hospitalizations, sick notes and sick payments
• Information the physical or mental invalidity to work
• Data from health- or fitness apps on eating or movement patterns, for example from wearables and smartphones

The notion of health data is therefore broader than ‘medicinal data’. Furthermore, it strongly overlaps with the notions of genetic and biometric data. in order to allow a seamless high protection within the scope of Article 9 GDPR. For further information, check the commentary on Article 9 GDPR.

Relevant Recitals

Recital 35: Health Data

Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for, or the provision of, health care services as referred to in Directive 2011/24/EU of the European Parliament and of the Council to that natural person; a number, symbol or particular assigned to a natural person to uniquely identify the natural person for health purposes; information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device or an in vitro diagnostic test.

Recital 54: Processing of Health Data for Reasons of Public Interest

The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject. Such processing should be subject to suitable and specific measures so as to protect the rights and freedoms of natural persons. In that context, ‘public health’ should be interpreted as defined in Regulation (EC) No 1338/2008 of the European Parliament and of the Council, namely all elements related to health, namely health status, including morbidity and disability, the determinants having an effect on that health status, health care needs, resources allocated to health care, the provision of, and universal access to, health care as well as health care expenditure and financing, and the causes of mortality. Such processing of data concerning health for reasons of public interest should not result in personal data being processed for other purposes by third parties such as employers or insurance and banking companies.

(16) Main Establishment

If a controller or a processor have establishments in more than one member states, identifying its ‘main establishment’ is the first step to recognize the lead supervisory authority in a cross-border procedure.

It is the role of a data protection authorities to properly define the main establishment of an entity according to objective criteria and subsequently determine the corresponding lead authority. The burden of proof falls on controllers and processors to demonstrate to the relevant supervisory authorities where the relevant processing decisions are taken and implemented. In this regard, however, the Working Party 29 stressed that the GDPR does not permit ‘forum shopping’ and conclusions cannot be based solely on statements by the organisation under review: The supervisory authorities can rebut the controller’s analysis based on an objective examination of the relevant facts, requesting further information where required.

Main Establishment of a Controller

As a general rule, the main establishment of a controller should be the place of its central administration in the Union, or in other words, “the place where decisions about the purposes and means of the processing of personal data are taken and this place has the power to have such decisions implemented”.

Recital 22 GDPR defines an establishment as "the effective and real exercise of activity through stable arrangements". The legal form of such arrangements is irrelevant. According to the CJEU, an establishment depends on “both the degree of stability of the arrangements and the effective exercise of activities in that other Member State must be interpreted in the light of the specific nature of the economic activities and the provision of services concerned.” In this regard, already the presence of a single representative can constitute a stable arrangement when acting with a sufficient degree of stability and the necessary equipment to provide the specific services in the member states concerned.

If a controller’s main establishment is not the place of its central administration in the EU, it is necessary to determine the establishment based on where the effective and real exercise of main decisions on the purposes and means of processing take place. It should depend neither on the place of the processing nor the use of technical means and technologies for processing personal data or processing activities. Instead, to determine the controller’s main establishment the Working Party 29 developed several guiding questions:

• Where are decisions about the purposes and means of the finally signed off’?
• Where are decisions about business activities that involve data processing made?
• Where does the power to have decisions implemented effectively lie?
• Where is the Director with responsibility for cross border processing located?
• Where is the controller or processor registered as a company?

A supervisory authority may require from a controller to present additional information proving that its main establishment fulfils criteria envisaged in the GDPR.

Main Establishment of a Processor

Similarly to the rules for controllers, the main establishment of a processor located in multiple member states shall also be the place of its central administration.

However, when there is no central administration in the Union, the rules applying to processors are formulated differently. In such cases, the main establishment of a processor is where the main processing activities take place in a Union’s establishment subject to the obligations under GDPR. This implies that the processing of personal data does not need to be carried out by the relevant establishment itself but only in in the context of its activities within the scope of the GDPR. The meaning of ‘the context of activities’ has already been specified by the CJEU, building on a broad definition of ‘establishment’ and clarifying that already the intention of a member state’s establishment to provide advertisement space for a third country undertaking is processing of personal data in the context of the Union’s establishment.

Following up on the CJEU judgement, the Working Party 29 specified that EU law may apply to data processing activities of controllers or processors established outside the EU “even if the local establishment is not actually taking any role in the data processing itself”. This reasoning can be based on an “inextricable link” between activities of an establishment in the EU and data processing by a non-EU controller or processor.

Cases Involving Both the Controller and the Processor

Recital 36 GDPR explains that “in cases involving both the controller and the processor, the competent lead supervisory authority should remain the supervisory authority of the Member State where the controller has its main establishment”. For further information determining the lead and concerned supervisory authorities in cross border contexts involving both the controller and the processor see the commentary on Article 56 GDPR and Article 4(22)-(23) GDPR.

Relevant Recitals

Recital 22: Processing Activities by an Establishment

Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

Recital 36: Determination of the Main Establishment

The main establishment of a controller in the Union should be the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union, in which case that other establishment should be considered to be the main establishment. The main establishment of a controller in the Union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing through stable arrangements. That criterion should not depend on whether the processing of personal data is carried out at that location. The presence and use of technical means and technologies for processing personal data or processing activities do not, in themselves, constitute a main establishment and are therefore not determining criteria for a main establishment. The main establishment of the processor should be the place of its central administration in the Union or, if it has no central administration in the Union, the place where the main processing activities take place in the Union. In cases involving both the controller and the processor, the competent lead supervisory authority should remain the supervisory authority of the Member State where the controller has its main establishment, but the supervisory authority of the processor should be considered to be a supervisory authority concerned and that supervisory authority should participate in the cooperation procedure provided for by this Regulation. In any case, the supervisory authorities of the Member State or Member States where the processor has one or more establishments should not be considered to be supervisory authorities concerned where the draft decision concerns only the controller. Where the processing is carried out by a group of undertakings, the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings, except where the purposes and means of processing are determined by another undertaking.

(17) Representative

Representative are any legal or natural persons established in the union designated by a controller or processor, in accordance with Article 27 GDPR. They are not to be confused with the executive organ of the controller, but they serve as contact persons for data subjects and DPAs towards controllers and processors that are only located outside the Union.

In this regard, the notion of a representative becomes relevant in terms of actors that are falling within the territorial scope of the GDPR without having any establishment within the union (see Article 3(2) GDPR and Recital 80 GDPR). In such cases, the representative becomes the addressee of enforcement proceedings in the event of non-compliance of the respective controller or processor. This way, the representative prevents such actors only established in a third country to become “infeasible” for data subjects and DPA’s within the union. Examples for representatives may therefore be designated employees, lawyers or whole firms established within the union.

The designation shall happen in a written form, containing the a mandate to represent the controller or processor under the obligations from the GDPR. At the same time. the designation of a representative does not exclude the responsibility or liability of the controller or processor themselves. However, it remains unclear how entities not providing a representative may be tackled by the GDPR. This goes especially for public authorities that are excluded from the designation of a representative.

Relevant Recitals

Recital 80: Designated Representative

Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union, the controller or the processor should designate a representative, unless the processing is occasional, does not include processing, on a large scale, of special categories of personal data or the processing of personal data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing or if the controller is a public authority or body. The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority. The representative should be explicitly designated by a written mandate of the controller or of the processor to act on its behalf with regard to its obligations under this Regulation. The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation. Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation. The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.

(18) Enterprise

An enterprise’ means any natural or legal person, partnerships or associations regularly engaged in economic activities. With this definition, the GDPR introduced a broad concept of the enterprise, irrespective of their size, legal form or interests pursued.

An enterprise requires a regular engagement in economic activities, which means activities intended for a long-term and not only in an occasional manner. Excluded from such activities are completely familiarly or personal activities as part of the household exception, see the commentary on Article 2(c) GDPR.

While the English version of the GDPR distinguishes between the ‘enterprise’ and ‘undertaking’ the translation to other languages merged both into a single notion. This can cause controversy around the assessment of fines according to Article 83 GDPR, which by English language refers to the term of undertaking in accordance with Articles 101, 102 TFEU and thereby not to the definition of Article 4(18) GDPR. In any case, however, the notion is to be understood broadly when enforcing actions or determining fines on a particular entity, see the commentary on Article 83 GDPR.

Relevant Recitals

Recital 13: Harmonisation of Protection and Advantages for Small and Medium-Sized Enterprises

In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including micro, small and medium-sized enterprises, and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. The proper functioning of the internal market requires that the free movement of personal data within the Union is not restricted or prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC.

(19) Group of Undertakings

A group of undertakings consists of a leading (“controlling”) entity and one or more thereof dependent (“controlled”) entities. The central characteristic for a group of undertakings is therefore, that one entity exerts a dominant influence over the others, for example through ownership or financial participation. This is usually the case between a holding company and their subsidiaries.

In this regard, the mere possibility of exercising control over the the other entity is sufficient, a real exercise of such control is not necessary. As long as one entity has the factual power to assert its will over the other entities, they qualify as group of undertakings.

Already two undertakings are sufficient to form a group. However, a controller giving mere instructions to a processor regarding the processing of personal data does not qualify as a group of undertakings.

The classification as a group of undertakings becomes relevant for several provision across the GDPR, such as

• The joint designation of a Data Protection Officer (Article 37(2) GDPR),
• The formulation of binding corporate rules (Article 4(20) GDPR, Article 47 GDPR),
• The data transfer for internal administrative purposes (Article 6(1)(f) GDPR) with Recital 48 GDPR)
• The determination of the main establishment (Article 4(16) GDPR, Recital 22 GDPR).

However, the notion is to be distinguished from a ‘group of enterprises engaged in a joint economic activity’ also used throughout several provisions across the GDPR. These consist of separate and independent entities, which do not exercise control over each other and therefore cannot designate a single Data Protection Officer or rely on internal administrative data transfers.

Relevant Recitals

Recital 37: Group of Undertakings Controllership

A group of undertakings should cover a controlling undertaking and its controlled undertakings, whereby the controlling undertaking should be the undertaking which can exert a dominant influence over the other undertakings by virtue, for example, of ownership, financial participation or the rules which govern it or the power to have personal data protection rules implemented. An undertaking which controls the processing of personal data in undertakings affiliated to it should be regarded, together with those undertakings, as a group of undertakings.

Recital 48: Data Transfers Within a Group of Undertakings

Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.

(20) Binding Corporate Rules

Binding corporate rules (short ‘BCR’) are ‘personal data protection policies’ formulated by controllers or processors established on the union for transfers of personal data outside the union within their group. In this regard, binding corporate rules constitute a legal basis to transfer personal data to third countries without an adequacy decision. However, they only serve for for intra-corporate transfers, i.e. between entities of the concerned group of undertakings or enterprises. Transfers to entities outside of these groups are not covered by binding corporate rules.

Furthermore, there are additional requirements regarding the content of such rules. According to Recital 110 GDPR, BCR must include all essential principles and enforceable rights to ensure appropriate safeguards for transfers or categories of transfers of personal data. The rules are therefore to be previously approved by the national DPA concerned. Furthermore, the Commission may specify the format and procedures for the exchange of information for these rules. For more information on the requirements and the approval procedure of binding corporate rules, see the commentary on Article 47 GDPR.

Relevant Recitals

Recital 110: Binding Corporate Rules

A group of undertakings, or a group of enterprises engaged in a joint economic activity, should be able to make use of approved binding corporate rules for its international transfers from the Union to organisations within the same group of undertakings, or group of enterprises engaged in a joint economic activity, provided that such corporate rules include all essential principles and enforceable rights to ensure appropriate safeguards for transfers or categories of transfers of personal data.

(21) Supervisory Authority

Supervisory Authorities or ‘Data Protection Authorities’ (DPAs) are independent public authorities responsible for monitoring the application of the GDPR. The idea is, that such authorities protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union.

Member states can decide to provide only one or multiple DPAs, to reflect their constitutional, organisational and administrative structure. In this regard, DPAs must be public authorities established on the national level. And while each supervisory authority should be competent on the territory of its own member state, they shall cooperate, mutually assisting each other and conduct joint operations with to foster a consistent application of the GDPR in cross border contexts (see Articles 60-63 GDPR and Recital 123 GDPR).

In this regard, DPAs may act independent (see Article 52 GDPR) and shall be provided with several competencies (Articles 55, 56 GDPR), Tasks (Article 57 GDPR) and Powers (Article 58 GDPR). For further information, see the particular commentary on these articles.

Relevant Recitals

Recital 117: Establishment of Independent Supervisory Authorities

The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 122: Competence of Supervisory Authorities

Each supervisory authority should be competent on the territory of its own Member State to exercise the powers and to perform the tasks conferred on it in accordance with this Regulation. This should cover in particular the processing in the context of the activities of an establishment of the controller or processor on the territory of its own Member State, the processing of personal data carried out by public authorities or private bodies acting in the public interest, processing affecting data subjects on its territory or processing carried out by a controller or processor not established in the Union when targeting data subjects residing on its territory. This should include handling complaints lodged by a data subject, conducting investigations on the application of this Regulation and promoting public awareness of the risks, rules, safeguards and rights in relation to the processing of personal data.

Recital 123: Cooperation Amongst Supervisory Authorities and with the Commission

The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application throughout the Union, in order to protect natural persons in relation to the processing of their personal data and to facilitate the free flow of personal data within the internal market. For that purpose, the supervisory authorities should cooperate with each other and with the Commission, without the need for any agreement between Member States on the provision of mutual assistance or on such cooperation.

(22) Supervisory authority concerned

Qualifying a supervisory authority as ‘concerned’ can result out of three situations as laid out by Article 4(22) GDPR:

• For a controller or processor, when it is established in a member state of a supervisory authority,
• for a data subject, when it is residing in the member state of a supervisory authority (likely) substantially affected by the processing of personal data, or
• where a complaint has been lodged with that supervisory authority.

Controller or Processor Establishment

The DPA is concerned when a controller or processor is established in its jurisdiction. This implies any effective and real exercise of activity through stable arrangements, independent of the form of such arrangements of an actual branch or subsidiary within the union. This broad understanding is fostered by the EUCJ, including any real and effective activity exercised through stable agreements independently of their formalistic approach as an establishment.

(Likely) Substantially Affection of the Data Subject

A substantial affection, although not being further specified from the GDPR, indicates that that the processing requires a meaningful impact of at least considerable magnitude on the data subject. On the contrary, already the likelihood of such is sufficient, an actual affection is therefore not required. However, the substantial affection and the likelihood thereof is decided by the DPA on a case to case basis. In any case, this requires the data subject to reside in the member state of the DPA and therefore to have at least stable links to the state as its permanent habitual center.

Filing a Complaint with the Supervisory Authority

Filing a complaint with a particular supervisory authority makes them ‘concerned’ authority. Since complaints can also be filed with DPAs different from where the data subject resides, the supervisory authority can possibly be concerned without the data subject having a residence within the EU or any (likely) substantial affection. For further information on filing a complaint with a supervisory authority, see the commentary on Article 77 GDPR.

Relevant Recitals

Recital 124: Lead Supervisory Authority and Cooperation

Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and the controller or processor is established in more than one Member State, or where processing taking place in the context of the activities of a single establishment of a controller or processor in the Union substantially affects or is likely to substantially affect data subjects in more than one Member State, the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority. It should cooperate with the other authorities concerned, because the controller or processor has an establishment on the territory of their Member State, because data subjects residing on their territory are substantially affected, or because a complaint has been lodged with them. Also where a data subject not residing in that Member State has lodged a complaint, the supervisory authority with which such complaint has been lodged should also be a supervisory authority concerned. Within its tasks to issue guidelines on any question covering the application of this Regulation, the Board should be able to issue guidelines in particular on the criteria to be taken into account in order to ascertain whether the processing in question substantially affects data subjects in more than one Member State and on what constitutes a relevant and reasoned objection.

(23) Cross-Border Processing

Cross border processing means any processing taking place (i) in the in the context of the activities of establishments of a controller or processor in multiple member states, or (ii) in the context of a single establishment of a controller or processor in the union with (likely) substantially affects to data subjects in more than one member state.

Both conditions are therefore attached to the notion of ‘establishment’, whereas (i) requires the controller or processor to have multiple establishments within different member states of the union, while (ii) only requires the controller or processor to have an establishment within a single member state of the union. In both cases, however, the controller or processor needs to be established in at least one member state.

Processing in the Context of Establishments within Multiple Member States

The notion of establishment is again to be interpreted broadly. It is any effective and real exercise of activities through stable arrangements, independent of the formal declarations as a branch or subsidiary within the union. Furthermore, the processing is not required to be carried out within the establishment itself, but can also happen in the context of its activities. If the establishment in the EU is not directly processing the personal data, an extricable link between the activities of the establishment and the processing is already sufficient. Only remote links to the processing in question may not involve another entity and therefore not form a ‘cross border processing’.

Processing (likely) to Substantially Affect Data Subject in Multiple Member States

A substantial affection, again indicates that that the processing requires a meaningful impact of at least considerable magnitude on the data subject. In this regard, already the likelihood of such is sufficient, an actual affection is therefore not required. However, the substantial affection and the likelihood thereof is decided by the DPA on a case to case basis.

The evaluation of across border processing is relevant for determining the competent lead supervisory authority in situations where the processing would concern such of multiple member states. In this regard, it contributes to the ‘one-stop-shop’-principle, which is further described within the commentary of Article 56 GDPR.

Relevant Recitals

Recital 22: Processing Activities by an Establishment

Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

Recital 124: Lead Supervisory Authority and Cooperation

Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and the controller or processor is established in more than one Member State, or where processing taking place in the context of the activities of a single establishment of a controller or processor in the Union substantially affects or is likely to substantially affect data subjects in more than one Member State, the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority. It should cooperate with the other authorities concerned, because the controller or processor has an establishment on the territory of their Member State, because data subjects residing on their territory are substantially affected, or because a complaint has been lodged with them. Also where a data subject not residing in that Member State has lodged a complaint, the supervisory authority with which such complaint has been lodged should also be a supervisory authority concerned. Within its tasks to issue guidelines on any question covering the application of this Regulation, the Board should be able to issue guidelines in particular on the criteria to be taken into account in order to ascertain whether the processing in question substantially affects data subjects in more than one Member State and on what constitutes a relevant and reasoned objection.

(24) Relevant and Reasoned Objection

The ‘relevant and reasoned objection’ refers to situations, in which a supervisory authority concerned objects to a decision draft provided by a lead supervisory authority in terms of a cross-border-processing context. When such objection is exercised by the supervisory authorities concerned, the lead supervisory authority can either follow the objection or submit the matter to the EDPB (see Article 60(4) GDPR, Article 65(4) GDPR).

In order to not overload the EDPB with insufficiently grounded submissions causing delays for decisions, Article 4(24) GDPR introduces a threshold to such objections being ‘relevant’ and ‘reasoned’. In this regard, they have to show an infringement or compliance of the GDPR in opposition to the lead authorities decision draft clearly demonstrating the significance of the risks posed by the draft decision.

An objection is therefore only relevant and reasoned, when it refers to the concrete draft of a decision and does not only contain concerns of general nature. This requires to provide the exact legal reasons for the objection, clearly stating the the non-negligible risks for the data subjects or the free flow of personal data entailed.

The notion of relevant and reasoned objection is to be further developed by the EDPB. For further information on the EDPB’s criteria and procedure on elaborating a relevant and reasoned objection, check the commentary on Articles 60, 65 GDPR.

Relevant Recitals

Recital 124: Lead Supervisory Authority and Cooperation

Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and the controller or processor is established in more than one Member State, or where processing taking place in the context of the activities of a single establishment of a controller or processor in the Union substantially affects or is likely to substantially affect data subjects in more than one Member State, the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority. It should cooperate with the other authorities concerned, because the controller or processor has an establishment on the territory of their Member State, because data subjects residing on their territory are substantially affected, or because a complaint has been lodged with them. Also where a data subject not residing in that Member State has lodged a complaint, the supervisory authority with which such complaint has been lodged should also be a supervisory authority concerned. Within its tasks to issue guidelines on any question covering the application of this Regulation, the Board should be able to issue guidelines in particular on the criteria to be taken into account in order to ascertain whether the processing in question substantially affects data subjects in more than one Member State and on what constitutes a relevant and reasoned objection.

(25) Information Society Service

For the definition on ‘information society service’ the GDPR refers to Article 1(1)(b) of Directive (EU) 2015/1535, on a procedure for the provision of information in the field of technical regulations and of rules on Information Society services. Hereafter, such services are any “normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient”.

‘At a distance’ means that the service is provided without the parties being simultaneously present. Thus, even when using electronic means, services provided within the physical presence of the recipient to the provider are not falling within this definition.

‘By electronic means’ requires, that the service is entirely sent and received via electronic equipment for the processing and storage of data, for example through being transmitted by wire, radio, optical or other electromagnetic means. And while offline services are excluded from these services, composite services such as the selling of goods, advertising and gaming do qualify as such.

An ‘individual request of a recipient of services’ means that the service is provided through the transmission of data on individual request. Services transmitting data to an unlimited number of individuals without their individual demand, such as radio broadcasting, television, teletext, are therefore not covered. On the contrary, video-on-demand or pay-per-view services do qualify as information society services.

Accordingly, most online services encountered nowadays fulfil the criteria of an information society service. Typical example are:

• Online legal or health services
• Online libraries or newspapers
• Online shopping and booking services
• Online media-platforms or video games
• Online search engines and web browsers

The classification as information society service becomes relevant in several contexts of the GDPR, such as its material scope (see Article 2(4) GDPR), children’s consent (see Article 8(1) GDPR), the right to erasure (see Article 17(1)(f) GDPR) or the right to object (see Article 21(5) GDPR). For further information in this context, see the commentary in the relevant provisions.

Relevant Recitals

Recital 21: Application without Prejudice to the Application of Directive 2000/31/EC

This Regulation is without prejudice to the application of Directive 2000/31/EC of the European Parliament and of the Council, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. That Directive seeks to contribute to the proper functioning of the internal market by ensuring the free movement of information society services between Member States.

(26) International Organisation

An ‘international organisation’ means any organisation or subordinate bodies of such, which are governed either by public international law or set up by an agreement between two or more countries.

While there is no universally accepted or further specified definition of the term coming from the GDPR, the overall definition from the Vienna Convention on the Law of Treaties from 1969 serves as a source of inspiration for interpreting EU law according to the CJEU. However, Article 2(1)(i) of the Convention defines international organisation as ‘intergovernmental organization’, thereby failing to deliver a more specific definition. Moreover, since both options to reach an international organization, either through public international law or multilateral agreements, are not further delineated by the GDPR, a broad and flexible approach to the term is suggested.

In this regard, most organizations, such as the United Nations (UN), the International Telecommunications Union (ITU), the World Trade Organization (WTO as well as Inter- and Europol shall fall under the term. However, these examples are not exhaustive and can be infinitely extended to other Internationals Organizations. Only NGO’s, which are usually non-governmental organisations established as private initiatives and governed by domestic member state law, may not qualify as such.

The classification as international organization is relevant in terms of the additional rules placed on data transfers, according to Articles 44-50 GDPR. While the Data Protection Directive only regulated data flows to third party countries, the GDPR now extends the applicability of these rules to international organizations as as well. For more information on the principles and additional safeguards placed on such transfers see the commentary on Articles 45-49 GDPR.

Further Definitions

Article 4 GDPR is not the only provision defining relevant terms for the GDPR. The regulation contains further articles that directly or indirectly deliver definitions in its context, such as:

• Article 5(1)(a) GDPR: ‘lawfulness, fairness and transparency’,
• Article 5(1)(b) GDPR: ‘purpose limitation’,
• Article 5(1)(c) GDPR: ‘data minimisation’,
• Article 5(1)(d) GDPR: ‘accuracy’,
• Article 5(1)(e) GDPR: 'storage limitation’,
• Article 5(1)(f) GDPR: ‘integrity and confidentiality’,
• Article 5(2) GDPR: ‘accountability’,
• Article 8 GDPR: ‘child’,
• Article 9 GDPR: ‘special categories of personal data’,
• Article 51 GDPR: ‘supervisory authority’,
• Article 68 GDPR: ‘European Data Protection Board’.

For further information check the commentary on the respective Articles.

Decisions

→ You can find all related decisions in Category:Article 4 GDPR