Article 3 GDPR
|← Article 3: Territorial scope →|
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
- (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
- (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
Applies to processing in the context of the activities of entities established in the Union, regardless of processing location (Article 3(1))
The GDPR does not define the term "establishment". Recital 22 states that
“[e]stablishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect”.
This very closely resembles the CJEU - C-230/14 - Weltimmo case, according to which an establishment extends “to any real and effective activity — even a minimal one — exercised through stable arrangements”. In its guidelines, the EDPB reminded that the wording was not new as it was identical to Recital 19 of Directive 95/46/EC. It also pointed out that although the threshold for “stable arrangement” is quite low in the context of online activities and that the notion of “establishment” is broad, it cannot lead to the conclusion that a “non-EU entity has an establishment in the Union merely because the undertaking’s website is accessible in the Union”.
The meaning of “in the context of the activities” has to be interpreted broadly, as confirmed by judgments of the CJEU:
In CJEU - C-131/12 - Google Spain the Court determined with regard to Directive 95/46/EC that the activity of a search engine is to be classified as “processing of personal data”. It found that
“inasmuch as the data processing carried out in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites and affects the data subject’s fundamental rights additionally, the operator of the search engine as the controller in respect of that processing must ensure, within the framework of its responsibilities, powers and capabilities, that that processing meets the requirements of Directive 95/46, in order that the guarantees laid down by the directive may have full effect”.
The Court explained that both terms “processing” and “controller” must be interpreted broadly as to not "largely deprive the Directive of its effect” and "to ensure effective and complete protection of data subjects”.
In CJEU - C-210/16 - Wirtschaftsakademie Schleswig-Holstein, the Court stated with regard to Directive 95/46/EC that processing carried out in the context of the activities of the controller’s establishment “cannot be interpreted restrictively” and that processing “does not require that such processing be carried out ‘by’ the establishment concerned itself, but only that it be carried out ‘in the context of the activities of’ the establishment”.
At the same time, the EDPB has stated that the requirement "should not be interpreted too broadly to conclude that the existence of any presence in the EU with even the remotest links to the data processing activities of a non-EU entity will be sufficient to bring this processing within the scope of EU data protection law". The EDPB suggests that (i) the relationship between a data controller or processor outside the Union and its local establishment in the Union and (ii) revenue raising in the Union by a local establishment may help in determining whether processing by a non-EU entity occurs in the context of its establishment in the Union.
The location of the processing itself is irrelevant to determine the geographical scope of Article 3(1). As explained by the EDPB, geographical location is only relevant to answer whether a controller or processor is established inside or outside the Union and whether a non-EU controller or processor has an establishment in the Union.
Targeting the Union market (Article 3(2))
If the controller or the processor is not established in the Union, the GDPR can be triggered if personal data of data subjects located in the Union is being processed. In light of Recital 14 and as supoorted by the EDPB guidelines, the targeting criterion is neither limited by residence nor nationality, but covers any natural person located in the Union to the extent that they are subject to processing as described in Article 3(2)(a) and (b).
(a) Offering of goods or services
The concept of "goods and services" has been clarified in EU law (such as Directive 2006/123/EC on services in the internal market) and case law, inter alia on the interpretation of Articles 28 to 37 and 56 to 62 TFEU.
“Goods” are products which can be valued in money and which are capable, as such, of forming the subject of commercial and lawful transactions.
“Services” are activities agreed upon by the provider and the recipient in exchange for, typically, remuneration. In addition, the service provider must be independent and pursue its activity on a stable and continuous basis. This definition includes “any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services”, as also supported by the EDPB.
The processing is covered "irrespective of whether a payment of the data subject is required".
(b) The monitoring of data subjects' behaviour
Processing related to the monitoring of the behaviour of data subject is not defined in the GDPR. Recital 24 clarifies that
“[i]n order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.”
(3) The public international law criterion
The GDPR applies to the processing of personal data by a controller not established in the Union if the Member State’s legislation applies by virtue of public international law.
Recital 25 gives the example of processing taking place in a “Member State’s diplomatic mission or consular post”. The EDPB gives as a further example the case of a German cruiseship traveling in international waters. By virtue of public international law, the GDPR will apply even though the ship is in international waters.
→ You can find all related decisions in Category:Article 3 GDPR
- C-230/14, Weltimmo, 1 October 2015, paragraph 31.
- EDPB guidelines 3/2018on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p.8.
- C‑191/15, Verein für Konsumenteninformation v. Amazon EU Sarl, 28 July 2016, paragraph 76.
- C-131/12, Google Spain, 13 May 2014, paragraph 83.
- C-131/12, Google Spain, 13 May 2014, paragraph 30.
- C-131/12, Google Spain, 13 May 2014, paragraph 34.
- C-230/14,Weltimmo, 1 October 2015, paragraph 25.
- C-210/16, Wirtschaftsakademie, 5 June 2018, paragraph 56.
- C-210/16, Wirtschaftsakademie, 5 June 2018, paragraph 57.
- EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 7.
- EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 8.
- EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 10.
- EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p. 14.
- Eg: C-7/68 European Commission v. Italy, 10 December 1968; C-50/80 Horvath, 5 February 1981; C-421/09 Humanplasma, 9 December 2010.
- Eg C-263/86 Humbel, 27 September 1988.
- Eg. C-55/94 Gebhard, 20 November 1995.
- Article 1(1)(b) of Directive 2015/1535/EU.
- EDPB guidelines 3/2018 on the territorial scope of the GDPR, Version 2.1, 12 November 2019, p.16 referring to Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services.
- EDPB, guidelines 3/2018 on the territorial scope of the GDPR, versions 2.1., 12 Novembre 2019, p. 23.