Shedding some light on the territorial scope of the GDPR

Before the publication of these guidelines, much has been speculated and argued in and outside of the European Union (EU) regarding the effect of the GDPR and whether or not third countries would have to follow the rules set out in the Regulation. Nevertheless, many companies established in third countries dealing with the EU were unsure how to proceed. Although especially questions regarding enforcement actions and obligations in third countries remained unanswered, the bottom line drawn by most privacy professionals was that third-country controllers and processors with strong links to the EU should comply with the GDPR.

The newly published and long-awaited guidelines will now shed some light on the many questions asked by privacy professionals with regard to issues arising out of the GDPR. With the release of the guidelines, the EDPB in particular intends to clarify the territorial scope of the GDPR to ensure a common interpretation. While national enforcement in countries outside the EU remains a matter for those national laws, among other issues addressed, the guidelines do provide clarification on issues around:

• the application of the establishment criterion in the context of controllers and processors established outside the EU;
• the application of the targeting criterion in the context of controllers and processors established outside the EU;
• the processing in a place where Member State law applies by virtue of public international law; and
• the requirement for third country controllers or processors to designate an EU representative.

Click here for the full text of the guidelines.