CIPP/E - TERRITORIAL AND
MATERIAL SCOPE OF THE GDPR -
CHAPTER 5 100% ACCURATE
The Regulation applies Territorial Scope:
1) To EU established organisations
2) on a long arm extraterritorial basis to organisations which offer to sell goods or
services or who monitor individuals in the EU. - ANSWERHow is Territorial Scope
applied in the Regulation?
Article 3(1) of the GDPR provides that it:
applies to the processing of personal data in the context of the activities of the
establishment of a controller or a processor in the Union, regardless of whether the
processing takes place in the Union or not. - ANSWERHow is the concept of
'establishment' introduced in Article 3(1) of the Regulation?
There is no definition of 'establishment' in the Regulation; however Recital 22 gives the
term a broad meaning:
establishment implies the effective and real exercise of activity through stable
arrangements. The legal form of such arrangements, whether through a branch or a
subsidiary with a legal personality, is not the determining factor in that respect. -
ANSWERWhat is the definition of establishment?
The test is met when there is an inextricable link between the activities of an EU
establishment and the processing of data carried out by a non-EU controller. -
ANSWERWhat is the test of 'in the context of activities' that would make the Regulation
apply?
Article 3(2) provides that the Regulation:
applies to the processing of personal data of the data subjects who are in the Union by
a controller or a processor not established in the Union, where the processing activities
are related to:
1. the offering of goods or services, irrespective of whether a payment of the data
subject is required, to such data subjects in the Union; or
2) the monitoring of their behaviour as far as their behaviour takes place in the Union. -
ANSWERWhat does Article 3(2) say about non-EU 'established' organisations?
Recital 23 provides that, in determining whether an organisation is offering good or
services to data subjects who are in the EU, it should be ascertained whether it is
'apparent that the controller or processor envisages offering services to data subjects in
one or more Member States of the Union'. - ANSWERWhat does Recital 23 of the
Regulation provide with respect to Territorial Scope?
MATERIAL SCOPE OF THE GDPR -
CHAPTER 5 100% ACCURATE
The Regulation applies Territorial Scope:
1) To EU established organisations
2) on a long arm extraterritorial basis to organisations which offer to sell goods or
services or who monitor individuals in the EU. - ANSWERHow is Territorial Scope
applied in the Regulation?
Article 3(1) of the GDPR provides that it:
applies to the processing of personal data in the context of the activities of the
establishment of a controller or a processor in the Union, regardless of whether the
processing takes place in the Union or not. - ANSWERHow is the concept of
'establishment' introduced in Article 3(1) of the Regulation?
There is no definition of 'establishment' in the Regulation; however Recital 22 gives the
term a broad meaning:
establishment implies the effective and real exercise of activity through stable
arrangements. The legal form of such arrangements, whether through a branch or a
subsidiary with a legal personality, is not the determining factor in that respect. -
ANSWERWhat is the definition of establishment?
The test is met when there is an inextricable link between the activities of an EU
establishment and the processing of data carried out by a non-EU controller. -
ANSWERWhat is the test of 'in the context of activities' that would make the Regulation
apply?
Article 3(2) provides that the Regulation:
applies to the processing of personal data of the data subjects who are in the Union by
a controller or a processor not established in the Union, where the processing activities
are related to:
1. the offering of goods or services, irrespective of whether a payment of the data
subject is required, to such data subjects in the Union; or
2) the monitoring of their behaviour as far as their behaviour takes place in the Union. -
ANSWERWhat does Article 3(2) say about non-EU 'established' organisations?
Recital 23 provides that, in determining whether an organisation is offering good or
services to data subjects who are in the EU, it should be ascertained whether it is
'apparent that the controller or processor envisages offering services to data subjects in
one or more Member States of the Union'. - ANSWERWhat does Recital 23 of the
Regulation provide with respect to Territorial Scope?
