Territorial scope of the GDPR

Answer:

The extraterritorial reach of the GDPR is one of the new features that contribute significantly to the increased level of protection of personal data. What does extraterritorial mean? Probably one of the most important changes, the GDPR enjoys extended applicability affecting entities not established in the EU. Of course, some conditions must be met for the extraterritoriality to be applicable. The EU GDPR applies to the processing of personal data of EU data subjects, regardless of whether the processing activities take place in the EU or not. The EU GDPR is also applicable to entities established outside the EU if they offer goods or ser vices to individuals in the Union, or if they monitor the behavior of individuals in the Union (i.e., profiling activities, tracking individuals’ activities on the internet, etc.).

The key to understanding when EU GDPR is applicable is understanding the meaning of “in the Union.” The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant. For example, a company based in the EU which is processing the data of Japanese individuals located in Japan will still need to comply with the EU GDPR. Consequently, the Japanese individuals will be benefiting from all rights according to the EU GDPR, even if these rights do not exist in their own nation’s laws.

When the data of EU citizens is processed outside of the EU by companies which are also outside the EU, then this is not considered to be “in the Union”. For example, the EU GDPR will not be applicable for a school which is based in the United States just because there is a possibility that one or several of its students would be EU citizens. In this case, the processing does not take place “in the Union,” nor is the individual “in the Union”.

One of the consequences of the extraterritorial reach is that companies not established in the EU must appoint a representative. That representative must be based in a Member State in which the relevant data subjects are based. Only a limited derogation is permitted where the processing is occasional, does not involve large-scale processing of sensitive personal data, and the purpose and result of the processing is unlikely to be a risk to individuals.

If you want to find out more about the EU GDPR check out this free EU GDPR Foundation Course (https://advisera.com/training/eu-gdpr-foundations-course//).