Navegaci贸n
RGPD > Art铆culo聽3. 脕mbito territorial
Descargar PDF

Art铆culo聽3 RGPD. 脕mbito territorial

Article 3 GDPR. Territorial scope

1. El presente Reglamento se aplica al tratamiento de datos personales en el contexto de las actividades de un establecimiento del responsable o del encargado en la Uni贸n, independientemente de que el tratamiento tenga lugar en la Uni贸n o no.

1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

Ley de Directrices y caso Considerandos

(22) Todo tratamiento de datos personales en el contexto de las actividades de un establecimiento de un responsable o un encargado del tratamiento en la Uni贸n debe llevarse a cabo de conformidad con el presente Reglamento, independientemente de que el tratamiento tenga lugar en la Uni贸n. Un establecimiento implica el ejercicio de manera efectiva y real de una actividad a trav茅s de modalidades estables. La forma jur铆dica que revistan tales modalidades, ya sea una sucursal o una filial con personalidad jur铆dica, no es el factor determinante al respecto.

(22) Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

(14) La protecci贸n otorgada por el presente Reglamento debe aplicarse a las personas f铆sicas, independientemente de su nacionalidad o de su lugar de residencia, en relaci贸n con el tratamiento de sus datos personales. El presente Reglamento no regula el tratamiento de datos personales relativos a personas jur铆dicas y en particular a empresas constituidas como personas jur铆dicas, incluido el nombre y la forma de la persona jur铆dica y sus datos de contacto.

(14) The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.

Textos enlazados

2. El presente Reglamento se aplica al tratamiento de datos personales de interesados que residan en la Uni贸n por parte de un responsable o encargado no establecido en la Uni贸n, cuando las actividades de tratamiento est茅n relacionadas con:

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

Textos enlazados

a) la oferta de bienes o servicios a dichos interesados en la Uni贸n, independientemente de si a estos se les requiere su pago,聽o

(a)聽the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

Considerandos

(23) Con el fin de garantizar que las personas f铆sicas no se vean privadas de la protecci贸n a la que tienen derecho en virtud del presente Reglamento, el tratamiento de datos personales de interesados que residen en la Uni贸n por un responsable o un encargado no establecido en la Uni贸n debe regirse por el presente Reglamento si las actividades de tratamiento se refieren a la oferta de bienes o servicios a dichos interesados, independientemente de que medie pago. Para determinar si dicho responsable o encargado ofrece bienes o servicios a interesados que residan en la Uni贸n, debe determinarse si es evidente que el responsable o el encargado proyecta ofrecer servicios a interesados en uno o varios de los Estados miembros de la Uni贸n. Si bien la mera accesibilidad del sitio web del responsable o encargado o de un intermediario en la Uni贸n, de una direcci贸n de correo electr贸nico u otros datos de contacto, o el uso de una lengua generalmente utilizada en el tercer pa铆s donde resida el responsable del tratamiento, no basta para determinar dicha intenci贸n, hay factores, como el uso de una lengua o una moneda utilizada generalmente en uno o varios Estados miembros con la posibilidad de encargar bienes y servicios en esa otra lengua, o la menci贸n de clientes o usuarios que residen en la Uni贸n, que pueden revelar que el responsable del tratamiento proyecta ofrecer bienes o servicios a interesados en la Uni贸n.

(23) In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member聽States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member聽States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Textos enlazados

b) el control de su comportamiento, en la medida en que este tenga lugar en la Uni贸n.

(b)聽the monitoring of their behaviour as far as their behaviour takes place within the Union.

Considerandos

(24) El tratamiento de datos personales de los interesados que residen en la Uni贸n por un responsable o encargado no establecido en la Uni贸n debe ser tambi茅n objeto del presente Reglamento cuando est茅 relacionado con la observaci贸n del comportamiento de dichos interesados en la medida en que este comportamiento tenga lugar en la Uni贸n. Para determinar si se puede considerar que una actividad de tratamiento controla el comportamiento de los interesados, debe evaluarse si las personas f铆sicas son objeto de un seguimiento en internet, inclusive el potencial uso posterior de t茅cnicas de tratamiento de datos personales que consistan en la elaboraci贸n de un perfil de una persona f铆sica con el fin, en particular, de adoptar decisiones sobre 茅l o de analizar o predecir sus preferencias personales, comportamientos y actitudes.

(24) The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

Textos enlazados

3. El presente Reglamento se aplica al tratamiento de datos personales por parte de un responsable que no est茅 establecido en la Uni贸n sino en un lugar en que el Derecho de los Estados miembros sea de aplicaci贸n en virtud del Derecho internacional p煤blico.

3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member聽State law applies by virtue of public international law.

Considerandos

(25) Cuando sea de aplicaci贸n el Derecho de los Estados miembros en virtud del Derecho internacional p煤blico, el presente Reglamento debe aplicarse tambi茅n a todo responsable del tratamiento no establecido en la Uni贸n, como en una misi贸n diplom谩tica u oficina consular de un Estado miembro.

(25) Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State’s diplomatic mission or consular post.

Comentario de expertos Considerandos Ley de Directrices y caso Deja un comentario
Comentario de expertos

(EN) One of the most frequent questions asked is whether a company falls within the scope of the GDPR. It relates, among other things, to the definition of the European regulation鈥檚 territorial scope.

Here you can find a little self-assessment test:

Does the GDPR apply in these cases?

  1. A Russian mobile application processes the geolocation data of Russian and foreign nationals in the EU.
  2. A Belarusian dating site collects contact information from all its users. Americans and Europeans who come to Belarus and want to meet local women can also register on the site.
  3. An Italian chain has opened a new hotel in Kyiv, where both Europeans and citizens of other countries stay. Guests registration is carried out on the Italian site, and data are processed in the head office of the management company in Italy.
  4. An American training platform uses personal data to sell online courses around the world.
  5. EU nationals, who are on vacation in India, came to an Austrian airline’s local office in Mumbai to fly to Bali for a couple of days. For this purpose, their passport information and bank card data were collected, as well as the information that the passengers are vegetarians.
  6. EU users visit the site of a company from Rostov-on-Don 2-3 times a month and order flower deliveries in the city for their loved ones. The site is in Russian. Deliveries are only in Rostov. The currency of payment is the Russian ruble.

If you doubt the answers, go on reading and you will find the detailed analysis in the video lesson at the bottom of this article (in Russian).

Here are three cases, which show when it is necessary to observe the GDPR:

  1. When data are processed in the context of the activities of an establishment in the EU. In other words, if the office is physically located in any of the EU countries and the data are processed in that office, the GDPR applies. Thus, the correct answer to the third question concerning the Italian hotel is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, this paragraph does not apply only to a physical office or a registered legal entity. There are many other unobvious examples of what should be considered as the 鈥渃ontext of the activities of an establishment鈥. We describe them in detail in the video.

  1. When the data subject is in the EU and the processing relates to the supply of goods and services. In this case, 鈥渄ata subject鈥 does not refer only to European citizens, but also to people from other countries who are passing through, traveling, or staying temporary in Europe. At the same time, the goods and services do not necessarily have to be paid for. For example, a free mobile app that you have downloaded.

Therefore, if, for example, a Russian citizen, being in Latvia, has used a Russian mobile application, she or he is protected by the GDPR. So the correct answer to the first question is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, according to this paragraph, the GDPR also applies to other cases, which we have mentioned at the beginning of this article. For instance, in the second case, the Belarusian dating site provides a service to European citizens, as well as the American platform from the fourth case.

In comparison, in the fifth case concerning the purchase of tickets to Bali, the GDPR is not applicable, as these people have left the EU and are buying tickets in the office in India.

Do you know why in the sixth case concerning the flower delivery the GDPR does not apply, although the data of European citizens are processed? The reason is that the exception described in the recitals of the Regulation is based on a specific judicial precedent.

For more details on these recitals and court precedent, please see our video lesson.

  1. When you monitor behaviour within the EU. These situations are rare. And that rule does not apply to any of the cases from this article. More detailed information can be found in the video.

We hope that the information was helpful. Share it with your colleagues and make sure to see our detailed video lesson below in which you will find:

  • A detailed explanation of the diagram 鈥渢he territorial scope of the GDPR鈥;
  • Explanation of articles, recitals, judicial precedents, and clarification by the supervisory authority;
  • Further examples and cases from practice;
  • Detailed case analysis from this article.


para acceder al texto completo

(EN) Author
Siarhei Varankevich
(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP
FIP_IAPP
(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant
Considerandos

(22) Todo tratamiento de datos personales en el contexto de las actividades de un establecimiento de un responsable o un encargado del tratamiento en la Uni贸n debe llevarse a cabo de conformidad con el presente Reglamento, independientemente de que el tratamiento tenga lugar en la Uni贸n. Un establecimiento implica el ejercicio de manera efectiva y real de una actividad a trav茅s de modalidades estables. La forma jur铆dica que revistan tales modalidades, ya sea una sucursal o una filial con personalidad jur铆dica, no es el factor determinante al respecto.

(22) Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

(23) Con el fin de garantizar que las personas f铆sicas no se vean privadas de la protecci贸n a la que tienen derecho en virtud del presente Reglamento, el tratamiento de datos personales de interesados que residen en la Uni贸n por un responsable o un encargado no establecido en la Uni贸n debe regirse por el presente Reglamento si las actividades de tratamiento se refieren a la oferta de bienes o servicios a dichos interesados, independientemente de que medie pago. Para determinar si dicho responsable o encargado ofrece bienes o servicios a interesados que residan en la Uni贸n, debe determinarse si es evidente que el responsable o el encargado proyecta ofrecer servicios a interesados en uno o varios de los Estados miembros de la Uni贸n. Si bien la mera accesibilidad del sitio web del responsable o encargado o de un intermediario en la Uni贸n, de una direcci贸n de correo electr贸nico u otros datos de contacto, o el uso de una lengua generalmente utilizada en el tercer pa铆s donde resida el responsable del tratamiento, no basta para determinar dicha intenci贸n, hay factores, como el uso de una lengua o una moneda utilizada generalmente en uno o varios Estados miembros con la posibilidad de encargar bienes y servicios en esa otra lengua, o la menci贸n de clientes o usuarios que residen en la Uni贸n, que pueden revelar que el responsable del tratamiento proyecta ofrecer bienes o servicios a interesados en la Uni贸n.

(23) In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member聽States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member聽States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

(24) El tratamiento de datos personales de los interesados que residen en la Uni贸n por un responsable o encargado no establecido en la Uni贸n debe ser tambi茅n objeto del presente Reglamento cuando est茅 relacionado con la observaci贸n del comportamiento de dichos interesados en la medida en que este comportamiento tenga lugar en la Uni贸n. Para determinar si se puede considerar que una actividad de tratamiento controla el comportamiento de los interesados, debe evaluarse si las personas f铆sicas son objeto de un seguimiento en internet, inclusive el potencial uso posterior de t茅cnicas de tratamiento de datos personales que consistan en la elaboraci贸n de un perfil de una persona f铆sica con el fin, en particular, de adoptar decisiones sobre 茅l o de analizar o predecir sus preferencias personales, comportamientos y actitudes.

(24) The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

(25) Cuando sea de aplicaci贸n el Derecho de los Estados miembros en virtud del Derecho internacional p煤blico, el presente Reglamento debe aplicarse tambi茅n a todo responsable del tratamiento no establecido en la Uni贸n, como en una misi贸n diplom谩tica u oficina consular de un Estado miembro.

(25) Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State’s diplomatic mission or consular post.

Ley de Directrices y caso Deja un comentario
[js-disqus]