Članak 3. 📖 GDPR. Teritorijalno područje primjene

Članak 3. GDPR. Teritorijalno područje primjene

1. Ova se Uredba odnosi na obradu osobnih podataka u okviru aktivnosti poslovnog nastana voditelja obrade ili izvršitelja obrade u Uniji, neovisno o tome obavlja li se obrada u Uniji ili ne.

Smjernice i sudska praksa Uvodne izjave Vezani tekstovi

Smjernice i sudska praksa

(EN)

Documents

WP29, Update of Opinion on applicable law in light of the CJEU judgement in Google Spain (2010).

Case Law

CJEU, Google Spain SL/Agencia española de protección de datos, C-131/12 (2014):

55. In the light of that objective of Directive 95/46 and of the wording of Article 4(1)(a), it must be held that the processing of personal data for the purposes of the service of a search engine such as Google Search, which is operated by an undertaking that has its seat in a third State but has an establishment in a Member State, is carried out ‘in the context of the activities’ of that establishment if the latter is intended to promote and sell, in that Member State, advertising space offered by the search engine which serves to make the service offered by that engine profitable.

56. In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed. (page 14)

CJEU, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein/Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16 (2018):

… where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State. (page 14)

Uvodne izjave

(22) Svaka obrada osobnih podataka u Uniji s obzirom na djelatnosti poslovnog nastana voditelja obrade ili izvršitelja obrade trebala bi se obavljati u skladu s ovom Uredbom, neovisno o tome obavlja li se sama obrada u Uniji. Poslovni nastan podrazumijeva djelotvorno i stvarno obavljanje djelatnosti putem stabilnih aranžmana. Pravni oblik takvih aranžmana, bilo kroz podružnicu ili društvo kćer s pravnom osobnošću, nije odlučujući čimbenik u tom pogledu.

(14) Zaštita koja se pruža ovom Uredbom u vezi s obradom osobnih podataka trebala bi se odnositi na pojedince bez obzira na njihovu nacionalnost ili boravište. Ovom se Uredbom ne obuhvaća obrada osobnih podataka koji se tiču pravnih osoba, a osobito poduzetnika koji su ustanovljeni kao pravne osobe, uključujući ime i oblik pravne osobe i kontaktne podatke pravne osobe.

Vezani tekstovi

2. Ova se Uredba primjenjuje na obradu osobnih podataka ispitanikâ u Uniji koju obavlja voditelj obrade ili izvršitelj obrade bez poslovnog nastana u Uniji, ako su aktivnosti obrade povezane s:

Vezani tekstovi

(a) nuđenjem robe ili usluga takvim ispitanicima u Uniji, neovisno o tome treba li ispitanik izvršiti plaćanje; ili

Uvodne izjave Vezani tekstovi

Uvodne izjave

(23) Kako bi se osiguralo da pojedincima nije uskraćena zaštita na koju imaju pravo na temelju ove Uredbe, na obradu osobnih podataka ispitanika koji se nalaze u Uniji, a koju obavlja voditelj obrade ili izvršitelj obrade bez poslovnog nastana u Uniji, trebala bi se primjenjivati ova Uredba ako su aktivnosti obrade povezane s ponudom robe ili usluga takvim ispitanicima, bez obzira na to ima li ta ponuda veze s plaćanjem. Kako bi se utvrdilo nudi li takav voditelj obrade ili izvršitelj obrade robu ili usluge ispitanicima koji se nalaze u Uniji, trebalo bi utvrditi je li očito da voditelj obrade ili izvršitelj obrade namjerava ponuditi usluge ispitanicima koji se nalaze u jednoj ili više država članica Unije. Iako su sama dostupnost internetskih stranica voditelja obrade, izvršitelja obrade ili posrednika u Uniji ili adrese elektroničke pošte i drugih kontaktnih podataka ili korištenje jezikom koji je općenito u uporabi u trećoj zemlji u kojoj voditelj obrade ima poslovni nastan nedovoljni za utvrđivanje takve namjere, čimbenici kao što je korištenje jezikom ili valutom koji su općenito u uporabi u jednoj ili više država članica s mogućnošću naručivanja robe i usluga na tom drugom jeziku, ili spominjanje kupaca ili korisnika koji se nalaze u Uniji, mogu jasno pokazati da voditelj obrade namjerava nuditi robu ili usluge ispitanicima u Uniji.

Vezani tekstovi

(b) praćenjem njihova ponašanja dokle god se njihovo ponašanje odvija unutar Unije.

Uvodne izjave Vezani tekstovi

Uvodne izjave

(24) Na obradu osobnih podataka ispitanika koji se nalaze u Uniji, a koju obavlja voditelj obrade ili izvršitelj obrade bez poslovnog nastana u Uniji, također bi se trebala primjenjivati ova Uredba kada se odnosi na praćenje ponašanja takvih ispitanika ako se njihovo ponašanje odvija unutar Unije. Kako bi se odredilo može li se aktivnost obrade smatrati praćenjem ponašanja ispitanika, trebalo bi utvrditi prati li se pojedince na internetu među ostalim mogućom naknadnom upotrebom tehnika obrade osobnih podataka koje se sastoje od izrade profila pojedinca, osobito radi donošenja odluka koje se odnose na njega ili radi analize ili predviđanja njegovih osobnih sklonosti, ponašanja i stavova.

Vezani tekstovi

3. Ova se Uredba primjenjuje na obradu osobnih podataka koju obavlja voditelj obrade koji nema poslovni nastan u Uniji, već na mjestu gdje se pravo države članice primjenjuje na temelju međunarodnog javnog prava.

Uvodne izjave

(25) Kada se pravo države članice primjenjuje na temelju međunarodnog javnog prava, ova Uredba trebala bi se primjenjivati i na voditelje obrade koji nemaju poslovni nastan u Uniji, kao na primjer u diplomatskom ili konzularnom predstavništvu države članice.

Opća uredba o zaštiti podataka (GDPR)

Stručni komentar Uvodne izjave Smjernice i sudska praksa Ostavite komentar

Stručni komentar

(EN) One of the most frequent questions asked is whether a company falls within the scope of the GDPR. It relates, among other things, to the definition of the European regulation’s territorial scope.

Here you can find a little self-assessment test:

Does the GDPR apply in these cases?

A Russian mobile application processes the geolocation data of Russian and foreign nationals in the EU.
A Belarusian dating site collects contact information from all its users. Americans and Europeans who come to Belarus and want to meet local women can also register on the site.
An Italian chain has opened a new hotel in Kyiv, where both Europeans and citizens of other countries stay. Guests registration is carried out on the Italian site, and data are processed in the head office of the management company in Italy.
An American training platform uses personal data to sell online courses around the world.
EU nationals, who are on vacation in India, came to an Austrian airline’s local office in Mumbai to fly to Bali for a couple of days. For this purpose, their passport information and bank card data were collected, as well as the information that the passengers are vegetarians.
EU users visit the site of a company from Rostov-on-Don 2-3 times a month and order flower deliveries in the city for their loved ones. The site is in Russian. Deliveries are only in Rostov. The currency of payment is the Russian ruble.

If you doubt the answers, go on reading and you will find the detailed analysis in the video lesson at the bottom of this article (in Russian).

Here are three cases, which show when it is necessary to observe the GDPR:

When data are processed in the context of the activities of an establishment in the EU. In other words, if the office is physically located in any of the EU countries and the data are processed in that office, the GDPR applies. Thus, the correct answer to the third question concerning the Italian hotel is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, this paragraph does not apply only to a physical office or a registered legal entity. There are many other unobvious examples of what should be considered as the “context of the activities of an establishment”. We describe them in detail in the video.

When the data subject is in the EU and the processing relates to the supply of goods and services. In this case, “data subject” does not refer only to European citizens, but also to people from other countries who are passing through, traveling, or staying temporary in Europe. At the same time, the goods and services do not necessarily have to be paid for. For example, a free mobile app that you have downloaded.

Therefore, if, for example, a Russian citizen, being in Latvia, has used a Russian mobile application, she or he is protected by the GDPR. So the correct answer to the first question is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, according to this paragraph, the GDPR also applies to other cases, which we have mentioned at the beginning of this article. For instance, in the second case, the Belarusian dating site provides a service to European citizens, as well as the American platform from the fourth case.

In comparison, in the fifth case concerning the purchase of tickets to Bali, the GDPR is not applicable, as these people have left the EU and are buying tickets in the office in India.

Do you know why in the sixth case concerning the flower delivery the GDPR does not apply, although the data of European citizens are processed? The reason is that the exception described in the recitals of the Regulation is based on a specific judicial precedent.

For more details on these recitals and court precedent, please see our video lesson.

When you monitor behaviour within the EU. These situations are rare. And that rule does not apply to any of the cases from this article. More detailed information can be found in the video.

We hope that the information was helpful. Share it with your colleagues and make sure to see our detailed video lesson below in which you will find:

A detailed explanation of the diagram “the territorial scope of the GDPR”;
Explanation of articles, recitals, judicial precedents, and clarification by the supervisory authority;
Further examples and cases from practice;
Detailed case analysis from this article.

(EN) […]

(EN) Sign in
to read the full text

(EN) Author