(22) 유럽연합 역내의 컨트롤러 또는 프로세서의 사업장(establishment) 활동과 관련한 개인정보 처리는 본 규정에 따라야 하고, 그 처리 자체가 유럽연합 역내에서 발생하는지 여부는 상관없다.
사업장이라 함은 안정적인 방식을 통해 효과적이고 실제적인 활동을 행하는 것을 의미한다.
그 방식의 법적 형태는 법인격을 가진 지점 또는 자회사를 통한 것인지에 관계없이 그와 관련한 결정적인 요인이 아니다.
(22) Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union.
Establishment implies the effective and real exercise of activity through stable arrangements.
The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.
Before considering what is meant by “an establishment in the Union” it is first necessary to identify who is the controller or processor for a given processing activity. According to the definition in Article 4(7) of the GDPR, controller means “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”. A processor, according to Article 4(8) of the GDPR, is “a natural or legal person, public authority, 6 Adopted agency or other body which processes personal data on behalf of the controller”. As established by relevant CJEU case law and previous WP29 opinion, the determination of whether an entity is a controller or processor for the purposes of EU data protection law is a key element in the assessment of the application of the GDPR to the personal data processing in question.