3 pants 📖 VDAR. Teritoriālā darbības joma

3 pants VDAR. Teritoriālā darbības joma

1. Šo regulu piemēro personas datu apstrādei saistībā ar darbībām, ko veic pārziņa vai apstrādātāja uzņēmējdarbības vietā Savienībā, neatkarīgi no tā, vai apstrāde notiek vai nenotiek Savienībā.

Vadlīnijas & Case Law Apsvērums Savienojumi

Vadlīnijas & Case Law

(EN)

Documents

WP29, Update of Opinion on applicable law in light of the CJEU judgement in Google Spain (2010).

Case Law

CJEU, Google Spain SL/Agencia española de protección de datos, C-131/12 (2014):

55. In the light of that objective of Directive 95/46 and of the wording of Article 4(1)(a), it must be held that the processing of personal data for the purposes of the service of a search engine such as Google Search, which is operated by an undertaking that has its seat in a third State but has an establishment in a Member State, is carried out ‘in the context of the activities’ of that establishment if the latter is intended to promote and sell, in that Member State, advertising space offered by the search engine which serves to make the service offered by that engine profitable.

56. In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed. (page 14)

CJEU, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein/Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16 (2018):

… where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State. (page 14)

Apsvērums

(22) Personas datu apstrādei, kas notiek saistībā ar darbībām, ko veic pārziņa vai apstrādātāja uzņēmējdarbībā Savienībā, būtu jānotiek saskaņā ar šo regulu neatkarīgi no tā, vai pati apstrāde notiek Savienībā. Uzņēmējdarbības veikšana nozīmē efektīvu un faktisku darbību, ko veic pastāvīga vienība. Šādas vienības juridiskā forma neatkarīgi no tā, vai tā ir filiāle vai meitasuzņēmums ar juridiskas personas statusu, minētajā sakarā nav noteicošais faktors.

(14) Šajā regulā noteiktajai aizsardzībai attiecībā uz personas datu apstrādi būtu jāattiecas uz fiziskām personām neatkarīgi no to valstspiederības vai dzīvesvietas. Šī regula neattiecas uz tādu personas datu apstrādi, kas skar juridiskas personas un jo īpaši uzņēmumus, kuriem ir juridiskas personas statuss, tostarp juridiskās personas nosaukumu, uzņēmējdarbības formu un kontaktinformāciju.

Savienojumi

2. Šo regulu piemēro Savienībā esošu datu subjektu personas datu apstrādei, ko veic pārzinis vai apstrādātājs, kas neveic uzņēmējdarbību Savienībā, ja apstrādes darbības ir saistītas ar:

Savienojumi

a) preču vai pakalpojumu piedāvāšanu šādiem datu subjektiem Savienībā, neatkarīgi no tā, vai no datu subjekta tiek prasīta samaksa; vai

Apsvērums Savienojumi

Apsvērums

(23) Lai nodrošinātu, ka fiziskām personām netiek liegta aizsardzība, kas tām pienākas saskaņā ar šo regulu, Savienībā esošu datu subjektu personas datu apstrāde, ko veic pārzinis vai apstrādātājs, kas neveic uzņēmējdarbību Savienībā, būtu jāveic saskaņā ar šo regulu, ja apstrādes darbības ir saistītas ar preču vai pakalpojumu piedāvāšanu šādiem datu subjektiem neatkarīgi no tā, vai tā ir saistīta ar samaksu. Lai noteiktu, vai šāds pārzinis vai apstrādātājs piedāvā preces vai pakalpojumus datu subjektiem, kuri ir Savienībā, būtu jāpārliecinās, vai ir acīmredzams, ka pārzinis vai apstrādātājs ir iecerējis piedāvāt pakalpojumus datu subjektiem vienā vai vairākās Savienības dalībvalstīs. Tā kā, lai pārliecinātos par šādu ieceri, nepietiek tikai ar to, ka ir pieejama pārziņa, apstrādātāja vai starpnieka tīmekļa vietne Savienībā, e-pasta adrese vai cita kontaktinformācija, vai ka tiek izmantota valoda, ko parasti izmanto trešā valstī, kurā pārzinis veic uzņēmējdarbību, faktori, piemēram, tādas valodas vai valūtas izmantošana, kuru parasti izmanto vienā vai vairākās dalībvalstīs, piedāvājot pasūtīt preces un pakalpojumus minētajā citā valodā, vai Savienībā esošu klientu vai lietotāju pieminēšana var liecināt par to, ka pārzinis ir iecerējis piedāvāt preces vai pakalpojumus datu subjektiem Savienībā.

Savienojumi

b) viņu uzvedības novērošanu, ciktāl viņu uzvedība notiek Savienībā.

Apsvērums Savienojumi

Apsvērums

(24) Savienībā esošu datu subjektu personas datu apstrāde, ko veic pārzinis vai apstrādātājs, kas neveic uzņēmējdarbību Savienībā, būtu jāveic saskaņā ar šo regulu arī tad, ja tā ir saistīta ar šādu datu subjektu uzvedības novērošanu, ciktāl to uzvedība notiek Savienībā. Lai noteiktu, vai apstrādes darbību var uzskatīt par datu subjektu “uzvedības novērošanu”, būtu jāpārliecinās, vai fiziska persona tiek izsekota internetā, tostarp vai var turpmāk izmantot personas datu apstrādes paņēmienus, kas ietver fiziskas personas profilēšanu, jo īpaši, lai pieņemtu lēmumus par datu subjektu vai lai analizētu vai iepriekš paredzētu datu subjekta personīgās vēlmes, uzvedību un attieksmi.

Savienojumi

3. Šo regulu piemēro personas datu apstrādei, ko veic pārzinis, kas neveic uzņēmējdarbību Savienībā, bet vietā, kur saskaņā ar starptautiskajām publiskajām tiesībām ir piemērojamas dalībvalsts tiesības.

Apsvērums

(25) Ja, ievērojot starptautiskās publiskās tiesības, ir piemērojamas dalībvalsts tiesības, tad šī regula būtu piemērojama arī pārzinim, kas neveic uzņēmējdarbību Savienībā, piemēram, pārzinim dalībvalsts diplomātiskajā pārstāvniecībā vai konsulātā.

Vispārīgā datu aizsardzības regula (VDAR)

Ekspertu komentāri Apsvērums Vadlīnijas & Case Law Atstājiet savu komentāru

Ekspertu komentāri

(EN) One of the most frequent questions asked is whether a company falls within the scope of the GDPR. It relates, among other things, to the definition of the European regulation’s territorial scope.

Here you can find a little self-assessment test:

Does the GDPR apply in these cases?

A Russian mobile application processes the geolocation data of Russian and foreign nationals in the EU.
A Belarusian dating site collects contact information from all its users. Americans and Europeans who come to Belarus and want to meet local women can also register on the site.
An Italian chain has opened a new hotel in Kyiv, where both Europeans and citizens of other countries stay. Guests registration is carried out on the Italian site, and data are processed in the head office of the management company in Italy.
An American training platform uses personal data to sell online courses around the world.
EU nationals, who are on vacation in India, came to an Austrian airline’s local office in Mumbai to fly to Bali for a couple of days. For this purpose, their passport information and bank card data were collected, as well as the information that the passengers are vegetarians.
EU users visit the site of a company from Rostov-on-Don 2-3 times a month and order flower deliveries in the city for their loved ones. The site is in Russian. Deliveries are only in Rostov. The currency of payment is the Russian ruble.

If you doubt the answers, go on reading and you will find the detailed analysis in the video lesson at the bottom of this article (in Russian).

Here are three cases, which show when it is necessary to observe the GDPR:

When data are processed in the context of the activities of an establishment in the EU. In other words, if the office is physically located in any of the EU countries and the data are processed in that office, the GDPR applies. Thus, the correct answer to the third question concerning the Italian hotel is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, this paragraph does not apply only to a physical office or a registered legal entity. There are many other unobvious examples of what should be considered as the “context of the activities of an establishment”. We describe them in detail in the video.

When the data subject is in the EU and the processing relates to the supply of goods and services. In this case, “data subject” does not refer only to European citizens, but also to people from other countries who are passing through, traveling, or staying temporary in Europe. At the same time, the goods and services do not necessarily have to be paid for. For example, a free mobile app that you have downloaded.

Therefore, if, for example, a Russian citizen, being in Latvia, has used a Russian mobile application, she or he is protected by the GDPR. So the correct answer to the first question is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, according to this paragraph, the GDPR also applies to other cases, which we have mentioned at the beginning of this article. For instance, in the second case, the Belarusian dating site provides a service to European citizens, as well as the American platform from the fourth case.

In comparison, in the fifth case concerning the purchase of tickets to Bali, the GDPR is not applicable, as these people have left the EU and are buying tickets in the office in India.

Do you know why in the sixth case concerning the flower delivery the GDPR does not apply, although the data of European citizens are processed? The reason is that the exception described in the recitals of the Regulation is based on a specific judicial precedent.

For more details on these recitals and court precedent, please see our video lesson.

When you monitor behaviour within the EU. These situations are rare. And that rule does not apply to any of the cases from this article. More detailed information can be found in the video.

We hope that the information was helpful. Share it with your colleagues and make sure to see our detailed video lesson below in which you will find:

A detailed explanation of the diagram “the territorial scope of the GDPR”;
Explanation of articles, recitals, judicial precedents, and clarification by the supervisory authority;
Further examples and cases from practice;
Detailed case analysis from this article.

…

Pieslēgties
lai piekļūtu pilnam tekstam

(EN) Author