导航
GDPR > 第 3 條. 領土適用範圍
下载PDF

第 3 條 GDPR. 領土適用範圍

Article 3 GDPR. Territorial scope

1. 本規則適用於控管者或處理者在歐盟境內之分支機構所為之個人 資料處理活動,不問該處理是否發生於歐盟境內。

1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

指南和案例法 献技

(22) 控管者或處理者在歐盟境內之分支機構所為之一切個人資料處理均應受本規則之拘束,無論其處理行為本身是否發生於歐盟境內。分支機構係指透過穩定安排,從事於有效且實際之活動。此等安排之法律形式,不因其係透過分公司或具有法人格之子公司所為而有不同。

(22) Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

(14) 本規則所保護者,係不論當事人之國籍或住居所,凡涉及其個 人資料之處理均屬之。本規則並未涵蓋法人及具法人資格之特定事業 的個人資料處理(包括法人名稱、設立形式及其聯繫方式)。

(14) The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.

相关文章

2. 本規則適用於由非設立於歐盟境內之控管者或處理者對於歐盟境 內之資料主體所為涉及如下事項之個人資料處理:

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

相关文章

(a) 對歐盟境內之資料主體提供商品或服務,不問是否需要資料主體 付款;

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

献技

(23) 為確保當事人受本規則所保護之權利不被侵奪,凡為歐盟境內 之資料主體,雖由非設立於歐盟境內之控管者及處理者進行個人資料 處理,惟其處理活動涉及為該等資料主體提供商品或服務者,不問是 否涉及付款,本規則仍應予適用。為決定控管者或處理者是否為歐盟 境內之資料主體提供商品或服務,應確認是否明顯可知該控管者或處 理者預見其係提供服務予位於一個或多個歐盟會員國境內之資料主 體。如僅係可接近使用控管者、處理者或中介者於歐盟境內之網頁、 電子郵件或其他聯繫方式,或所使用之語言係控管者設立地之第三國 所通常使用之語言,均不足以確認其具有提供商品或服務之上述意圖; 但諸如:所使用之語言或貨幣通常係使用於一個或多個會員國境內且 有以該語言訂購其商品或服務之可能性,或所提及之消費者或使用者 位於歐盟境內者,則可能使其明顯可知控管者擬向於歐盟境內之資料 主體提供商品或服務。

(23) In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

相关文章

(b) 對於資料主體於歐盟內所為行為之監控。

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

献技

(24) 凡為歐盟境內之資料主體,雖由非設立於歐盟境內之控管者及 處理者進行個人資料處理,惟其涉及對該資料主體之行為所為監控且 該受監控之行為係發生於歐盟境內者,本規則亦應予適用。為決定該 資料處理是否可受認定為監控該資料主體之行為,應確認當事人是否 於網路中被追蹤,包括以個人資料處理技術為潛在之後續使用而將當 事人建檔,特別是為了得到其決策,或為分析或預測其個人喜好、行 為及態度。

(24) The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

相关文章

3. 本規則適用於由非設立於歐盟境內之控管者,但在會員國法律依 國際公法可得適用領域內所為之個人資料處理。

3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

献技

(25) 凡會員國法律依國際公法可得適用之領域,本規則亦應拘束非 設立於歐盟境內之控管者,諸如會員國之使領館。

(25) Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State’s diplomatic mission or consular post.

專家評論 献技 指南和案例法 发表评论
專家評論

(EN) One of the most frequent questions asked is whether a company falls within the scope of the GDPR. It relates, among other things, to the definition of the European regulation’s territorial scope.

Here you can find a little self-assessment test:

Does the GDPR apply in these cases?

  1. A Russian mobile application processes the geolocation data of Russian and foreign nationals in the EU.
  2. A Belarusian dating site collects contact information from all its users. Americans and Europeans who come to Belarus and want to meet local women can also register on the site.
  3. An Italian chain has opened a new hotel in Kyiv, where both Europeans and citizens of other countries stay. Guests registration is carried out on the Italian site, and data are processed in the head office of the management company in Italy.
  4. An American training platform uses personal data to sell online courses around the world.
  5. EU nationals, who are on vacation in India, came to an Austrian airline’s local office in Mumbai to fly to Bali for a couple of days. For this purpose, their passport information and bank card data were collected, as well as the information that the passengers are vegetarians.
  6. EU users visit the site of a company from Rostov-on-Don 2-3 times a month and order flower deliveries in the city for their loved ones. The site is in Russian. Deliveries are only in Rostov. The currency of payment is the Russian ruble.

If you doubt the answers, go on reading and you will find the detailed analysis in the video lesson at the bottom of this article (in Russian).

Here are three cases, which show when it is necessary to observe the GDPR:

  1. When data are processed in the context of the activities of an establishment in the EU. In other words, if the office is physically located in any of the EU countries and the data are processed in that office, the GDPR applies. Thus, the correct answer to the third question concerning the Italian hotel is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, this paragraph does not apply only to a physical office or a registered legal entity. There are many other unobvious examples of what should be considered as the “context of the activities of an establishment”. We describe them in detail in the video.

  1. When the data subject is in the EU and the processing relates to the supply of goods and services. In this case, “data subject” does not refer only to European citizens, but also to people from other countries who are passing through, traveling, or staying temporary in Europe. At the same time, the goods and services do not necessarily have to be paid for. For example, a free mobile app that you have downloaded.

Therefore, if, for example, a Russian citizen, being in Latvia, has used a Russian mobile application, she or he is protected by the GDPR. So the correct answer to the first question is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, according to this paragraph, the GDPR also applies to other cases, which we have mentioned at the beginning of this article. For instance, in the second case, the Belarusian dating site provides a service to European citizens, as well as the American platform from the fourth case.

In comparison, in the fifth case concerning the purchase of tickets to Bali, the GDPR is not applicable, as these people have left the EU and are buying tickets in the office in India.

Do you know why in the sixth case concerning the flower delivery the GDPR does not apply, although the data of European citizens are processed? The reason is that the exception described in the recitals of the Regulation is based on a specific judicial precedent.

For more details on these recitals and court precedent, please see our video lesson.

  1. When you monitor behaviour within the EU. These situations are rare. And that rule does not apply to any of the cases from this article. More detailed information can be found in the video.

We hope that the information was helpful. Share it with your colleagues and make sure to see our detailed video lesson below in which you will find:

  • A detailed explanation of the diagram “the territorial scope of the GDPR”;
  • Explanation of articles, recitals, judicial precedents, and clarification by the supervisory authority;
  • Further examples and cases from practice;
  • Detailed case analysis from this article.


访问全文

(EN) Author
(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP
FIP_IAPP
(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant
献技

(22) 控管者或處理者在歐盟境內之分支機構所為之一切個人資料處理均應受本規則之拘束,無論其處理行為本身是否發生於歐盟境內。分支機構係指透過穩定安排,從事於有效且實際之活動。此等安排之法律形式,不因其係透過分公司或具有法人格之子公司所為而有不同。

(22) Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

(23) 為確保當事人受本規則所保護之權利不被侵奪,凡為歐盟境內 之資料主體,雖由非設立於歐盟境內之控管者及處理者進行個人資料 處理,惟其處理活動涉及為該等資料主體提供商品或服務者,不問是 否涉及付款,本規則仍應予適用。為決定控管者或處理者是否為歐盟 境內之資料主體提供商品或服務,應確認是否明顯可知該控管者或處 理者預見其係提供服務予位於一個或多個歐盟會員國境內之資料主 體。如僅係可接近使用控管者、處理者或中介者於歐盟境內之網頁、 電子郵件或其他聯繫方式,或所使用之語言係控管者設立地之第三國 所通常使用之語言,均不足以確認其具有提供商品或服務之上述意圖; 但諸如:所使用之語言或貨幣通常係使用於一個或多個會員國境內且 有以該語言訂購其商品或服務之可能性,或所提及之消費者或使用者 位於歐盟境內者,則可能使其明顯可知控管者擬向於歐盟境內之資料 主體提供商品或服務。

(23) In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects irrespective of whether connected to a payment. In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

(24) 凡為歐盟境內之資料主體,雖由非設立於歐盟境內之控管者及 處理者進行個人資料處理,惟其涉及對該資料主體之行為所為監控且 該受監控之行為係發生於歐盟境內者,本規則亦應予適用。為決定該 資料處理是否可受認定為監控該資料主體之行為,應確認當事人是否 於網路中被追蹤,包括以個人資料處理技術為潛在之後續使用而將當 事人建檔,特別是為了得到其決策,或為分析或預測其個人喜好、行 為及態度。

(24) The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

(25) 凡會員國法律依國際公法可得適用之領域,本規則亦應拘束非 設立於歐盟境內之控管者,諸如會員國之使領館。

(25) Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State’s diplomatic mission or consular post.

指南和案例法 发表评论