第 3 條 &128214; GDPR. 領土適用範圍

第 3 條 GDPR. 領土適用範圍

1. 本規則適用於控管者或處理者在歐盟境內之分支機構所為之個人資料處理活動，不問該處理是否發生於歐盟境內。

指南和案例法献技相关文章

指南和案例法

(EN)

Documents

WP29, Update of Opinion on applicable law in light of the CJEU judgement in Google Spain (2010).

Case Law

CJEU, Google Spain SL/Agencia española de protección de datos, C-131/12 (2014):

55. In the light of that objective of Directive 95/46 and of the wording of Article 4(1)(a), it must be held that the processing of personal data for the purposes of the service of a search engine such as Google Search, which is operated by an undertaking that has its seat in a third State but has an establishment in a Member State, is carried out ‘in the context of the activities’ of that establishment if the latter is intended to promote and sell, in that Member State, advertising space offered by the search engine which serves to make the service offered by that engine profitable.

56. In such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed. (page 14)

CJEU, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein/Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16 (2018):

… where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State. (page 14)

献技

(22) 控管者或處理者在歐盟境內之分支機構所為之一切個人資料處理均應受本規則之拘束，無論其處理行為本身是否發生於歐盟境內。分支機構係指透過穩定安排，從事於有效且實際之活動。此等安排之法律形式，不因其係透過分公司或具有法人格之子公司所為而有不同。

(14) 本規則所保護者，係不論當事人之國籍或住居所，凡涉及其個人資料之處理均屬之。本規則並未涵蓋法人及具法人資格之特定事業的個人資料處理（包括法人名稱、設立形式及其聯繫方式）。

2. 本規則適用於由非設立於歐盟境內之控管者或處理者對於歐盟境內之資料主體所為涉及如下事項之個人資料處理：

(a) 對歐盟境內之資料主體提供商品或服務，不問是否需要資料主體付款；

献技相关文章

献技

(23) 為確保當事人受本規則所保護之權利不被侵奪，凡為歐盟境內之資料主體，雖由非設立於歐盟境內之控管者及處理者進行個人資料處理，惟其處理活動涉及為該等資料主體提供商品或服務者，不問是否涉及付款，本規則仍應予適用。為決定控管者或處理者是否為歐盟境內之資料主體提供商品或服務，應確認是否明顯可知該控管者或處理者預見其係提供服務予位於一個或多個歐盟會員國境內之資料主體。如僅係可接近使用控管者、處理者或中介者於歐盟境內之網頁、電子郵件或其他聯繫方式，或所使用之語言係控管者設立地之第三國所通常使用之語言，均不足以確認其具有提供商品或服務之上述意圖；但諸如：所使用之語言或貨幣通常係使用於一個或多個會員國境內且有以該語言訂購其商品或服務之可能性，或所提及之消費者或使用者位於歐盟境內者，則可能使其明顯可知控管者擬向於歐盟境內之資料主體提供商品或服務。

(b) 對於資料主體於歐盟內所為行為之監控。

献技相关文章

献技

(24) 凡為歐盟境內之資料主體，雖由非設立於歐盟境內之控管者及處理者進行個人資料處理，惟其涉及對該資料主體之行為所為監控且該受監控之行為係發生於歐盟境內者，本規則亦應予適用。為決定該資料處理是否可受認定為監控該資料主體之行為，應確認當事人是否於網路中被追蹤，包括以個人資料處理技術為潛在之後續使用而將當事人建檔，特別是為了得到其決策，或為分析或預測其個人喜好、行為及態度。

3. 本規則適用於由非設立於歐盟境內之控管者，但在會員國法律依國際公法可得適用領域內所為之個人資料處理。

献技

(25) 凡會員國法律依國際公法可得適用之領域，本規則亦應拘束非設立於歐盟境內之控管者，諸如會員國之使領館。

通用数据保护条例(EU GDPR)

Source: https://www.ndc.gov.tw/Content_List.aspx?n=F98A8C27A0F54C30

專家評論献技指南和案例法发表评论

專家評論

(EN) One of the most frequent questions asked is whether a company falls within the scope of the GDPR. It relates, among other things, to the definition of the European regulation’s territorial scope.

Here you can find a little self-assessment test:

Does the GDPR apply in these cases?

A Russian mobile application processes the geolocation data of Russian and foreign nationals in the EU.
A Belarusian dating site collects contact information from all its users. Americans and Europeans who come to Belarus and want to meet local women can also register on the site.
An Italian chain has opened a new hotel in Kyiv, where both Europeans and citizens of other countries stay. Guests registration is carried out on the Italian site, and data are processed in the head office of the management company in Italy.
An American training platform uses personal data to sell online courses around the world.
EU nationals, who are on vacation in India, came to an Austrian airline’s local office in Mumbai to fly to Bali for a couple of days. For this purpose, their passport information and bank card data were collected, as well as the information that the passengers are vegetarians.
EU users visit the site of a company from Rostov-on-Don 2-3 times a month and order flower deliveries in the city for their loved ones. The site is in Russian. Deliveries are only in Rostov. The currency of payment is the Russian ruble.

If you doubt the answers, go on reading and you will find the detailed analysis in the video lesson at the bottom of this article (in Russian).

Here are three cases, which show when it is necessary to observe the GDPR:

When data are processed in the context of the activities of an establishment in the EU. In other words, if the office is physically located in any of the EU countries and the data are processed in that office, the GDPR applies. Thus, the correct answer to the third question concerning the Italian hotel is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, this paragraph does not apply only to a physical office or a registered legal entity. There are many other unobvious examples of what should be considered as the “context of the activities of an establishment”. We describe them in detail in the video.

When the data subject is in the EU and the processing relates to the supply of goods and services. In this case, “data subject” does not refer only to European citizens, but also to people from other countries who are passing through, traveling, or staying temporary in Europe. At the same time, the goods and services do not necessarily have to be paid for. For example, a free mobile app that you have downloaded.

Therefore, if, for example, a Russian citizen, being in Latvia, has used a Russian mobile application, she or he is protected by the GDPR. So the correct answer to the first question is affirmative, i.e. it is necessary to comply with the GDPR.

By the way, according to this paragraph, the GDPR also applies to other cases, which we have mentioned at the beginning of this article. For instance, in the second case, the Belarusian dating site provides a service to European citizens, as well as the American platform from the fourth case.

In comparison, in the fifth case concerning the purchase of tickets to Bali, the GDPR is not applicable, as these people have left the EU and are buying tickets in the office in India.

Do you know why in the sixth case concerning the flower delivery the GDPR does not apply, although the data of European citizens are processed? The reason is that the exception described in the recitals of the Regulation is based on a specific judicial precedent.

For more details on these recitals and court precedent, please see our video lesson.

When you monitor behaviour within the EU. These situations are rare. And that rule does not apply to any of the cases from this article. More detailed information can be found in the video.

We hope that the information was helpful. Share it with your colleagues and make sure to see our detailed video lesson below in which you will find:

A detailed explanation of the diagram “the territorial scope of the GDPR”;
Explanation of articles, recitals, judicial precedents, and clarification by the supervisory authority;
Further examples and cases from practice;
Detailed case analysis from this article.

…

登入
访问全文

(EN) Author