Federico Marengo All rights reserved

2.- General aspects of data protection law

2.6.- GDPR territorial scope of application
Summary: the GDPR applies to the processing in the context of the activities of an establishment of a controller or processor in the EU,
but also, under specific circumstances, to controllers or processors not established in the EU, and by virtue of public international law.

Territorial scope of application

(art. 3 GDPR)

Targeting criterion
(art. 3(2) GDPR)

Two step assessment

Offering of goods or services, irrespective of

Data subjects in the EU
whether a payment is required, to DS in the EU

Offering goods or services to DS (art. 3(2)(a) GDPR)

- Controllers or processors that intentionally
- Regardless of whether a payment is required
target consumers located in the EU
- It includes the offering of information society services:
- Data protection is ensured to 'everyone' (art. 8
services normally provided for remuneration, at a distance, by
CFR), regardless of the citizenship, residence
electronic means and at the individual request of a recipient of
or other type of legal status (rec. 14 GDPR)
services (art. 1(1)(b) Directive 2015/1535)
- Permanent or temporary presence in the EU
- The offer of the goods and services must be intentionally
- The location must be assessed at the moment
directed at an individual in the EU
when the relevant triggering activity takes place
- Indicators (Rec. 23 GDPR):
(e.g. the offering of the goods or services or the
- the use of a language or a currency used in MSs
monitoring of the DS behaviour)
- the mention of customers or users located in the EU
- Intentional targeting of individuals in the EU,
- the use of certain top-level domain name (e.g. .it for
rather than incidentally
Italian users)
- The processing of EU citizens' or residents'
- the offer to deliver the goods to the EU
personal data taking place in a third country
- dedicated addresses or phone numbers to be reached
does not trigger the application of the GDPR
from a MS; etc
- The mere accessibility of the controller's, processor's or an
intermediary's website in the EU, of contact details, or the use
of a language generally used in the third country where the
controller is established, is insufficient to ascertain the
intention to offer goods and services to a person in the EU
Processor not established in the EU (rec. 23 GDPR)
Where processing activities by a controller
relates to the offering of goods or services or to
the monitoring of individuals?behaviour in the Monitoring of EU consumers' behaviour (art. 3(2)(b)
EU, any processor instructed to carry out that GDPR)
processing on behalf of the controller will fall Conditions:
within the scope of the GDPR (art. 3(2) GDPR) - DS in the EU
in respect of that processing. - the monitored behaviour must take place in the EU
Assessment of whether:
- tracking of natural persons on the internet or through
other type of network or technology involving personal data
processing (e.g. through smart devices)
- subsequent use of any personal data processing
techniques consisting in profiling a natural person (rec. 24
GDPR).
In these cases they must - Monitoring activities: e.g. behavioural advertising,
designate a representative in the geo-localization for marketing purposes, online tracking
EU (art. 27 GDPR) through cookies or fingerprinting, monitoring or reporting of
an individual's health status

28
Data Protection Law in Charts. A Visual Guide to the General Data Protection Regulation Available at https://payhip.com/fmarengo