Does the EU General Data Protection Regulation have extra-territorial effect?

• Published date: 25 November 2020
• Subject Matter: Privacy, Data Protection
• Law Firm: Colin Biggers & Paisley
• Author: Mr Toby Blyth and Jessica Yazbek

In brief - Before concluding that GDPR applies, a close analysis of what exactly the overseas entity does and the components of its supply chain is warranted

This article was first published in the Privacy Law Bulletin 17.6 and reprinted in the Financial Services Newsletter - Issue 19.8

Main points:

• Closely analyse data flows
• Pay careful attention to how a transaction chain works in reality, as no transaction is seamless
• Consider how entities can be structured to contain EU touchpoints and therefore risk in a manageable way

Introduction

The European Union is (depending on the way one counts) the largest economy in the world and its constituent nations occupy prime positions in global trade. The size and effective influence of the EU's trade regime has meant that the General Data Protection Regulation (GDPR) represents a large change in the way data privacy is protected in the EU, with the regulation fundamentally reshaping healthcare to banking, marketing and beyond.

The effect of the GDPR is felt not just in the EU, as it can apply to those who trade in the EU and those who process data in the EU. However, the effect does not stop there as the GDPR purports to have a significant extra-territorial effect.

Biggest change for data privacy laws

The extra-territorial reach of the GDPR is arguably the biggest change for data privacy laws internationally. However, exactly how the GDPR has extra-territorial reach is a subject that has in certain aspects been little explored, other than via what seem to be viewed as performative utterances by the EU.

In our view, it should not just be assumed that the GDPR applies to an overseas controller or processor, simply because EU data subjects have access to the overseas entity's website or services. A close analysis of what exactly the overseas entity does, and its supply chain is warranted before it should be concluded that the GDPR applies.

In the classical legal theory of jurisdiction, there are two main heads: citizenship and presence.

A country will assert jurisdiction over its citizens on the basis of their citizenship. This means that a nation will assert that it can criminalise or regulate the conduct of its citizens anywhere in the world. Classic examples are child sexual exploitation and taxation.

By extension, a nation will assert citizenship jurisdiction over a corporation or other non-natural person which is incorporated or otherwise brought into being by the law of that nation.

The other classical head of jurisdiction is presence. A nation will assert jurisdiction over those natural or non-natural persons who are present in its jurisdiction. Hence, visiting aliens are subject to the laws of a nation that they are visiting, and an alien company that trades in a nation will also be subject to its laws.

The latter head has been expanded somewhat by the "targeting" or "effects" extension (ie when a company or person targets consumers in another country).¹

The internet has meant that nations have had to re-consider their conception of jurisdiction and to adapt the two classical heads of jurisdiction. It is obvious that when analysed closely, most digital transactions occur somewhere, but in the form of digital signal communications. In that respect they are analogous to transactions by letter or telegram, and the legal rules developed to handle those transactions are not manifestly unsuitable to consider...