Scope of the eu general personal data regulation

Abstract

Listen

Translate article

The purpose of this article is to clarify the scope of the Regulation (eu) 2016/679 of the European parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (here in after — Regulation). The author makes a comparative legal analysis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (here in after — the Directive) and Regulations. As a result of the study, the author distinguishes between the territorial and extraterritorial scope of the Regulation. The author clarifies the content of the concepts of “equipment” and “the establishment” of the controller and the person processing personal data in the context of the application of the Regulations. The article concludes that since no changes were made to the concept of “the establishment” when the Directive was repealed, a broad interpretation of this concept in judicial practice can also be applied to the territorial scope of the Regulation. The continuity of the wording of the Directive and the Regulation allowed the author to conclude that the extraterritorial scope of the Regulation can be seen not only in Part 2 of Article 3 of the Regulation, which provides for its direct extraterritorial effect, but also in Part 1 of Article 3, which specifies the territorial scope of its action, on the basis of criteria that are based solely on the territory of the EU member States, such as the “place of establishment” of the controller or the person processing personal data.