One may therefore ask, primarily, how is the territorial scope of application of
data protection rules, including those on electronic data processing, defined in the
jurisdictions covered by the present study.
In this respect, the GDPR sets out a basic rule in article 3(1), according to which:
This Regulation applies to the processing of personal data in the context of the activities of
an establishment of a controller or a processor in the Union, regardless of whether the
processing takes place in the Union or not.
The place of establishment of the personal data controller or processor is, thus, the
primarily relevant connecting factor to determine the applicability of the Regulation’s provisions.
In the abovementioned Costeja case,
145 the CJEU has clarified, in respect of the
corresponding provision of Directive 95/46, that:
processing of personal data is carried out in the context of the activities of an establishment
of the controller on the territory of a Member State, within the meaning of that provision,
when the operator of a search engine sets up in a Member State a branch or subsidiary which
is intended to promote and sell advertising space offered by that engine and which orientates
its activity towards the inhabitants of that Member State.
The processing of personal data through a search engine such as Google Search,
which was operated by Google Inc. (a company incorporated in the U.S. but with an
establishment in Spain, Google Spain SL), was thus deemed to be carried out “in the
context of the activities” of that establishment, since the latter was “intended to
promote and sell, in that Member State, advertising space offered by the search
engine which serves to make the service offered by that engine profitable”.
146
In such circumstances, the activities of the operator of the search engine and those
of its establishment situated in the Member State concerned were, as the Court held,
“inextricably linked”, since the activities relating to the advertising space “constitute
the means of rendering the search engine at issue economically profitable and that
engine is, at the same time, the means enabling those activities to be performed”.
147
This broad definition of the notion of establishment of the data controller or
processor, which the CJUE has reaffirmed in the Weltimmo case,
148 is now reflected
in recital 22 of the GDPR, which states that:
Establishment implies the effective and real exercise of activity through stable arrangements.
The legal form of such arrangements, whether through a branch or a subsidiary with a legal
personality, is not the determining factor in that respect.
The European approach in respect of the scope of application of personal data
protection rules, centered on the place of establishment or the domicile of the data
145 See, supra, para 7.3.
146 See CJEU of 13 May 2014, rendered in case C-131/12, Google Spain SL and Google Inc., ECLI:
EU:C:2014:317, para. 56.
147 See ibidem, para. 57.
148 See the judgment rendered on 1 October 2015 in case C-230/14, Weltimmo s.r.o. v Nemzeti
Adatvédelmi és Információszabadság Hatóság, ECLI:EU:C:2015:639.
Data Protection in the Internet: General Report
31
data protection rules, including those on electronic data processing, defined in the
jurisdictions covered by the present study.
In this respect, the GDPR sets out a basic rule in article 3(1), according to which:
This Regulation applies to the processing of personal data in the context of the activities of
an establishment of a controller or a processor in the Union, regardless of whether the
processing takes place in the Union or not.
The place of establishment of the personal data controller or processor is, thus, the
primarily relevant connecting factor to determine the applicability of the Regulation’s provisions.
In the abovementioned Costeja case,
145 the CJEU has clarified, in respect of the
corresponding provision of Directive 95/46, that:
processing of personal data is carried out in the context of the activities of an establishment
of the controller on the territory of a Member State, within the meaning of that provision,
when the operator of a search engine sets up in a Member State a branch or subsidiary which
is intended to promote and sell advertising space offered by that engine and which orientates
its activity towards the inhabitants of that Member State.
The processing of personal data through a search engine such as Google Search,
which was operated by Google Inc. (a company incorporated in the U.S. but with an
establishment in Spain, Google Spain SL), was thus deemed to be carried out “in the
context of the activities” of that establishment, since the latter was “intended to
promote and sell, in that Member State, advertising space offered by the search
engine which serves to make the service offered by that engine profitable”.
146
In such circumstances, the activities of the operator of the search engine and those
of its establishment situated in the Member State concerned were, as the Court held,
“inextricably linked”, since the activities relating to the advertising space “constitute
the means of rendering the search engine at issue economically profitable and that
engine is, at the same time, the means enabling those activities to be performed”.
147
This broad definition of the notion of establishment of the data controller or
processor, which the CJUE has reaffirmed in the Weltimmo case,
148 is now reflected
in recital 22 of the GDPR, which states that:
Establishment implies the effective and real exercise of activity through stable arrangements.
The legal form of such arrangements, whether through a branch or a subsidiary with a legal
personality, is not the determining factor in that respect.
The European approach in respect of the scope of application of personal data
protection rules, centered on the place of establishment or the domicile of the data
145 See, supra, para 7.3.
146 See CJEU of 13 May 2014, rendered in case C-131/12, Google Spain SL and Google Inc., ECLI:
EU:C:2014:317, para. 56.
147 See ibidem, para. 57.
148 See the judgment rendered on 1 October 2015 in case C-230/14, Weltimmo s.r.o. v Nemzeti
Adatvédelmi és Információszabadság Hatóság, ECLI:EU:C:2015:639.
Data Protection in the Internet: General Report
31