As recital 23 of the Regulation makes it clear, in order to determine whether a
controller or processor is offering goods or services to data subjects who are in the
Union, one should ascertain whether it is apparent that the controller or processor
“envisages offering services to data subjects in one or more Member States in the
Union”, i.e., that it is targeting them.
For this purpose, the recital goes on to say, the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of
other contact details, or the use of a language generally used in the third country
where the controller is established, is insufficient; instead, “factors such as the use of
a language or a currency generally used in one or more Member States with the
possibility of ordering goods and services in that other language, or the mentioning
of customers or users who are in the Union, may make it apparent that the controller
envisages offering goods or services to data subjects in the Union”.
In what concerns the issue of whether a processing activity can be considered to
“monitor the behavior of data subjects”, recital 24 of the Regulation states that one
should ascertain whether natural persons are “tracked on the internet”. This includes
subsequent use of personal data processing techniques such as “profiling a natural
person, particularly to take decisions concerning her or him or for analyzing or
predicting her or his personal preferences, behaviors and attitudes”.
The applicability of domestic rules on data protection to foreign business operators (notably those that process such data in connection with the supply of goods or
services to persons located in national territory) is also provided for in article 75 of
the Japanese Act on Protection of Personal Information,
157 and in the Singaporean
Personal Data Protection Act 2012, which covers, according to section 2(1), companies formed under non-Singapore laws and/or resident outside Singapore.
158
A particularly difficult issue arises in connection with the applicability of the
provisions on the so-called right to be forgotten to search engine service providers
established abroad when their listings appear on websites with different domain
names: should in those cases the removal of the search results be ordered only in
respect of the website identified by a domain name that serves the forum State or
should it extend to any other sites?
157 See the Japanese National Report, Sect. 4.2.
158 See the Singaporean National Report, Sect. 4.1.
Data Protection in the Internet: General Report
33
controller or processor is offering goods or services to data subjects who are in the
Union, one should ascertain whether it is apparent that the controller or processor
“envisages offering services to data subjects in one or more Member States in the
Union”, i.e., that it is targeting them.
For this purpose, the recital goes on to say, the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of
other contact details, or the use of a language generally used in the third country
where the controller is established, is insufficient; instead, “factors such as the use of
a language or a currency generally used in one or more Member States with the
possibility of ordering goods and services in that other language, or the mentioning
of customers or users who are in the Union, may make it apparent that the controller
envisages offering goods or services to data subjects in the Union”.
In what concerns the issue of whether a processing activity can be considered to
“monitor the behavior of data subjects”, recital 24 of the Regulation states that one
should ascertain whether natural persons are “tracked on the internet”. This includes
subsequent use of personal data processing techniques such as “profiling a natural
person, particularly to take decisions concerning her or him or for analyzing or
predicting her or his personal preferences, behaviors and attitudes”.
The applicability of domestic rules on data protection to foreign business operators (notably those that process such data in connection with the supply of goods or
services to persons located in national territory) is also provided for in article 75 of
the Japanese Act on Protection of Personal Information,
157 and in the Singaporean
Personal Data Protection Act 2012, which covers, according to section 2(1), companies formed under non-Singapore laws and/or resident outside Singapore.
158
A particularly difficult issue arises in connection with the applicability of the
provisions on the so-called right to be forgotten to search engine service providers
established abroad when their listings appear on websites with different domain
names: should in those cases the removal of the search results be ordered only in
respect of the website identified by a domain name that serves the forum State or
should it extend to any other sites?
157 See the Japanese National Report, Sect. 4.2.
158 See the Singaporean National Report, Sect. 4.1.
Data Protection in the Internet: General Report
33