through stable arrangements regardless of the legal form (branch, subsidiary. . .) of
such arrangements (Recital 22). According to the guidance provided by the CJEU in
its Google Spain judgment, the processing of personal data can be regarded as
carried out “in the context of the activities of an establishment” where the activities
of a processor not established in the Union, such as a provider of a search engine or
social network service, are inextricably linked those of its establishment situated in
the Member State concerned.
34
Second, the GDPR applies to the processing of personal data of data subjects who
are in the Union by a controller or processor not established in the Union, where the
processing activities are related to: (a) the offering of goods or services, irrespective
of whether a payment of the data subject is required, to such data subjects in the
Union; or (b) the monitoring of their behaviour as far as their behaviour takes place
within the Union. [Article 3(2).] Recital 23 of the GDPR clarifies that in order to
determine whether goods or services are being offered to data subjects who are in the
Union, it should be ascertained whether it is apparent that the controller or processor
envisages offering services to data subjects in one or more Member States in the
Union. The mere accessibility of a website in the Union or the use of a language
generally used in the third country where the controller is established is not regarded
as sufficient to ascertain such intention, but factors such as the use of a language or a
currency generally used in one Member State or the mentioning of customers who
are in the Union, may be significant to conclude that the controller envisages offering
goods or services to data subjects in the Union. The factors provided by the CJEU in
its Pammer and Hotel Alpenhof Judgment concerning the application of the special
jurisdiction provisions protecting consumers to persons that direct their commercial
activities to the Member State of the consumer’s domicile may also be relevant in
this context.
35 Furthermore, pursuant to Recital 24 of the GDPR, in order to
determine whether a processing activity can be considered to monitor the behaviour
of data subjects, it should be ascertained whether persons are tracked on the internet
including potential subsequent use of profiling a natural person for behavioural
advertising practices.
36
Finally, the third group of situations where the GDPR applies is the processing of
personal data by a controller not established in the Union, but in a place where
Member State law applies by virtue of public international law, such as in a Member
State’s diplomatic mission or consular post.
34 CJEU Judgment of 13 May 2014, rendered in case C-131/12, Google Spain SL and Google Inc.
v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, ECLI:EU:
C:2014:317, paras 55 and 56. See also Article 29 Working Party on Data Protection, “Update of
Opinion 8/2010 on applicable law in light of the CJEU judgment in Google Spain”, 16 December
2015, Annex II; Kuner (2015), Oro Martínez (2015) and Van Alsenoy and Koekkoek (2015).
35 Judgment of the CJEU of 7 December 2010, Peter Pammer v. Reederei Karl Schlüter GmbH &
Co KG (C-585/08) and Hotel Alpenhof GesmbH v. Oliver Heller (C-144/09), ECLI:EU:
C:2010:740, paras. 77–78.
36 On the data protection implications of those practices, see Article 29 Working Party on Data
Protection, Opinion 2/2010 on online behavioural advertising, WP 171, adopted on 22 June 2010.
474
P. A. de Miguel Asensio
such arrangements (Recital 22). According to the guidance provided by the CJEU in
its Google Spain judgment, the processing of personal data can be regarded as
carried out “in the context of the activities of an establishment” where the activities
of a processor not established in the Union, such as a provider of a search engine or
social network service, are inextricably linked those of its establishment situated in
the Member State concerned.
34
Second, the GDPR applies to the processing of personal data of data subjects who
are in the Union by a controller or processor not established in the Union, where the
processing activities are related to: (a) the offering of goods or services, irrespective
of whether a payment of the data subject is required, to such data subjects in the
Union; or (b) the monitoring of their behaviour as far as their behaviour takes place
within the Union. [Article 3(2).] Recital 23 of the GDPR clarifies that in order to
determine whether goods or services are being offered to data subjects who are in the
Union, it should be ascertained whether it is apparent that the controller or processor
envisages offering services to data subjects in one or more Member States in the
Union. The mere accessibility of a website in the Union or the use of a language
generally used in the third country where the controller is established is not regarded
as sufficient to ascertain such intention, but factors such as the use of a language or a
currency generally used in one Member State or the mentioning of customers who
are in the Union, may be significant to conclude that the controller envisages offering
goods or services to data subjects in the Union. The factors provided by the CJEU in
its Pammer and Hotel Alpenhof Judgment concerning the application of the special
jurisdiction provisions protecting consumers to persons that direct their commercial
activities to the Member State of the consumer’s domicile may also be relevant in
this context.
35 Furthermore, pursuant to Recital 24 of the GDPR, in order to
determine whether a processing activity can be considered to monitor the behaviour
of data subjects, it should be ascertained whether persons are tracked on the internet
including potential subsequent use of profiling a natural person for behavioural
advertising practices.
36
Finally, the third group of situations where the GDPR applies is the processing of
personal data by a controller not established in the Union, but in a place where
Member State law applies by virtue of public international law, such as in a Member
State’s diplomatic mission or consular post.
34 CJEU Judgment of 13 May 2014, rendered in case C-131/12, Google Spain SL and Google Inc.
v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, ECLI:EU:
C:2014:317, paras 55 and 56. See also Article 29 Working Party on Data Protection, “Update of
Opinion 8/2010 on applicable law in light of the CJEU judgment in Google Spain”, 16 December
2015, Annex II; Kuner (2015), Oro Martínez (2015) and Van Alsenoy and Koekkoek (2015).
35 Judgment of the CJEU of 7 December 2010, Peter Pammer v. Reederei Karl Schlüter GmbH &
Co KG (C-585/08) and Hotel Alpenhof GesmbH v. Oliver Heller (C-144/09), ECLI:EU:
C:2010:740, paras. 77–78.
36 On the data protection implications of those practices, see Article 29 Working Party on Data
Protection, Opinion 2/2010 on online behavioural advertising, WP 171, adopted on 22 June 2010.
474
P. A. de Miguel Asensio