Territorial And Material Scope Flashcards
What is Opinion WP 179?
Article 29 Working Party- test is whether necessary human and technical resources are available, not just where an entity is Incorporated.
What types of processing does the GDPR not apply to, in terms of material scope?
Processing for domestic purposes, or processing which is regulated by another EU data protection law, such as Regulation 45/2001, which applies to the processing of personal data by EU institutions.
What is the meaning of “establishment” in the GDPR?
Recital 22: Establishment means the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.
What does Opinion WP 179 state on the concept of establishment?
The test is whether necessary human and technical resources are available, not just where an entity is incorporated. A single server would not be enough.
What is the test for whether an org is offering goods or services to data subjects in the EU?
Recital 23: whether it is apparent that the controller or processor envisages offering services to data subjects in one or more member states in the union.
What does monitoring mean?
Recital 24: Monitoring specifically includes the tracking of individuals online to create profiles, including where this is used to make decisions particularly concerning them or for analysing or predicting their personal preferences, behaviours and attitudes. E-commerce Companies will be caught by Article 3(2)(b).
What Processing activities fall outside the scope of Union law?
Processing operations that concern public security, defence and national security. Personal data initially collected for commercial purposes but subsequently used for security purposes may fall within these exemptions.
What does the household exemption under Article 2(2) (c) of the GDPR cover?
Includes correspondence and the holding of address books even if they incidentally concern or may concern the private life of other persons provided their use is for personal purposes and not connected to professional or business activities.
Social networking and online activities used for social and domestic purposes will also be covered.
In the Brussels I Regulation context, what considerations would be helpful to interprete Article 3(2)(a) of the GDPR?
Patent evidence, such as payment of money to a search engine to facilitate access to a member state and other factors including:
- The international nature of the relevant activity
- mentions of telephone numbers with an international code
- Use of a top level domain name like .de
- Description of itineraries from member states to the place where the service is provided
- Mentions of an international clientele composed of customers domiciled in various member states
What is the relationship between the GDPR and the ePrivacy directive?
Article 95 states that the regulation does not impose additional obligations. However it may still influence the interpretation of the ePrivacy directive. for example, direct marketing may still have to comply with the more stringent consent requirements under the regulation.
What is the scope of this competent authorities under the LEDP Directive?
(A) Any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or
(B) any other body or entity entrusted by member state law to exercise public authority and public powers
What is the relationship between the e-commerce directive and the GDPR?
The liability of Internet service providers for the actions of users will be determined by the e-commerce directive but other matters such as obligations to erase or rectify data or obligations on an ISP concerning its own uses of personal data will be covered by the GDPR. However the point remains unclear.
What did Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment cover?
These changes may occur when:
- a single or main establishment is relocated from one EEA country to another EEA country
- a single or main establishment ceases to exist
- a main establishment is set up on an EEA’s territory or moves from a third country to an EEA territory
Competence to act can switch to another supervisory authority in case of a documented change in the circumstances relating to that main or single establishment until a final decision has been reached.
