By Smith Chandra
The General Data Protection Regulation (GDPR) harmonizes data protection laws in the EU to make them fit for purpose in the ever-evolving internet age. It aims to bring better transparency to help support the rights of individuals and grow the digital economy.
The regulation imposes new rules on companies, government agencies, non-profits, and other organizations that offer goods and services to people in the EU, or that collect and analyze data tied to their personal data. From an economic standpoint, the GDPR aims to simplify the regulatory environment for international business by unifying data protection rules within the EU.
Because the GDPR is a regulation and not a directive, it is directly applicable in all EU member states starting from May 25, 2018. A directive only instructs member states to implement rules, whereas a regulation enforces them uniformly.
Territorial Applicability
According to Article 3, the territorial scope of the regulation applies in several key contexts:
- EU Establishments: It applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the actual processing takes place within the Union or not.
- Non-EU Establishments (Article 3(2)): It applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
- The offering of goods or services, irrespective of whether a payment is required, to such data subjects in the Union (known as the marketplace rule, which also covers internet-related activities).
- The monitoring of their behavior as far as that behavior takes place within the Union.
- Public International Law: It applies to the processing of personal data by a controller not established in the Union, but in a place where a Member State’s law applies by virtue of public international law.
The primary objective of the GDPR is to give citizens back control over their personal data. Applicability is strictly tied to the physical presence of an individual in the EU, irrespective of their nationality, residence, or reason for stay (as outlined in Recital 14).
The GDPR applies to goods and services offered to individuals in the Union, whether for payment or free of charge. However, it only applies if a company intends to offer goods or services to customers situated in the EU. Recital 23 notes that the company must express this intention to deal with EU users, such as by offering payment in EU currency, providing shipment options to the EU, or listing EU-specific customer care numbers.
How to Avoid GDPR Applicability
Companies seeking not to fall within the contours of the GDPR must avoid giving the impression that they offer goods and services to customers in the EU. Effective means of achieving this include:
- Displaying a disclaimer on the website or mobile app stating that neither goods nor services are intended for users from the EU.
- Disallowing customers from the EU from creating accounts on the website or app.
- Refraining from offering any services to EU customers through digital platforms.
- Avoiding user agreements with EU customers or users.
- Not accepting payments in EU currency.