Frequently Asked Questions on PrighterGDPR-Rep

According to Art 27 GDPR, controllers or processors are exempted from the regulation if ALL of the following criteria are met:

• personal data is only processed occasionally, which is only from time to time and non-systematic; AND

• data processing does not include large-scale processing of special categories of personal data or personal data relating to criminal convictions and offences; AND

• data processing is unlikely to result in a risk to the rights and freedoms of data subjects.

It is hard to meet ALL of these criteria, in particular the criterion of processing data only occasionally proves to be a big hurdle for most businesses.

Your company's intention to establish commercial relations with EU customers needs to have manifested in a business activity. The mere accessibility of a website in the EU, a mention on the website of an e-mail or geographical address, or of a telephone number without an international code, does not, of itself, provide sufficient evidence to demonstrate the intention to offer goods or services to EU customers. The EDPB listed the factors to be taken into account when assessing if goods and services are offered in its Guideline 3/2018 on the territorial scope of GDPR. Some of the factors are:

• using languages of EU Member States or offering payments in a currency of an EU Member State;
• using Google or Facebook ads to address the EU market or any other marketing activity directed towards EU customers;
• mentioning EU references or testimonials;
• an international nature of the activity at hand, such as certain tourist activities;
• mentioning dedicated addresses or phone numbers to be reached from an EU country;
• use of EU top-level domains;
• description of travel instructions from one or more other EU Member States to the place
  where the service is provided;
• offering the delivery of goods to EU Member States;

In a nutshell, if your company has any outbound activity in the EU or if your company enables or guides EU customers to find your company's product, GDPR is likely to apply.  

Not all online collection or analysis of personal data of individuals in the EU counts automatically as “monitoring”. Monitoring the behaviour of EU data subjects implies an intention to collect data for a specific purpose. Therefore, any kind of tracking of natural persons on the Internet, including the potential subsequent use of profiling techniques qualifies as "monitoring". Again, the EDPB gives some more guidance in the Guidelines 03/2018. According to the EDPB, monitoring may not only take place in the internet but also through wearables and other smart devices. Monitoring activities include:

• Behavioural advertisement
• Geo-localisation activities, in particular for marketing purposes
• Online tracking through the use of cookies or other tracking techniques such as fingerprinting
• Personalised diet and health analytics services online
• CCTV
• Market surveys and other behavioural studies based on individual profiles
• Monitoring or regular reporting on an individual’s health status

The GDPR extends its ‘territorial scope’ to controllers and processors that have their registered office in a country outside of the EU. As a result, the exorbitantly high penalties of up to €10 million or 2% of the worldwide annual turnover can apply if a processor or a controller does not comply with the obligation of appointing an EU representative. The penalties may be enforced by individual claims or by authorities. Furthermore, your partners in the EU may be obliged to stop transferring data to your company.