Chapter 2B: Territorial and Material Scope of GDPR

Question 1

For the GDPR to be applicable, in regards to territorial scope, just one of the following three criteria must be met:

Answer 1

• Processing of personal data where a controller or processor is established in the EU
• Processing of personal data of data subjects in the EU relating to offering goods or services or monitoring behaviour in the EU
• Processing of personal data by a controller not established in the EU but in a place where member state law applies by virtue of public international law

Question 2

EDPB says processing personal data of individuals in the EU alone is not the trigger for GDPR; the important element is…

Answer 2

Targeting of data subjects in the EU.

Question 3

What can be considered ‘monitoring’ of behaviour in the EU?

Answer 3

Digital tracking of behaviour, plus CCTV usage and market surveys. EDPB adds that its not just any online collection or analysis of personal data, but dependent on purpose.

Question 4

What is the material scope of the GDPR (Article 2)

Answer 4

Processing of personal data wholly or partly by automated means or processing other than by automated means of personal data which form part of a filing system (or intended to)

Question 5

What is automated processing?

Answer 5

Any processing operation performed without human intervention

Question 6

What exclusions are there to material scope?

Answer 6

Activities outside the scope of Union Law (e.g. national security activities)

Border checks, asylum and immigration

Household activity

Law enforcement and public security