Concepts And Scope

Question 1

What is personal data?

Answer 1

GDPR art. 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);

an identifiable natural person is one who can be identified, directly or indirectly

Question 2

What is data processing?

Answer 2

GDPR art. 4(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means,

Question 3

What is the terriotorial score of GDPR?

Answer 3

GDPR art. 3(1): When the data controller or processor is established in EU (regardless of where the processing is happening)

GDPR art. 3(2): When the controller and the processor is not established in EU but

a) offer goods and services to data subjects in the EU
b) monitor data subjects in the EU

Question 4

What is the material scope of GDPR?

Answer 4

GDPR art. 2(1): Processing wholly or partly by automated means AND processing in form of a filing system

GDPR art. 2(2): GDPR does not apply when the processing is
(…)
c) purely private (household activity)
d) in the purpose of solving crimes (covered by the LED)

Question 5

Why is the Google Spain case relevant for the question of material and territorial scope?

Answer 5

Material: Google systematically organise search information = processing

Territorial: Google Spain is intended to promote and sell advertising space in the Search engine to inhabitants of the member State = establishment in a member State

Question 6

What does the Breyer case shows?

Answer 6

That a dynamic IP address is a personal information