Article 3(2) of the GDPR and the second criterion: Targeting criterion

Article 3 of the GDPR defines the territorial scope of the regulation using two main criteria with respect to businesses: “Establishment” (Article 3(1)) and “Targeting” (Article 3(2)).  Our first post in this series examined the “Establishment” criterion. In this post, we will move into the second criterion, “Targeting”.

Two Types of Targeting Activities Relating to Data Subjects in the EU

Under this criterion, the GDPR applies to two distinct and alternative types of activities, provided that these processing activities relate to data subjects that are in the Union.

Article 3(2) (a) Offering Goods or Services to Data Subjects in the EU, Irrespective of Whether a Payment of the Data Subject is Required

There are two important issues in this respect:

• Article 3 (2) (as) specifies that the targeting criterion concerning the offering of goods or services applies irrespective of whether payment is made in exchange for the goods or services provided.
• It has to be determined on a case-by-case basis whether the offer of goods or services is directed at persons in the Union.

Continue Reading Territorial Scope of the GDPR Following EDPB’s Final Guidelines (Part 2)