Does the EU General Data Protection Regulation have extra-territorial effect?

In brief - Before concluding that GDPR applies, a close analysis of what exactly the overseas entity does and the components of its supply chain is warranted

This article was first published in the Privacy Law Bulletin 17.6 and reprinted in the Financial Services Newsletter - Issue 19.8

Main points:

• Closely analyse data flows.
• Pay careful attention to how a transaction chain works in reality, as no transaction is seamless.
• Consider how entities can be structured to contain EU touchpoints and therefore risk in a manageable way.

Introduction

The European Union is (depending on the way one counts) the largest economy in the world and its constituent nations occupy prime positions in global trade. The size and effective influence of the EU's trade regime has meant that the General Data Protection Regulation (GDPR) represents a large change in the way data privacy is protected in the EU, with the regulation fundamentally reshaping healthcare to