GDPR Territorial Scope – Draft Guidelines Released That May Help Canadians Established Outside The EU Understand Whether They Must Comply

At the end of November, the European Data Protection Board (the "EDPB") released Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) (the "Guidelines") for public consultation.

The Guidelines reiterate that the General Data Protection Regulation (the "GDRP") has a broad scope for the protection of personal data, not only of EU citizens, but for everyone. In other words, the GDRP applies to data subjects in the EU, regardless of nationality or legal status. 

Article 3 of the GDRP defines its territorial scope on the basis of two main criteria: (1) the "establishment" requirement (Article 3(1)) meaning an EU-based data controller or processor); and (2) the "targeting" requirement (Article 3(2) where a controller or processor is not established in the EU but is engaging in certain processing activities). Where one of these two criteria is met, the GDPR will apply to the processing of personal data by the controller or processor.