Who’s Afraid Of The Proposed Data Protection Regulation?

The significant lobbying efforts by US companies regarding the proposed data protection Regulation, recently covered by the press (e.g., http://www.ft.com/intl/cms/s/0/e29a717e-6df0-11e2-983d-00144feab49a.html#axzz2KtWrMvGO), can be better understood in light of the provisions of the Regulation setting forth its scope, which lead to its extraterritorial application.

Unsurprisingly, article 1 of the Regulation sets forth that the Regulation applies "to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union". So if a controller or a processor are established in the Union, there is no doubt about it: they will be subject to the Regulation. So far, this rule merely expresses the concept of territorial application of Union law and sounds fair and straightforward. As a consequence, US companies not willing to be subject to the Regulation should simply refrain from setting up an establishment in