Читать книгу Privacy and Data Protection based on the GDPR - Leo Besemer - Страница 50

At first sight this seems to be a clear definition, but it is not. According to its subtitle the GDPR is “Text with EEA Relevance”, which means it applies to all countries within the European Economic Area (EEA)¹⁴. These are all EU Member States plus some countries which are members of the European Free Trade Association (EFTA): Iceland, Liechtenstein and Norway.

The map in Figure 1.8 only shows the EEA territories in Europe. Several European countries, however, have territories in other parts of the world, with varying degrees of autonomy. Based on Article 198 TFEU the EU recognizes nine of such territories as part of the EU: Azores and Madeira (Portuguese), Canary Islands (Spanish), French Guiana, Guadeloupe, Martinique, Saint Martin, Mayotte and La Réunion (French). These territories are within the territorial scope of the GDPR. Other overseas countries and European territories are not part of the EEA and in regards to the GDPR these are deemed “third countries”.

Figure 1.8 Map of the EEA (March 2020)

Special cases also include the Channel Islands and the Isle of Man, which are not part of the UK nor of the EU, and the Faroe Islands and Greenland which are autonomous parts of the Kingdom of Denmark but not part of the EU.

The geographical scope of the GDPR will probably vary again in future, both because of Great Britain leaving the Union and also as new countries have applied for EU membership. Bosnia-Herzegovina, Montenegro, Northern Macedonia, Serbia and Turkey were all declared “candidate countries”, whilst Albania and Kosovo have been declared “potential candidates”, which means they have a clear prospect of joining the EU in the future but have not yet been granted candidate country status.

In addition, the GDPR applies to processing of personal data by a controller not established in the EEA, but “in a place where Member State law applies by virtue of public international law”. Recital (25) gives the example of a Member State’s diplomatic mission or consulate. For the same reason the GDPR also applies to processing aboard ships that are registered in an EU Member State, regardless of wherever in the world the ship actually is.

Example: The Dutch consulate in Kingston, Jamaica, opens an online application process for the recruitment of local staff in order to support its administration. While the Dutch consulate in Kingston is not established in the Union, the fact that it is a consular post of an EU country where Member State law applies by virtue of public international law, renders the GDPR applicable to its processing of personal data.

Example: A German cruise ship travelling in international waters is processing data of the guests on board for the purpose of tailoring the in-cruise entertainment offer. While the ship is located outside the Union in international waters, the fact that it is a German registered cruise ship means that by virtue of public international law the ship is considered German territory. As a consequence, the GDPR is applicable to its processing of personal data, as per Article 3(3).