Pursuant to Article 3, the GDPR applies if personal data is processed by (1) an “establishment” in the EU or (2) a controller or processor not established in the EU that “targets” or “monitors” data subjects in the EU. Many companies have expressed confusion about what it means to have an “establishment” in the EU. For instance, are companies subject to the GDPR solely because they use an EU processor? Similarly, are companies without an EU presence subject to the GDPR simply because they have EU customers or clients? What qualifies as “monitoring” subjects in the EU? The draft Guidelines attempted to address many of these open questions.

The Meaning of 'Establishment'

Pursuant to Article 3(1), the GDPR applies to data processing carried out in the context of the activities of an “establishment” of an EU-based controller or processor, regardless of whether the processing takes place in the EU. The threshold for when a company has such an establishment is low enough that a single employee or agent in the EU may, in certain circumstances, qualify. For this reason, U.S. companies cannot assume that the GDPR does not apply to them because they do not have a registered office branch or subsidiary in the EU.

The GDPR left open the question of whether companies that otherwise have no presence in the EU become subject to the GDPR by retaining an EU-based processor. The draft Guidelines clarified that companies should conduct separate analyses for a data controller and a data processor and determine which, if any, are “established” in the EU within the meaning of the GDPR. The GDPR applies only to the entity (or entities) that has an EU “establishment.” For example, a Mexican retail company offering services exclusively to the Mexican market will not be subject to the GDPR simply because it retains a processor in Spain to process the personal data of clients. The processor in Spain, however, will be subject to the GDPR provisions applicable to data processors. This clarification should provide comfort to those non-EU companies that have avoided or reconsidered contracting with EU-based data processors for fear of becoming bound by the GDPR.

Targeting Criterion

Pursuant to Article 3(2), the GDPR applies even where neither the controller nor the processor are established in the EU if a company's activities are related to (1) the “offering of goods or services” to data subjects in the EU, or (2) the “monitoring” of a data subject's behavior when that behavior takes place in the EU—i.e., the company “targets” data subjects in the EU.

One of the important clarifications to Article 3(2) provided by the draft Guidelines is that application of the GDPR turns on the location of the data subject at the time of the triggering activity (the “offering of goods or services” or “monitoring”) rather than simply on whether a company processes the personal data of EU citizens. For example, if a U.S. tourist visiting an EU country downloads a city-mapping application provided by a U.S. company, the processing of the U.S. tourist's personal data in connection with the city-mapping service falls within the scope of the GDPR.

There must also be an element of “targeting” the EU data subject by way of offering goods or services or monitoring. In the above example, if the U.S. company only provides maps of geographic areas in the United States, it will not be subject to the GDPR just because a U.S. tourist chooses to download the application while visiting the EU. As another example, a U.S. hotel with no EU presence will not be subject to the GDPR simply by virtue of the fact that the hotel has guests from the EU. The hotel would, however, fall subject to the GDPR if it processes the personal data of an EU guest in connection with a specific offer directed at EU residents.

The draft Guidelines provide a list of factors to be considered in totality when determining whether goods or services “target” data subjects in the EU, including the use of an EU country's language or currency when offering goods or services. Pursuant to the draft Guidelines, mere accessibility of the non-EU company's website in the EU is insufficient to demonstrate the company's intention to target data subjects in the EU.

The draft Guidelines also emphasize that, to qualify as “monitoring” under the GDPR, the company must have the specific purpose of collecting the data at issue to analyze data subjects' behavior. Geolocation for marketing purposes, online tracking through cookies and conducting market surveys may all qualify as monitoring. As an example, a U.S. marketing company is subject to the GDPR if it advises a shopping center in France on optimal store layout based on an analysis of customer movement data.

Pursuant to Article 27 of the GDPR, once a controller or processor becomes subject to the GDPR by meeting the “targeting” criterion, it is required to have a representative in the EU. The draft Guidelines clarify that the representative must be an individual or an organization other than a company's data protection officer. Such representative must, at the very least, be tasked with facilitating communication between the data subject and the controller or processor, maintaining a record of processing activities and facilitating exchanges with a supervisory authority.

Assuming that the final Guidelines will hue closely to the draft version, which provided important clarification of certain key questions regarding the territorial reach of the GDPR, U.S. companies would be wise to reassess whether their data collection and processing activities make them subject to the GDPR and the GDPR's potential for heavy fines.

Una A. Dean is a partner and Melis S. Kiziltay Carter is an associate at Fried Frank.