The Principle of Territoriality in EU Data Protection Law

The Court had already applied a similar reasoning in S.S. Wimbledon (United Kingdom v. Japan) PCIJ Rep Series A No 1 and in the Case of the Free Zones of Upper Savoy and the District of Gex (Switzerland v France) PCIJ Rep Series A/B No 46.

See Koskenniemi (2005), p. 256.

Munari (2016), p. 34.

Although the wrongful act committed through the legislative act of the State does not come into existence due to the mere adoption of the act, but rather it originates at the moment of its concrete implementation, even if coercively. Cf. Conforti (2014), p. 391; see also Phosphates in Morocco (Preliminary Objections) PCIJ Series A/B No 74, 25–26.

See Ryngaert (2008), pp. 6–8.

Jennings and Watts (1992), p. 456. Cf. also Lowe (2006), p. 335.

Based on the principle of nationality, or active personality, a State has jurisdiction over the conduct or the actions of its citizens abroad. See generally Shaw (2008), p. 659 ff.; Arnell (2001), p. 955 ff. In more recent times, State’s practice has shown the tendency to adopt the principle of passive personality, which grants jurisdiction over an act committed by an individual outside of the State’s territory because the victim is one of its citizens, especially when it comes to certain categories of crimes. See McCarthy (1989), p. 298 ff.; Gaeta (2009), p. 325 ff. Clearly, it must always be kept in mind the difference between the various types of jurisdiction, in relation to which the above-mentioned principles may have a different meaning or play a different role.

The protective principle allows States to assert jurisdiction over individuals outside its borders whose conduct or actions may damage or threaten their vital interests. State practice in the exercise of this principle has, on the whole, been extremely cautious. The principle at stake has also been codified in some multilateral agreements in relation to specific crimes. Cf., e.g., the International Convention Against the Taking of Hostages (adopted 17 December 1979, entered into force 3 June 1983) 1316 UNTS 205, especially art. 5 (b). Cf. American Law Institute (1987), p. 237 ff.

The universality principle allows States to claim jurisdiction even when there is no link at all with the State. However, this principle is deemed to apply exclusively in the prosecution of international crimes. See generally Bassiouni (2001–2002), p. 81; O’Keefe (2004), p. 735.

This is one of the typical cases on which the exercise of criminal jurisdiction is based.

See Scott (2014b), p. 1374; Lowe (2006), p. 339. The doctrine has been developed by US case-law in relation to national competition law infringements. See especially US v Aluminium Co of America [1945] 148 F.2d 416. The effects doctrine differs from the protective principle of jurisdiction since the latter can only be invoked to protect vital interests of the State, whilst the former has a wider scope of application. See also Munari (2016), p. 36.

See especially Svantesson (2015a), p. 69 ff.

These two principles are already the foundation for the theory of jurisdiction, as it is demonstrated, for instance, by the approach taken in the ‘Draft Convention on Jurisdiction with Respect to Crime’ (1935) 29 American Journal of International Law 439.

See Kohl (2007), pp. 24–25.

As data protection laws usually regulate all types of data processing, they are by their very nature applicable to every operation that takes place on the Internet. Cf. Kuner (2010), p. 176. According to the new Regulation 2016/679 (art. 4 (1) and (2)), “personal data” means ‘any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’, while “processing” means ‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’.

The protection of personal data in electronic communications was already provided by Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector [2002] OJ L201/37. The Directive will soon be replaced by a new e-privacy Regulation, which will set forth a discipline complementary to that provided by Regulation 2016/679. Cf. Commission, ‘Proposal of a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC - Regulation on Privacy and Electronic Communications’ COM (2017) 10 final.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) [2016] OJ L119/1.

The definition is borrowed from Scott (2014a), pp. 89–90.

See International Bar Association, ‘Report of the Task Force on Extraterritorial Jurisdiction’ (2009) 7–8. See also Michaels (2005–2006), p. 1058: ‘In the domestic US paradigm, the role of boundaries is one of delimitation. The power of a court goes to the state’s boundaries, not beyond the. […] By contrast, the role of state boundaries in the international European paradigm is one of allocation: the locus of an event or a party defines the place that has jurisdiction in a multilateral fashion’.

Svantesson (2015b), p. 227. This is the case, for instance, of EU norms regulating the transfers of data from the Union’s territory to a third country and requiring a certain level of protection in the legal order of the latter. While the de facto influence on third countries of such a mechanism cannot be put in question, this kind of measure does not lead to a territorially extended (nor an extraterritorial) application of EU law in the proper sense.

Such problem will be overcome when the Regulation enters into force. See the next section.

Svantesson (2014), p. 65.

Case C-230/14 Weltimmo [2015] EU:C:2015:639, para 29. The Court recognized that the presence of only one representative of the foreign company can be considered “establishment” under the Directive. Such interpretation does not appear to fully coincide with recital 19 of the Directive which states that ‘establishment on the territory of a Member State implies the effective and real exercise of activity through stable arrangements; whereas the legal form of such an establishment, whether simply branch or a subsidiary with a legal personality, is not the determining factor in this respect’. For a more detailed discussion on the interpretation of the concept of “establishment” and on the differences between the various legislations of Member States, see Kuner (2007), pp. 117–118. See also Svantesson (2016), p. 210. In a more recent case, the Court has excluded that the mere accessibility of a website may constitute an “establishment” for the purpose of art. 4. See case C-191/15, Verein für Konsumenteninformation v Amazon EU Sàrl [2016] EU:C:2016:388, para 76: ‘while the fact that the undertaking responsible for the data processing does not have a branch or subsidiary in a Member State does not preclude it from having an establishment there within the meaning of Article 4(1)(a) of Directive 95/46, such an establishment cannot exist merely because the undertaking’s website is accessible there’.

The organisational model traditionally employed by many overseas and, especially, American companies was based on the establishment of a merely formal (non-operational) office in Ireland, in order to sell goods and services inside the EU territory and circumvent the various national laws. This model has been undermined by the decision in the Google Spain case. Cf. De Hert and Czerniawski (2016), p. 234. See also De Hert and Papakonstantinou (2015), p. 624.

It is to be noticed that the wording of article 4 does not suggest the existence of a hierarchical order between the three criteria set forth in the article. Thus, it must be concluded that they may be employed alternatively or cumulatively.

Moerel (2011), p. 28.

Art 29 Data Protection Working Party, ‘Opinion 8/2010 on Applicable Law’ (16 December 2010) 19.

Ibid., p. 20. Even the mere use by non-EU controllers of cookies, whose purpose is to identify users and prepare customized web pages for them, would bring the processing of personal data under the scope of the Directive. See Moerel (2011), pp. 39–43.

Maier (2010), p. 163, who remarks the difference in the approach enshrined in the Directive and that of the effects doctrine, followed for instance in the renown Yahoo! case.

Profiling means ‘any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements’. The Regulation sets forth a number of specific provisions with regard to profiling activities, especially art 22 which regulates automated individual decision-making based on profiling. For a more detailed discussion on profiling, see Rubinstein et al. (2008), p. 261 ff.

As for the monitoring of online activities, it shall be assumed that the data subject made use of servers located on European territory. In this light, the criterion also includes the case of “equipment” located on the territory and utilized for the purpose of processing as referred to in the aforementioned Directive.

For a definition of behavioural monitoring, see recital 24: ‘[i]n order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes’.

See Van Alsenoy (2017), pp. 87–88.

The definition of data subjects is not provided for in the regulation, but can be easily derived from the definition of “personal data” under art 4, n.1.

Ibid., para 41.

See Gömann (2017), pp. 585–586, also recalling that the intention requirement has been nonetheless “objectivized” through concrete indicators, especially in the field of consumer contracts.

See Svantesson (2015b), pp. 230–231, which takes as an example of a situation that does not fall under the scope of the regulation the case of a European citizen or resident who concludes a contract in an Australian shop. See also De Hert and Czerniawski (2016), p. 238.

Conversely, the monitoring of behaviours based on geo-localization services should be less problematic.

Svantensson (2015b), p. 231. See also Kuner (2012), p. 6.

Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories [2012] OJ L201/1. The Regulation includes certain clearing obligations and risk mitigation techniques for OTC derivatives that apply also when entities established outside the Union trade together if the transaction has an impact on EU markets.

The definition of EU financial counterparty can be found in art 2, paragraph 8 of the mentioned Regulation.

Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases [1996] OJ L77/20.

Ibid., para 39.

Joined Cases C-585/08 and C-144/09, Peter Pammer and Hotel Alpenhof [2010] EU:C:2010:740, para 76. This case-law has been confirmed in the subsequent Case C-190/11, Mühlleitner [2012] EU:C:2012:542, and Case C-218/12, Emrek [2013] EU:C:2013:666, with regard to art 17 of the Regulation 1215/2012, that repealed Regulation 44/2001.

See Reed (2012), p. 225, according to whom this model of jurisdiction can be justified in light of the fact that the seller, who directs its own online activity targeted to a specific consumer in a different State, would become part, even though for a limited span of time, of that territorial economic community. Consequently, the foreign operator should recognize the authority of the territorial State, voluntarily complying with the domestic law of the latter.

On this topic, see Scott (2014b), pp. 1348–1349, tracing back the criterion of the access to the market to the more traditional one of the conduct that takes place in a specific territory. There are also some exceptions (highlighted by the same Author), such as the one laid down in the new Regulation 600/2014 on markets in financial instruments, which excludes the applicability of said legislation to services provided within the Union’s territory when the provision was offered on the exclusive initiative of the person that received the service. Nonetheless, the exclusion in the present case is due to the qualification as professional investors of the clients in question, who can therefore be excluded from the protection offered under the Regulation. See also Gabel and Hickman (2016).

See especially Kohl (2007), pp. 26 and 111 ff.

On this topic, see Brkan (2016), p. 324.

See Case C-286/90, Poulsen and Diva Navigation [1992] EU:C:1992:453, para 9. On the applicability of customary law to the European Union, see generally Gianelli (2012), p. 93.

Case C-366/10, Air Transport Association of America [2011] EU:C:2011:864, para 123. On the ATAA case see Denza (2012), p. 314; de Baere and Ryngaert (2013), p. 389; Odermatt (2013–2014), p. 143.

See the well-known excerpt from Section 403 of the Third Restatement of the Foreign Relations Law of the United States: ‘[e]ven when one of the bases for jurisdiction under § 402 is present, a state may not exercise jurisdiction to prescribe law with respect to a person or activity having connections with another state when the exercise of such jurisdiction is unreasonable’. See also Hixson (1988), p. 127.

Belonging to international customary law. See Legality of the Threat or Use of Nuclear Weapons (Advisory Opinion) [1996] ICJ Rep 226, para 41.

See Cannizzaro (2000), p. 204.

The role played by the principle of proportionality in relation to unilateral measures of the State has been recognized in the context of international law of the sea, especially with respect to the claims for the use of areas outside the exclusive jurisdiction of an individual State. See also the work of the International Law Commission and particularly the ‘Report of Special Rapporteur Francois’ (1956) 2 Yearbook of the International Law Commission 1 (Report of the Special Rapporteur Francois), para 56.

Along the same lines as conflict rules in private international law. Cf. Report of Special Rapporteur Francois (n 63), para 56.

Contra the application of this method, only used in a few States, within the international legal order, see Picone (1989), p. 81.

Svantesson (2015a), p. 71. But see Ryngaert (2015), p. 81 ff.

Contra Munari (2016), p. 66, according to whom, in the context of conflicts of jurisdiction, arguments such as that of the balance of interests are often used to justify ex post the existence of an interest of the State, rather than to predetermine the legitimacy of the interest to the unilateral exercise of jurisdiction.

See Scott (2014b), p. 1345. In this context, recourse could be made also to proportionality as a general principle of EU law. See case C-265/87, Hermann Schräder HS Kraftfutter GmbH & Co. KG v Hauptzollamt Gronau [1989] EU:C:1989:303, para 21.

See De Hert and Czerniawski (2016), pp. 239–240.

Such as having in place adequate safeguards that can provide a protection equivalent to that of EU law. For an overview on the safeguard clauses laid down in this type of measures adopted by the EU, see Scott (2014b), p. 1364 ff.

See Kuner (2015), p. 242.

One of these tasks is to act as the contact point for the supervisory authority on issues relating to processing.

Gömann (2017), p. 588.

The case was thus related to the exercise of enforcement jurisdiction rather than of prescriptive jurisdiction. When the Congress passed the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) in 2018 the case was definitively vacated.

See in this regard Goldsmith (1997–1998), p. 475.