Scope of the eu general personal data regulation

 The purpose of this article is to clarify the scope of the Regulation (eu) 2016/679 of the European parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (here in after — Regulation). The author makes a comparative legal analysis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (here in after — the Directive) and Regulations. As a result of the study, the author distinguishes between the territorial and extraterritorial scope of the Regulation.
The author clarifies the content of the concepts of “equipment” and “the  establishment” of the controller and the person processing personal data in the context of the application of the Regulations. The article concludes that since no changes were made to the concept of “the establishment” when the Directive was repealed, a broad interpretation of this concept in judicial practice can also be applied to the territorial scope of the Regulation.
The continuity of the wording of the Directive and the Regulation allowed the author to conclude that the extraterritorial scope of the Regulation can be seen not only in Part 2 of Article 3 of the Regulation, which provides for its direct extraterritorial effect, but also in Part 1 of Article 3, which specifies the territorial scope of its action, on the basis of criteria that are based solely on the territory of the EU member States, such as the “place of establishment” of the controller or the person processing personal data. 

1. Бабаев А. Б., Бабкин С. А., Бевзенко Р. С., Белов В. А., Тарасенко Ю. А. Гражданское право. Актуальные проблемы теории и практики : в 2 т. / под общ. ред. В. А. Белова; 2-е изд., стереотип. — М. : Юрайт, 2015. — Т. 2. — 1161 с.

2. Долинская В. В. Защита прав в сфере персональных данных в России и ЕС // Законы России: опыт, анализ, практика. — 2019. — № 9. — С. 22—29.

3. Зимненко Б. Л. Международное право и правовая система Российской Федерации. Особенная часть : курс лекций. — М.: Статут, 2010. — 543 с.

4. Касенова М. Б. Некоторые замечания относительно диверсификации правового регулирования защиты персональных данных: подход Европейского Союза // Юридическая наука. — 2018. — № 2. — С. 17—26.

5. Лукашук И. И. Международное право. Общая часть : учебник для студентов юридических факультетов и вузов. 3-е изд., перераб. и доп. — М. : Волтерс Клувер, 2008. — 415 c.

6. Международное право. Общая частья: учебник / под ред. Р. М. Валеевой, Г. И. Курдюкова. — М. : Статут, 2011. — 543 с.

7. Талапина Э. В. Защита персональных данных в цифровую эпоху: российское право в европейском контексте // Труды института государства и права российской академии наук. — 2018. — № 5. — С. 117—150.

8. Толстых В. Л. Курс международного права : учебник. — М. : Проспект, 2018. — 736 с.

9. Хименес де Аречага Э. Современное международное право. — М.: Прогресс, 1983. — 480 c.

10. Akehurst M. A. Modem Introduction to International Law. — 5th ed. — London, 1985. — 310 p.

11. Azzi A. The Challenges Faced by the Extraterritorial Scope of the General Data Protection Regulation // Journal of Intellectual Property, Information Technology and E-Commerce Law. — 2018. — Vol. 9 (2). — URL: https://www.jipitec.eu/issues/jipitec-9-2-2018/4723.

12. Colangelo A. J. What is extraterritorial jurisdiction? // Cornell Law Abstract. — 2014. — Vol. 99. — P. 1303—1352.

13. Gullaker H. The extraterritorial scope of European data protection law: The changes in extraterritorial scope between the Data Protection Directive and the General Data Protection Regulation. Р. 15 // URL: https://www.duo.uio.no/bitstream/handle/10852/60636/586.pdf?sequence=1&isAllowed=y (дата обращения 14.11.2020).

14. Moerel L. The long arm reach of EU data protection law: Does the Data Protection Directive apply to processing of personal data of EU citizens by websites worldwide? // International Data Privacy Law. — 2001. — № 1 (1). — Pр. 28—45.

15. Moniz G. C. Finally: a coherent framework for the extraterritorial scope of EU data protection law — WЕe end of the linguistic conundrum of Article 3 (2) of the GDPR // UNIO — EU Law Journal. — 2018. — Vol. 4. — № 2. — Рр. 105—116.

16. Parrish A. Reclaiming International Law from Extraterritoriality // Minnesota Law Abstract. — 2009. — Vol. 93. — P. 815—874.

17. Savelyev A. Russia’s new personal data localization regulations: A step forward or a self-imposed sanction? // Сomputer law & security review. — 2016. — Vol. 32. — P. 128—145.

18. Senz D., Charlesworth H. Building Blocks: Australia’s Response to Foreign Extraterritorial Legislation // Melbourne Journal of International Law. — 2001. — Vol. 2. — URL: https://law.unimelb.edu.au/__data/assets/pdf_file/0019/1680004/Senz-and-Charlesworth.pdf.

19. Spencer A. B. Jurisdiction and the Internet: Returning to Traditional Principles to Analyze Network-Mediated Contacts // University of Illinois Law Abstract. — 2006. — Vol. 71 (102). — P. 71—126.

20. Zerk J. A. Extraterritorial Jurisdiction: Lessons for the Business and Human Rights Sphere from Six Regulatory Areas. — Working Paper № 59. — Harvard Corporate Social Responsibility Initiative, 2010. — 222 p.