The legality of EU’s extraterritorial jurisdiction and
enforcement stemming from Article 3(2) of the
General Data Protection Regulation (GDPR)
-European Union Law Master Thesis-
Author: Laura Bante
Student Nr. 12685186
laura_bante@hotmail.com
Supervisor: Dr Eva Kassoti
ABSTRACT
The Union’s legal order as of today faces the challenges of an ever-evolving, open, and independent structure, thus unique that is referred to as the Internet.
Rather than stepping back, the European Union is seizing the rise of this new structure as an opportunity to export its constitutional values to the wider world.
Article 3(2) of the General Data Protection Regulation adopted in 2016 embodies this quest of becoming a global driver in the strengthening of data privacy rights for all. In fact, Article’s 3(2) GDPR territorial scope goes beyond the Union, as it applies to firms located completely outside the Union’s territory which have online access to data of European citizens. This comes with various uncertainties: Is the Union legally entitled to rule over entities located within the territorial borders of another State, outside its jurisdiction? Do foreign businesses targeting EU users have to comply with the GDPR? How can such an Article be enforced?
The thesis argues that Article’s 3(2) GDPR prescriptive jurisdiction – competence of the State to enact legal norms over conduct and activities - to be lawful in light of Public International Law and European Law. Both legal perspectives are taken into consideration, as European Law provides for incorporation of Public International Law in jurisdictional matters. While asserting extraterritorial jurisdiction is only admitted in exceptional cases, Article 3(2) GDPR falls precisely into that category as it relies on today’s widely recognised effects doctrine.
The thesis finds a legal gap of the Article’s enforcement jurisdiction – the ability of a State to enforce its laws through compliance with executive decisions or court orders. Past case law from the Court of Justice of the European Union in the field of data protection and competition law reveals that the effects doctrine can indeed lawfully form part of the Union’s enforcement jurisdiction. Potential limitations to such jurisdiction may arise. Therefore, the thesis suggests enacting agreements with third States and applying a modified version of the rule of reason as to provide a multilateral solution to jurisdictional conflicts over global data flows.
Table of Contents
1. Introduction ... 1
1.1 Objective and Outline ... 2
2. Chapter 1: Extraterritorial Jurisdiction and its Application to Article 3(2) GDPR ... 4
2.1 Public International Law ... 4
2.2 Prescriptive Jurisdiction ... 6
2.3 The Effects Doctrine ... 11
3. Chapter 2: Enforcement of Article 3(2) GDPR ... 18
3.1 Enforcement of European Data Protection Law: CJEU Case law ... 19
3.2 Comparison with the Extraterritorial Enforcement of European Competition Law . 23 4. Conclusion ... 25
4.1 Results ... 25
4.2 Limitations to Article’s 3(2) GDPR Extraterritorial Enforcement Jurisdiction ... 26
4.3 Solutions from European Competition Law ... 28
4.4 Final Conclusion ... 31
1. Introduction
The General Data Protection Regulation (GDPR)1 adopted by the European Union (EU) in
2016, can be viewed as one of the most influential tools of cyber regulations worldwide.2 The
Regulation provides for stricter privacy laws within the Union. In its Art. 3(2) it also introduces an obligation addressed to businesses in contact with data of European consumers located entirely outside the borders of the Union. This relates to the concept of extraterritoriality, defined as the application and enforcement of national legislation to acts taking place abroad.3
Such an extraterritorial scope is however controversial and translates into an extension of EU jurisdiction over other State’s jurisdiction.4 However, the limitations to such jurisdiction are
not easily established as the activities it regulates occur via the internet, a global system that is not subject to the jurisdiction of a particular state.5
It appears that the Union perceives the Internet’s independent and accessible configuration as an opportunity to exert considerable influence by exporting its own constitutional values.6 In
fact, pursuant to Art. 2, 3(2) and Art. 21(1) TEU the Union is founded on certain fundamental values such as democracy and the observance of human rights which it is to promote internationally.7 In addition, the GDPR specifically aims to safeguard the right to data
protection, enshrined in Art. 8 of the Charter of Fundamental Rights of the EU.8 This
strengthens the EU’s unilateral assertions of jurisdiction as no “limiting jurisdictional clause” to the Charter exists.9 Therefore, there is a risk that international tensions may arise in the
future. In fact, other States could argue to have a greater degree of connection to the matter,
1 Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L119/1
2 Christopher Kuner, The Internet and the Global Reach of EU Law, in Marise Cremona and Joanne Scott (eds), EU Law Beyond EU Borders: The Extraterritorial Reach of EU Law (OUP, 2019) 126
3 Menno T Kamminga, Extraterritoriality (Max Planck Encyclopedia of Public International Law, OUP 2012) 4 Cedric Ryngaert, Mistale Taylor, The GDPR as Global Data Protection Regulation? vol 114 (AJIL, CUP 2020), 5,6,8, defining extraterritoriality as follows: ‘the “extraterritorial” application of EU data protection law nevertheless has identifiable jurisdictional bases under public international law. First, the long arm of EU data protection law, with its attendant extraterritorial impact, is arguably based on territoriality, as it is triggered by a territorial link of an activity or person with the EU. Under the GDPR, territoriality may even be the key principle, where application of the Regulation to entities not based in the Union is triggered by their targeting or monitoring those “in the Union.” In the literature, this process has usefully been termed “territorial extension”‘.
5 Christopher Kuner, The Internet and the Global Reach of EU Law, in Marise Cremona and Joanne Scott (eds), EU Law Beyond EU Borders: The Extraterritorial Reach of EU Law (OUP, 2019) 112
6 Ibid. 113
7 Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art. 2, 3(1), 21(1) 8 Charter of Fundamental Rights of the European Union [2012], OJ C 326/391, Art. 8
9 Cedric Ryngaert, Mistale Taylor, The GDPR as Global Data Protection Regulation? vol 114 (AJIL, CUP 2020) 6
denying the EU’s assertion of jurisdiction creating a conflict between competing jurisdictions.10 According to Art. 3(5) and 21(1) of the Treaty on European Union, the EU is
committed to the strict observance of international law.11 Therefore, the Union’s extension of
jurisdiction has to comply with the requirements of Public International Law (PIL). This entails a variety of ramifications that will be addressed in detail throughout the thesis.
Article 3(2) of the GDPR reads:
“This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.”
1.1 Objective and Outline
The thesis aims to clarify the EU’s ability to prescribe and enforce its laws outside its borders in the field of data protection law to address the legal uncertainties for business abroad and the risks of conflict with other jurisdictions. As previously mentioned, Art. 3(5) and 21(1) of the Treaty on European Union mandates the EU to comply with PIL. In addition, Air Transport
Association of America provides for the adoption of PIL’s jurisdictional concepts within the
Union’s legal order. Thus, the thesis focuses on answering whether Article’s 3(2) GDPR extraterritorial jurisdiction is legal from both a Public International and European Law perspective. In fact, permissive principles of PIL such as the effects doctrine enabling States to assert prescriptive jurisdiction will be analyzed and applied to Art. 3(2) GDPR (Section 2:
Chapter 1 “Extraterritorial Jurisdiction and its Application to Article 3(2) GDPR”).
“When the jurisdictional scope of the law is much broader than the chance that the law will be enforced, there is a risk that respect for the law will be diminished.”12
10 Ibid. 8
11 Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art 3(5), 21(1)
12 Christopher Kuner, Data Protection Law and International Jurisdiction on the Internet, Part 2, vol 18 (Int'l JL & Info Tech, 2010) 235
Kuner’s words illustrate the importance of enforcement jurisdiction to protect the essence of the rule of law, a fundamental value of the Union.13 Therefore, the thesis also explores case
law from the Court of Justice of the EU (CJEU) in the field of data protection to assess whether the EU has been able to enforce the data protection laws it prescribes extraterritorially (Section
3: Chapter 2 “Enforcement of Article 3(2) GDPR). It will appear that all the existing cases
concern companies with a representative branch located within the Union (Section 3.1:
Chapter 2 “CJEU Case Law: Enforcement of European Data Protection Law”).14 Thus,
the thesis identifies a gap in the possibility to enforce the GDPR to firms with no establishment in the Union.15
The gap will be addressed by drawing inspiration from EU competition law (Section 3.2:
Chapter 2 “Comparison with the Extraterritorial Enforcement of EU Competition Law”). Case law stemming from EU competition law has precisely ruled on circumstances
involving firms located entirely outside the EU borders as the effects of their conduct affected the EU market.
Finally, the concluding chapter will summarise the findings of the thesis, providing a greater degree of legal certainty for foreign businesses that do not have any physical presence or representative branch within the Union (Section 4.1: “Results”). Then, a special focus will be brought on the practical limitations to GDPR’s enforceability (Section 4.2: “Limitations to
Article’s 3(2) GDPR Extraterritorial Jurisdiction”) and it will be discussed how these
limitations can be overcome by referring to the Union’s experience in the field of competition law (Section 4.3: “Solutions from European Competition Law”).
13 Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art. 2
14 Case C-362/14 Maximillian Schrems v Data Protection Commissioner [2015] ECR I-650, Case T-738/16 La Quadrature du Net and Others v Commission [2018] ECR II-520, Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems [pending], Case C-507/17 Google Inc. v Commission nationale de l'informatique et des libertés (CNIL) [2019] ECR-772
15 Benjamin Greze, The Extra-Territorial enforcement of the GDPR: a genuine issue and the quest for alternatives, vol 9 (International Data Privacy Law, OUP, 2019) 3, stating that “Since the GDPR came into force, firms outside the EU have been served formal regulatory actions for GDPR failures by, for instance, the English and French data protection authorities. But whether hard law can be used against such recalcitrant, negligent or wrongdoer data controller and processor is an entirely different matter. Where data controllers and processors have no establishment or assets within the EU, a number of barriers potentially undermining the protection afforded to EU data subjects arise to the smooth enforcement of cross-border measures.”
This knowledge is especially of importance today, as the impressive growth of e-commerce and other online activities calls for the need for greater clarity of the legal landscape regarding the internet, a territory that does not know any physical borders.16
2. Chapter 1: Extraterritorial Jurisdiction and its Application to Article
3(2) GDPR
This chapter aims to clarify whether Article’s 3(2) GDPR extraterritorial jurisdiction is legal from a both a Public International and European Law perspective. Thus, it will be explored under which conditions prescriptive laws applicable outside territorial borders are justified. While the initial ruling on the jurisdiction in Lotus stated that entities were attributed almost full discretion, the subsequent Barcelona Traction case set clear limitations: extraterritorial jurisdiction was only valid in light of certain permissive principles of international law. These can be listed as follows: territorial, nationality, protective, passive personality, universal, and effects principle. Art. 3(2) GDPR qualifies best for the effects principle as it applies to controllers located outside the Union but producing effects within the Union by targeting EU users. It is a variation of the territoriality principle, often relied on by the United States as well as by the Union itself. Therefore, the chapter will argue that the Union’s prescriptive jurisdiction stemming from Art. 3(2) GDPR is lawful as it complies with the effects principle of PIL in addition to fulfilling the internationally emerging rule of reason.
2.1 Public International Law
To begin with, it is necessary to establish whether Art. 3(2) GDPR satisfies the requirements set by PIL. In fact, PIL provides a framework for extraterritorial jurisdiction, enabling States to exercise regulative authority outside territorial borders. It is relevant to EU law as case law supports the inclusion of the concept in the EU legal order. In Air Transport Association of
America, the Court justified EU’s jurisdictional assertion over aircrafts landing or departing
from a Member State based on the jurisdictional concepts of PIL: the territorial link was
16 European Commission, Internet and Jurisdiction (date unknown) Press Statement <http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?action=display&doc_id=5651> accessed 1 June 2020
sufficient to lawfully establish extraterritorial jurisdiction over the aircraft’s activities and the aircrafts were required to comply with the EU Emission Trading Scheme for the full duration of the flight, including emissions released outside the EU’s territorial borders.17 The Court’s
inclusion of the concepts into the Union’s legal order stems from its constitutional mandate of “strict observance of international law” as well as “respect for the principles of international law”.18
Over the years state practice and opinio juris - which according to Art. 38 of the Statute of the International Court of Justice are the elements for the formation of a customary rule of international law19 - have crystallized into three types of jurisdictions addressing such unilateral
assertion of jurisdiction: prescriptive, enforcement, and adjudicative jurisdiction.20
Prescriptive jurisdiction relates to the legislative competence of the State to enact legal norms and regulate activities. Enforcement jurisdiction enables States to enforce laws and ensure compliance via executive orders or court judgments. Lastly, adjudicative jurisdiction refers to the States’ ability to apply the laws to specific persons or entities within judicial proceedings.21
Before providing an in-depth analysis of the different types of jurisdiction from a PIL perspective, it is crucial to comprehend the term of ‘jurisdiction’ itself.
Jurisdiction is based on the legal assumption of power exercised by the State. Thus, the
term relates to the State’s competence to assert normative power over regulation of behaviours or events.22 International law scholars such as Bowett have defined jurisdiction as “a
manifestation of state sovereignty (…) the capacity of a State under international law to
17 Case C-366/10 Air Transport Association of America [2011] ECRI-13755, para 125, stating that ‘In laying down a criterion for Directive 2008/101 to be applicable to operators of aircraft registered in a Member State or in a third State that is founded on the fact that those aircraft perform a flight which departs from or arrives at an aerodrome situated in the territory of one of the Member States, Directive 2008/101, inasmuch as it extends application of the scheme laid down by Directive 2003/87 to aviation, does not infringe the principle of territoriality or the sovereignty which the third States from or to which such flights are performed have over the airspace above their territory, since those aircraft are physically in the territory of one of the Member States of the European Union and are thus subject on that basis to the unlimited jurisdiction of the European Union.’
18 Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art 3(5), 21(1) 19 Statute of the International Court of Justice [1946] Art. 38
20 Menno T Kamminga, Extraterritoriality (Max Planck Encyclopedia of Public International Law, OUP 2012) 21 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015), 9
22 Patrick Capps and others (eds), Asserting Jurisdiction: international and European legal approaches (1st edn, Hart Publishing, 2003) 3
prescribe or to enforce a rule of law”.23 Others specify that its meaning is closely linked to
international rules on “allocating competence”, so no conflict of authority between States arises.24 It appears that jurisdiction relates to the principles of international law of
non-intervention and sovereign equality, delimiting the reach of laws and guaranteeing that “States, especially powerful States, do not assert jurisdiction over affairs which are the domain of other States”.25 Besson defines jurisdiction as “the competence of each state to prescribe, enforce,
and adjudicate, primarily on its territory, but also in exceptional cases outside the latter: e.g., on aircraft and ships, by embassies and consulates or by invitation to do so”.26
Thus, jurisdiction can be extraterritorial, but it needs to be based on the lawful assertion of jurisdiction to avoid inter-state conflicts and safeguard States’ peaceful coexistence.
This part mainly focuses on prescriptive jurisdiction to assess the legality of Art. 3(2) GDPR, as it relates precisely to that category of jurisdiction. The second and third type of jurisdiction both aim to guarantee compliance with legislation and will be relevant for Section 3, Chapter 2 (“Enforcement of Article 3(2) GDPR”).
2.2 Prescriptive Jurisdiction
The Permanent Court of International Justice was the first international court to define the theory of jurisdiction in its landmark case titled Lotus.27 The case relied on the specific nature
of international law, based on the State’s free will to base coexistence upon their submission to the rule of law.28 Thus, jurisdiction could only be restricted through common agreed-on rules
or international customs. In principle, a State would be free to exercise jurisdiction in its territory, even over conducts that materialized within the territorial borders of another State, it would only be illicit in the presence of an applicable international rule prohibiting such
23 Derek Bowett, Jurisdiction: Changing Patterns of Authority Over Activities and Resources, vol 53 (1st edn, BYIL, 1983) 1
24 Rosalyn Higgins, Problems and Process: International Law and How We Use It (Clarendon Press, OUP, 1994) 56
25 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015), 6
26 Samantha Besson, The Extraterritoriality of the European Convention on Human Rights: Why Human Rights Depend on Jurisdiction and What Jurisdiction Amounts to, vol 25 (LJIL, CUP 2012) 869
27 France v. Turkey [1927] PCIJ n 10 Series A
28 France v. Turkey [1927] PCIJ n 10 Series A, paras 18-19, stating “the rules of law binding upon States . . . emanate from their own free will” and “restrictions upon the independence of States cannot therefore be presumed.”
assertion jurisdiction.29 This constitutes a prohibitive approach to jurisdiction. This led the
Court to conclude:
“Far from laying down a general prohibition to the effect that States may not extend the application of their laws and the jurisdiction of their courts to persons, property and acts outside their territory, it leaves them in this respect a wide measure of discretion which is only limited in certain cases by prohibitive rules; as regards other cases, every State remains free to adopt the principles which it regards as best and most suitable.” (emphasis added)30
In that paragraph the Court refers to prescriptive jurisdiction. In principle, international law would allow states to enact laws on individuals, conducts and events outside its territorial borders, unless a contrary prohibitive rule applies.31 Thus, at first sight, the Union appears to
have lawfully extended its jurisdiction on data protection in Art. 3(2) GDPR to business practices of entities located outside the EU.
The EU asserted prescriptive jurisdiction in several other legislative acts. For instance, the previously cited case Air Transport Association of America concerned an EU directive claiming jurisdiction over airplanes departing and landing in the Union and requiring compliance with the EU Emission Trading Scheme for the full duration of the flight, including outside the Union’s territorial borders.32 Even if the European Court of Justice (ECJ) confirmed
the legality of such an extension of EU jurisdiction, strong opposition led to the suspension of the directive, and later to a Commission declaration that only emissions produced within the EU territorial borders to be covered by the directive.33 In 2013, the Union adopted measures
prohibiting the importation and marketing of seal products, banning seal products originating
29 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015), 33 30 France v. Turkey [1927] PCIJ n 10 Series A, paras 18-19
31 Ibid. paras 18-19: When it comes to enforcement jurisdiction, however, the Lotus case applies a permissive approach to jurisdiction: No state is to enforce its laws extraterritorially, unless there is “a permissive rule (…) from international custom or from a convention” the State can rely on. This type of jurisdiction will be further assessed in Chapter 2.
32 Case C-366/10 Air Transport Association of America [2011] ECRI-13755, para 125
33 European Commission, Stopping the clock of ETS and aviation emissions following last week’s International Civil Aviation Organisation (ICAO) Council [2012] MEMO/12/854, and European Commission, ICAO [2012] COM 20/12, see also Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 95
from “inhumane killing of seals”.34 Thus, the EU asserted jurisdiction over specific activities
located outside the Union based on its own value system.35 The ban was challenged in front of
the World Trade Organisation dispute settlement bodies, initially upheld but later rejected on appeal. However, this rejection was not established for jurisdictional reasons but because of discrimination against seal products of specific countries.36
Opposition to such an extensive competence to prescribe laws extraterritorially can be explained through the following danger: if concurring jurisdictions of states materialise, this can result in significant jurisdictional conflicts and cause deregulation of the international legal order.37 Thus, Lotus’ extension of jurisdiction is contested internationally. In fact, the risk of
encountering competing jurisdictions was already pointed out prior to Lotus in the Cutting
Case.38 This case concerned a Mexican court claiming jurisdiction over a United States (US)
citizen to condemn his acts committed against a Mexican citizen. These acts did however not take place in Mexico, but in Texas, within the territorial borders of the US.39 The Secretary of
State of the US held that such jurisdiction would disrupt the friendly international relations, their independence and negate the role of international law.40 He claimed that exterritorial
jurisdiction should be rather “an exception to the rule, either upon the general concurrence of nations or upon express conventions”.41
In the Barcelona Traction Case, the International Court of Justice (ICJ) decided to narrow
down the broad formulation of jurisdiction first enunciated in Lotus. It did acknowledge
States’ discretion to prescribe laws, but it argued that States are nevertheless bound by the following considerations:
34 WTO, European Communities: Measures Prohibiting the Importation and Marketing of Seal Products-Report of the Panel [2013] WT/DS400/R and WT/DS401/R, para 7.410
35 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 98
36 WTO, European Communities: Measures Prohibiting the Importation and Marketing of Seal Products-Report of the Panel [2013] WT/DS400/R and WT/DS401/R para 7.650
37 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015), 33 38 U.S. Department of State, Foreign Relations of the United States (1888), 751- 869
39 Ibid. 752, see also Patrick Capps and others (eds), Asserting Jurisdiction: international and European legal approaches (1st edn, Hart Publishing, 2003) Introduction xxii
40 Ibid. 753, arguing that ‘to extend (effectively, to prescribe) its jurisdiction to acts committed by foreigners outside the territory would impair (a) the independence of States and (b) amicable relations between States (…) if a Government could set up its own municipal laws as the final test of its international rights and obligations, then the rules of international law would be but the shadow of a name and would afford no protection either to States or to individuals.’
“It does, however, (a) postulate the existence of limits—though in any given case it may be for the tribunal to indicate what these are for the purposes of that case; and (b) involve for every State an obligation to exercise moderation and restraint as to the extent of the jurisdiction assumed by the courts in cases having a foreign element, and to avoid undue encroachment on a jurisdiction more properly appertaining to, or more appropriately exercisable by, another State.” (emphasis added) 42
Thus, the notion of extraterritorial prescriptive jurisdiction has evolved over time. While it began with an (almost) unlimited understanding of extraterritorial jurisdiction reflected in Lotus, today customary international law, as the ICJ asserted in the Barcelona Traction case,
has set clear limits to such jurisdiction. Indeed, the present chapter explores certain
permissive principles that explicitly grant a State the competence to exercise extraterritorial jurisdiction.43
In this light, the reach of Art. 3(2) GDPR is therefore only lawful under international law, if its adoption by the EU legislature can be based upon a permissive principle of international
law. These permissive principles are listed as follows: territorial, nationality, protective,
passive personality, universal, and effects principle.44 If any of these principles apply, a subject
of international law has a “legitimate interest” and connection over the circumstances it claims jurisdiction.45
The nationality principle relates to States enacting rules over individuals of their nationality, also when residing abroad.46 The principle finds its application mainly in criminal matters,
related to crimes committed abroad or diplomatic protection.47 The passive personality
principle follows the same reasoning but with the nuance that nationals are the victim in specific proceedings.48 The protective principle relates to a form of governmental self-defense
42 Belgium v Spain [1970] ICJ 3,Separate Opinion of Judge Sir Gerald Fitzmaurice, para 70 43 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 34
44 Rosalyn Higgins, Problems and Process: International Law and How We Use It (Clarendon Press, OUP, 1994) 56
45 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 39
46 Louis Henkin, International law: Politics, Values and Functions General Course on Public International Law, vol 216 (Collected Courses of the Hague Academy of International Law, 1990) 285
47 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 104-106 48 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 137
against harmful acts such as treason directly affecting sovereignty.49 The universality principle
enables States to assert jurisdiction over serious crimes committed anywhere in the world.50
Thus, as these principles relate to a large extent (but not exclusively) to matters of criminal law,51 this paper will focus on the territorial and effects principle.
The principle of territoriality relates to subjects of international law competence to prescribe laws on their territory.52 In light of the fundamental principles of the international legal order
of non-interference and sovereign equality, it is an exclusive competence.53 No State is to
encroach upon another State’s jurisdiction within its own territory.54 Consequently, the
extraterritorial reach of domestic laws are exceptions to the principle of territoriality.55
This principle also applies to the EU. While it is not a State, but an international organisation, the EU acts on behalf of all Member States: In light of the principle of conferral Member States have decided to confer certain powers to the Union.56 This is the case for instance within data
protection law.57 Thus, the principle of territoriality applies also to the Union, as its acts
originate from Member States’ jurisdictions. In fact, Ryngaert points out that the concept of jurisdiction is “exercised by States or regional organizations as the European Union”.58
Art. 3(2) GDPR relates to activities that take place in two different territories: the consumer or user of a specific platform is located within the European Union and the “controller” of the platform is situated in a third country. It appears that there is a territorial link with the Union since the targeted consumers reside or have an IP address within the Union. In reality, the activities, however, do not happen within a physical space, but on the internet. Thus, questions
49 Ibid. 114 50 Ibid. 147
51 Cedric Ryngaert, The Concept of Jurisdiction in International Law (UNIJURIS, 2014) 6 <https://unijuris.sites.uu.nl/wp-content/uploads/sites/9/2014/12/The-Concept-of-Jurisdiction-in-International-Law.pdf> accessed 1 June 2020
52 Louis Henkin, International law: Politics, Values and Functions General Course on Public International Law, vol 216 (Collected Courses of the Hague Academy of International Law, 1990) 274
53 Island of Palmas, US v Netherlands [1928] 2 RIAA, 829, see also Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 36
54 Ibid.
55 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 36-37
56 Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art. 13 (2)
57 Consolidated version of the Treaty on the Functioning of the European Union [2012] OJ C326/47, Art. 16 58 Cedric Ryngaert, The Concept of Jurisdiction in International Law (UNIJURIS, 2014) 1 <https://unijuris.sites.uu.nl/wp-content/uploads/sites/9/2014/12/The-Concept-of-Jurisdiction-in-International-Law.pdf> accessed 1 June 2020
arise on who is entitled to legislate upon activities that are not characterised by any traditional physical borders.59
Paradoxically, State practice, as well as the Convention on Cybercrime, attribute jurisdiction
over acts committed over the internet to the principle of territoriality. Such a connection
is to be based on one of the three following scenarios:
“(a) the production of effects within the territory, e.g. as a result of the alleged perpetrator purposely addressing content to territorially based users (…) (b) the location of the offender’s computer within the territory via an identified IP address (a variation on the subjective territoriality principle); or (c) the storage of content on a local server.” (emphasis added)60
Art. 3(2) GDPR does not relate to scenario (b) or (c) as this Article applies to “controllers” that have no IP address or server within the Union. In fact, scenario (a) is the only possible
scenario that can be invoked to argue in favor of the existence of a territorial link to the Union:
The use of Union citizens’ data by foreign controllers produces effects within the Union, affecting Union citizens’ privacy rights. This principle is known as the “the effects doctrine” which will constitute the main focus of the next section of this chapter.
2.3 The Effects Doctrine
The effects doctrine relates to acts that take place outside the territorial borders of a State but produce effects within its territorial borders.61 When investigating legal literature, it appears
that the effects doctrine is generally described as based upon the “objective territoriality
59 Christopher Kuner, The Internet and the Global Reach of EU Law, in Marise Cremona and Joanne Scott (eds), EU Law Beyond EU Borders: The Extraterritorial Reach of EU Law (OUP, 2019) 116, stating “the Internet complicates application of the territoriality principle, since it can be difficult to determine the place where a particular online action occurs. This leads to uncertainty concerning applicable law and jurisdiction, which is reflected in the challenges that the Internet presents to EU law.”
60 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 80
61 Najeeb Samie, The Doctrine of "Effects" and the Extraterritorial Application of Antitrust Laws, vol 14 (University of Miami Inter-American Law Review, 1982) 23
principle”, granting States jurisdiction over acts initiated in another State but finalised within
its territorial borders. 62
This interpretation can be applied to Art. 3(2) GDPR since the regulated act involves the IP address of both parties, the “controller” located abroad and the targeted individual within the Union. In light of the principle of objective territoriality, this suggests that at least part of the act is committed within the Union which points to the validity of Art. 3(2) GDPR.
The effects doctrine is rooted in PIL also on the basis of the Lotus ruling by the Permanent Court of International Justice: The Court ruled that Turkey could claim jurisdiction over personnel of a French vessel as “one of the constituent elements of the offense, and more specifically its effects have taken place there.”63
The US Supreme Court was the first national court to carefully formulate the doctrine in the
Alcoa Case.64 It declared an Aluminum Cartel created abroad as unlawful due to its harmful
effects on the US economy, intended by the parties:
“We should not impute to Congress an intent to punish all whom its courts can catch, for conduct which has no consequences within the United States (...) On the other hand, (...) any state may impose liabilities, even upon persons not within its allegiance, for conduct outside its borders that has consequences within its borders which the state reprehend.” (emphasis added) 65
While resistant at first, other States followed the American example. Canada issued in 1973 laws on foreign investors acquiring control over Canadian firms.66 Soon after, Sweden
62 Patrick Capps and others (eds), Asserting Jurisdiction: international and European legal approaches (1st edn, Hart Publishing, 2003) 110
63 France v. Turkey [1927] PCIJ n 10 Series A, 23
64 United States v. Aluminum Co. of America [1945] US Supreme Court 148 F 2d, 416 65 Ibid. 443
66 Canada's Foreign Investment Review Act is discussed in Andreas Lowenfeld, International Private Investment (2nd edn, 1982) 71-75
established a system of sanctions targeted towards South Africa in which it addressed subdivisions of Swedish firms.67
The EU also adopted the effects doctrine as it can be seen from its frequent application in the field of competition law. In fact, the Commission’s investigations regularly establish jurisdiction over anti-competitive practices originating abroad but deploying effects within the internal market of the Union.68 Indeed, in Grosfillex, the Union’s first competition law case,
the Commission stated:
“the territorial scope of [the competition laws] is determined neither by the domicile of the enterprises nor by... where the agreement is concluded or carried out. On the contrary, the sole and decisive criterion is whether an agreement... affects competition within the Common Market or is designed to have this effect." (emphasis added)69
A few years later, in the Alinine Dyes Cartel the Commission further clarified its approach: Competition decisions would apply to firms, established within or outside the Union’s border, “to all restrictions of competition which produce within the Common Market effects set out in Article 85 (1)”.70 Alford argues this to correspond to a more restrictive form of the effects
doctrine advocated by the US.71
The CJEU adopted the effects doctrine gradually over time:
In Dyestuffs the Advocate General recommended to the Court to rely on the doctrine.72
But instead, the Court claimed jurisdiction over the foreign company based on the principle of territoriality as one of the company’s sub-entities was located in the EU (under the so-called
67 Chief Reporter, Restatement of the Law, Third, Foreign Relations Law of the United States (The American Law Institute, 1987) Sec. 414, Reporters' note 2
68 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 110 69 Grosfillex-Fillistorf [1964] Commission Decision 3 CMLR 237
70 Aniline Dyes Cartel [1969] Commission Decision 8 CMLR, see also Roger Alford, The Extraterritorial Application of Antitrust Laws: The United States and the European Community Approaches, vol 33 (Virgina Journal of International Law, 1992) 28
71 Roger Alford, The Extraterritorial Application of Antitrust Laws: The United States and the European Community Approaches, vol 33 (Virgina Journal of International Law, 1992) 29
“economic unity theory” or “economic unity doctrine” ).73 This led the Commission to refer in
its subsequent decisions simultaneously to both, the effects and economic unity doctrine.74
In Woodpulp, the Court ruled for the first time over a company’s anti-competitive conduct with
no physical presence within the Union.75 This corresponds precisely to the situation in Art.
3(2) GDPR as it applies to firms located outside the Union. In Woodpulp the Court could not, as in previous cases, rely on the economic entity doctrine. The Advocate General advised the Court to rely on the effects doctrine.76 But the Court decided to justify its jurisdictional
assertion differently: While the results of the agreement resulted from “formation” abroad, its “implementation” occurred within the Union, and the latter being decisive.77 This enabled the
Court to claim jurisdiction based on the classical principle of territoriality, emphasising the location of implementation.78 However, in practice, the “implementation doctrine” resembles
the effects doctrine. Indeed, Wagner-van Papp argues that it is “difficult to find a meaningful nexus to the territory of the EU other than the economic effects of the conduct”.79 He states
that the Court developed that doctrine to avoid ruling on the compliance of the effects doctrine with PIL,80 but in reality the distinction of the two is artificial:
“…it seems obvious that if the effects doctrine were problematic from the perspective of public international law, so would be the implementation doctrine.
If the effects doctrine, however, is acceptable under public international law principles – and this seems not only the correct but also the prevailing view today –,then crafting a new and ill-defined ‘implementation test’ only created unnecessary uncertainty.” (emphasis added)81
73Ibid. 661-663, see also Roger Alford, The Extraterritorial Application of Antitrust Laws: The United States and the European Community Approaches, vol 33 (Virgina Journal of International Law, 1992) 30-31, stating “the Court asserted jurisdiction over the foreign undertakings by arguing that the subsidiary companies located within the EC were in fact part of the same "economic entity" as the parent companies located abroad. The Court in essence went beyond the facade of the separate legal personalities of parent and subsidiary companies and pierced the corporate veil so as to treat the parent and subsidiary as a single economic entity. It then imputed the conduct of the subsidiary established within the Community to the parent company located outside the Community.”
74 Gabrielle Marceau, Anti-Dumping and Anti-Trust issues in Free-Trade Areas (Clarendon Press, OUP, 1994) 73 75 Joined cases 89, 104, 114, 116, 117 and 125 to 129/85 A Ahlstrom Osakeyhtio v Commission [1988] ECR 5193 76 Ibid. 5217-20, 5226
77 Ibid. para 16 78 Ibid. para 18
79 Florian Wagner-von Papp, Competition Law, Extraterritoriality and Bilateral Agreements, in Ariel Ezrachi (ed), Research Handbook on International Competition Law (Edward Elgar, 2011) 27 <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1974977 27> accessed 1 June 2020
80 Ibid. 26-27 81 Ibid. 27-28
The presence of the effects doctrine in EU law can also be supported by the ruling of the Court of First Instance in Grencor,82 eight years after Woodpulp:83 The Court held that a merger
between 2 firms located outside the Union fell within its jurisdiction, as PIL permits such jurisdiction “when it is foreseeable that a proposed concentration will have an immediate and substantial effect in the Community”.84
The growth of regulatory instruments on matters with extraterritorial application comes however with a risk of burdensome intrusion in the sphere of jurisdiction of other States. This is especially problematic as PIL does not provide any rules of preference between concurring
jurisdictions.85 To address this issue, the US extracted from existing jurisprudence the
principle of reason, published as a principle of international law in its Restatement of Foreign
Law.86
The rule of reason would require States, prior to exercising prescriptive jurisdiction, to conduct an additional test assessing whether it is reasonable to do so with regards to the specific circumstances of the matter.87 Contrary to that declaration, no unanimity exists upon whether
the rule of reason has indeed become a solid principle of international law. State practice shows no manifestation of opposition, a possible explanation is that the principle is closely linked
to other international law principles such as proportionality, equity, abuse of rights,
non-intervention, and genuine connection.88 Some authors argue that it could be a matter of time
until it becomes a recognized principle of international law.89
The former analysis reveals that the effects doctrine under PIL permits the extraterritorial prescriptive jurisdiction over data protection laid down in Art. 3(2) GDPR. However, to conclude on its definite legality, it is advisable to apply the additional test of the rule of reason.
82 Case T-102/96, Gencor Ltd v Commission, [1999] ECR II-753
83 Joined cases 89, 104, 114, 116, 117 and 125 to 129/85 A Ahlstrom Osakeyhtio v Commission [1988] ECR 5193 84 Ibid. paras 90, 101
85 Louis Henkin, International law: Politics, Values and Functions General Course on Public International Law, vol 216 (Collected Courses of the Hague Academy of International Law, 1990) 293
86 Chief Reporter, Restatement of the Law, Third, Foreign Relations Law of the United States (The American Law Institute, 1987) Sec. 403, Comment a
87 Louis Henkin, International law: Politics, Values and Functions General Course on Public International Law, vol 216 (Collected Courses of the Hague Academy of International Law, 1990) 296
88 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 154 89 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 187
This can be supported by the ICJ’s dictum in the Barcelona Traction case: “the law is to be applied reasonably”.90
To apply the rule of reason, Ryngaert discerns three methods: Determining the “first-seized
State”, balancing the interests of all States involved (as advocated in the Restatement of
Foreign Law of the United States), or relying on considerations of “global justice and
welfare”.91
The “first-seized State” is not appropriate as it can lead to unjust outcomes. Indeed, it favors the State who first asserted jurisdiction but “such a rule fails to account for the strong territorial and national links with, or interests in, the situation which other States might entertain”.92
The balancing of interests requires State organs to consider the interests of different sovereigns.93 This is especially problematic from a European perspective. In fact, EU courts
are not viewed as “diplomats”, but are to abide by the rule of law, thus applying only specific “jurisdictional rules”.94 In addition, in Woodpulp95 the ECJ rejected the possibility of other
States’ jurisdictional interests to restrict the EU’s jurisdiction:
“As regards the argument relating to disregard of international comity, it suffices to observe that it amounts to calling in question the Community's jurisdiction to apply its competition rules to conduct such as that found to exist in this case and that, as such, that argument has already been rejected.” (emphasis added)96
Ryngaert favors the application of the third rule of reason related to “global justice and welfare”.97 Indeed, this method takes into account the “genuine” interests of the international
90 Belgium v Spain [1970] ICJ 3, para 93, see also Louis Henkin, International law: Politics, Values and Functions General Course on Public International Law, vol 216 (Collected Courses of the Hague Academy of International Law, 1990) 298
91 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 181 92 Ibid. 186
93 Ibid. 171
94 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 172-173
95 Joined cases 89, 104, 114, 116, 117 and 125 to 129/85 A Ahlstrom Osakeyhtio v Commission [1988] ECR 5193 96 Ibid. para 22, see also Roger Alford, The Extraterritorial Application of Antitrust Laws: The United States and the European Community Approaches, vol 33 (Virgina Journal of International Law, 1992) 36-37, stating that “The Court has no discretion to refuse jurisdiction for the sake of competing concerns such as foreign sovereignty interests or international comity”
community, offering a multilateral solution.98 I would argue that this interpretation corresponds
better to the European vision as the Union is constitutionally required to “promote multilateral solutions” in its external action.99 While GDPR does not fall under the category of EU’s
external action, extraterritoriality implies an external application, suggesting such a link to be appropriate. The thesis will thus focus on the third method.
Art. 3(2) GDPR extends the data protection it grants to its citizens also when targeted by online businesses abroad. It can be noted that many cases have been initiated in front of European courts on the unlawful data transfer between the Union and the US. In fact, in Schrems I which concerned Facebook’s practices with data of European citizens, the ECJ went on to annul the legal basis for data transfer across the two continents, the Safe Harbor Agreement.100 A few
days ago, on the 16th of July, the ECJ also invalidated its successor, the Privacy Shield
Agreement in the Schrems II ruling.101
This generates the impression that from a European perspective insufficient data protection
is provided by third countries, especially by the US.
To apply the rule of reason to Art. 3(2) GDPR, as suggested by Ryngaert, it has to be assessed if the Article enables greater social justice worldwide.102 It could be advanced that by granting
an extraterritorial application to the privacy rights of EU consumers, these rights will over time also be strengthened in other countries for local consumers, as countries will be likely to align its laws to the European laws and strengthen legal certainty for local businesses.
Therefore, it can be argued that Art. 3(2) GDPR is in accordance with the rule of reason. In addition, GDPR’s global reach has been highly influential. In 2018, the Californian State, for instance, adopted the California Consumer Privacy Act, providing a similar scope of data protection rights to Californian consumers than the GDPR grants to EU consumers.103 Brazil,
98 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 186, 187 99 Consolidated Version of the Treaty on European Union [2008] OJ C115/13, Art. 21 (1) 100 Case C-362/14 Maximillian Schrems v Data Protection Commissioner [2015] ECR I-650 101 Case C-311/18, Maximilian Schrems v Data Protection Commissioner [2020] ECR I-559 102 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 187
103 Chandu Gopalakrishnan, California's privacy act impacts UK companies as GDPR principles go global (SC Media, 2020) <https://www.scmagazineuk.com/californias-privacy-act-impacts-uk-companies-gdpr-principles-go-global/article/1669713> accessed 1 June 2020, see also Christopher Kuner, The Internet and the Global Reach of EU Law, in Marise Cremona and Joanne Scott (eds), EU Law Beyond EU Borders: The Extraterritorial Reach of EU Law (OUP, 2019) 126
New Zealand and other US States have since then issued proposals on similar data protection legislations.104 This strongly suggests a tendency of States’ alignment with European laws in
the field of data protection. I would, therefore, conclude that the EU’s prescriptive extraterritorial jurisdiction arising from Art. 3(2) GDPR complies with the requirements of
PIL and EU Law.
Finally, this chapter relied on the European treaties and the Air Transport Association of
America ruling, to indicate that the Union has included a PIL approach of jurisdiction into its
legal order. Thus, the former section assessed the legality of Art. 3(2) GDPR against recognised jurisdictional principles of PIL. Customary international law only allows States to exercise prescriptive extraterritorial jurisdiction in limited cases to safeguard the principle of non-interference. The Union has adopted a variety of legislative acts other than GDPR which entail extraterritorial assertions of jurisdiction. Such cases are to be based on specific permissive PIL principles. It can be derived for instance from the Convention on Cybercrime which regulates acts committed over the internet that Art. 3(2) GDPR best qualifies for the effects doctrine. This principle stems from the permissive principle of territoriality. In fact, the use of Union citizens’ data by foreign controllers produces effects within the Union, affecting Union citizens’ privacy rights. A variety of States such as the US but also the EU frequently rely on the effects doctrine, confirming the legality of Art. 3(2) GDPR. It is not clear whether compliance with the rule of reason advocated by the United States is required, but it could be qualified as an emerging principle of international law. In addition, the international regulatory response to the adoption of the GDPR points to its conformity with the rule of reason. Thus, Article’s 3(2) GDPR prescriptive jurisdiction appears to be lawful from a PIL and European Law perspective.
3. Chapter 2: Enforcement of Article 3(2) GDPR
The following chapter will rely on CJEU case law to shed light on the Union’s current stance on extraterritorial enforcement of data protection law. It appears that the Court generally
stretches the interpretation of the principle of territoriality to prevent other State’s resistance. Recently, however, the Court admitted the effects doctrine to be better suited for ruling over global data flows, but it is yet to rely on it. The second part of the chapter will focus on the Court’s case law in competition law. Indeed, in that field, the Court already explicitly rules on the effects doctrine. Such a comparison is helpful as the Court’s case law regarding enforcement of competition law could be transposed to the enforcement of data protection law.
3.1 Enforcement of European Data Protection Law: CJEU Case law
To begin with, since the EU incorporated a PIL approach to matters of extraterritorial jurisdiction (see Chapter 2, Section 2.1) it is necessary to assess whether PIL empowers a State to enforce laws extraterritorially (enforcement jurisdiction).
Ryngaert states that in principle, “a State cannot use coercive power to enforce its rules outside its territory”.105 In fact, the previously mentioned Lotus ruling, contrary to prescriptive
jurisdiction, already provides a restrictive interpretation of enforcement jurisdiction as it could only be relied on in light of “a permissive rule (…) from international custom or from a convention”.106 Therefore, enforcement jurisdiction has always been considered to be
exceptional: A State can only enforce its laws extraterritorially in light of the permissive
principles of international law (see Section 2.2.), or as it can be inferred from Lotus, upon agreement with the sovereign State. Since Art. 3(2) GDPR relies on the effects doctrine, the
EU appears, at first sight, to be able to not only prescribe its data protection laws but also enforce these extraterritorially.
The following cases will illustrate that the CJEU is yet to rely clearly on the effects doctrine in the field of data protection. In fact, in previous years the Court rather circumvented any controversy by consistently linking the activity to the EU territory, clinging onto a traditional interpretation of the principle of territoriality.107 Thus, the Court rather refers to the territorial
scope of Art. 3(1) GDPR which applies to “activities of an establishment of a controller or a
105 Cedric Ryngaert, Jurisdiction in International Law (2nd edn, OUP 2015) 31 106 France v. Turkey [1927] PCIJ n 10 Series A paras 18-19
107 Benjamin Greze, GDPR: The extra-territorial enforcement of the GDPR: a genuine issue and the quest for alternatives, vol 9 (International Data Privacy Law, OUP, 2019) 122
processor in the Union”.108 In fact, the Court is yet to render a judgement based on Art. 3(2)
GDPR.
In Schrems I, the ECJ ruled on the legality of Facebook’s data transfer from Ireland to the US.109 As mentioned in Section 2.3. the Court went on to annul the Safe Habour Agreement
which previously enabled data transfers between both continents. The Court’s jurisdiction was not seen as problematic, as its judgment via preliminary reference was based on a complaint concerning the practices of a representative entity of Facebook within the Union: Facebook Ireland.110 In addition, the Court ruled on the conduct of the Irish DPA within its supervisory
role over data transfers to third countries.111 Thus, the Court did not assert jurisdiction directly
over the parent company located in the US.
In Digital Rights Irleand, the Court’s desire to establish jurisdiction regarding data protection upon evident territorial link becomes especially apparent.112 In that case, the Court explored
the validity of the Data Retention Directive (Directive 2006/24/EC) in light of Art. 7 ‘Right to Privacy’, Art.8 ‘Right to Data Protection’ and Art.11 ‘ Freedom of Expression’ of the Charter of Fundamental Rights of the EU.113 The Court held that the legislature failed to provide a
sufficient level of protection as the directive did not require providers to store the data within the Union, affecting control and investigations regarding compliance with the Directive by the EU Data Protection Authorities (DPAs).114 Thus, the Court points to the importance of
associating the regulated activity to the EU territory for enforcement. This was confirmed
two years later in Tele2 Sverige and Watson.115
In Google v CNIL, the Court ruled on the territorial scope of a specific Article contained in the GDPR.116 In fact, the Court examined whether Art. 17 of the GDPR, which safeguards the right
to be forgotten, enables EU users to issue requests of removal of personal data worldwide or
108 Jure Globocnik, The right to be forgotten is taking shape: CJEU Judgements in GC and Others (C-136/17) and Google v CNIL (C-507/17) vol 69 (GRUR International, OUP, 2020) 381-382
109 Case C-362/14 Maximillian Schrems v Data Protection Commissioner [2015] ECR I-650 110 Ibid. para 28
111 Ibid. paras 47-49
112 Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v. Ireland [2014] ECR I-238 113 Ibid. para 25
114 Ibid. paras 66-68
115 Joined Cases C-203/15 and C-698/15, Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others [2016] ECR I-970
solely as they appear in search engines within the Union.117 Google argued against a territorial
extension of the right requested by the French DPA, claiming it to be, amongst others, contrary to PIL principle of non-interference.118
In this case, the Court establishes its jurisdiction again based on Google’s subsidiary’s presence on the European territory.119 Nevertheless, due to the nature of the activity (occurring over the
internet) an exterritorial application of Art. 17 GDPR would be in principle justified, referring
implicitly to the effects doctrine:
“In a globalised world, internet users’ access — including those outside the Union — to the referencing of a link referring to information regarding a person whose centre of interests is situated in the Union is thus likely to have immediate and substantial effects on that person within the Union itself.
Such considerations are such as to justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.” (emphasis added)120
However, the Court then argues that the territorial scope of the right to be forgotten only applies to European domains since the right is not universally recognised by all States and it does not appear that the Union legislator intended to confer the right to extraterritorial matters.121 Thus,
the Court aims to rule carefully, more precisely in light of the principle of proportionality, as to not encroach upon other State’s regulatory space, that weigh the right to be forgotten against the right to privacy differently.122
Nevertheless, the Court’s argumentation is questionable as Art. 3(2) GDPR is of exterritorial application.123 Such a conflicting finding can be explained by the Court’s desire to recreate a
117 Ibid. para 43 118 Ibid. para 38 119 Ibid paras 51-52 120 Ibid paras 58-59 121 Ibid. paras 59-64
122 Jure Globocnik, The right to be forgotten is taking shape: CJEU Judgements in GC and Others (C-136/17) and Google v CNIL (C-507/17), vol 69 (GRUR International, OUP, 2020) 386
123 Ibid. 386, stating that the Court’s ‘argument is not convincing. A glance into the provisions governing the territorial applicability of the GDPR reveals that the GDPR does have extraterritorial effects.This is most clear from Art. 3(2) GDPR. For example, according to Art. 3(2)(b) GDPR, the GDPR applies to the monitoring of users’ behaviour taking place in the EU (most often by setting cookies) even if the controller is not established in the EU. This leads to a de facto worldwide application of the GDPR’
form of “digital territoriality” by attributing online activities to a specific territory.124
Interestingly, while the outcome of the case is that EU law does not mandate global de-referencing, the Court clarifies that such extraterritorial enforcement can lawfully be
applied by national authorities if proportionate:
“EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (…) a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.” (emphasis added)125
This ruling can be supported by the Article 29 Data Protection Working Party’s126 statement
that dereferencing exclusively from European domains would not provide a sufficient level of protection:
“limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the judgment. In practice, this means that in any case de-listing should also be effective on all relevant domains, including .com.” (emphasis added)127
124 Yann Padova, Is the right to be forgotten a universal, regional, or ‘global’ right? (Internet Data Privacy Law, OUP, 2019) 11-12 stating that ‘it re-establishes a link between the territory where people live, their rights as residents of such territory, and the activities of the search engines carried out on that territory’
125 Case C-18/18, Google LLC v Commission nationale de l'informatique et des libertés [2019] ECR I-772, para 72
126 Replaced by today’s European Data Protection Board composed of ‘national data protection authorities and the European Data Protection Supervisor’ see European Data Protection Board, About EDPB: who we are (2020) <https://edpb.europa.eu/about-edpb/about-edpb_en> accessed 10 June 2020
127 Article 29 Working Party, Guidelines on the Implementation of the Court of Justice of the European Union Judgment on “Google Spain and Inc v. Agencia Espan~ola de Proteccio ́ n de Datos (AEPD) and Mario Costeja Gonza ́ lez” C-131/12 (WP 225) (2014) 9 <https://ec.europa.eu/justice/article-29/docu mentation/opinion-recommendation/files/2014/wp225_en.pdf> accessed 10 June 2020
The previous cases illustrate that the Court has yet to rely in its judgments on the territorial scope contained in Art. 3(2) GDPR and favours a classical interpretation of its jurisdiction based on the principle of territoriality. In fact, the Court is careful as to avoid jurisdictional tensions with other States.128 According to Fink, the Court’s judgments, especially in Google
v CNIL “essentially highlights the incompatibility between principles of territorial jurisdiction
and global data flows.”129 The Court also notices this incompatibility since it states in the ruling
Google v CNIL jurisdiction based on the effects doctrine to be justified, thus suggesting it to
be best suited for activities occurring over the internet.130
3.2 Comparison with the Extraterritorial Enforcement of European Competition Law
Section 2.3. already introduced the Court’s reliance on the effects doctrine. The analysis below will, therefore, portray in more detail the evolution of the Court’s case law in three phases towards recognising the doctrine as a solid basis for enforcing EU competition law extraterritorially.
The first phase begins with Dyestuffs where the Court developed the so-called “economic
entity doctrine” as to apply EU competition law directly to the parent company located outside
the Union (in the United Kingdom, before becoming a Union Member) via the presence of the company’s subsidiaries on the European territory.131 The Court’s reliance on the principle of
territoriality to rule on the anti-competitive effect within the Union can be explained by the opposition to EU’s extraterritorial jurisdiction.132 Indeed, the United Kingdom submitted an
aide-mémoire to the Court where it considered the Union to infringe upon its territorial sovereignty.133
128 Jure Globocnik, The right to be forgotten is taking shape: CJEU Judgements in GC and Others (C-136/17) and Google v CNIL (C-507/17), vol 69 (GRUR International, OUP, 2020) 386
129 Michèle Finck, Google v CNIL: Defining the Territorial Scope of European Data Protection Law (University of Oxford, 2018) <https://www.law.ox.ac.uk/business-law-blog/blog/2018/11/goo gle-v-cnil-defining-territorial-scope-european-data-protection-law> accessed 10 June 2020
130 Case C-18/18, Google LLC v Commission nationale de l'informatique et des libertés [2019] ECR I-772, para 58
131 Case 48/69 ICI v. Commission [1972] ECR 619, paras 128-135
132 Peter Behrens, The extraterritorial reach of EU competition law revisited: The “effects doctrine” before the ECJ, Discussion Paper No 3/15 (Europa-Kolleg Hamburg, Institute for European Integration, 2016) 9
133 Aide-mémoire submitted by the UK Government to the European Court in the Dyestuff case [1972] in Alan Vaughan Lowe, Extraterritorial Jurisdiction: An Annotated Collection of Legal Materials (Grotius Publication Ltd, 1983) 144-146
