On 18 November 2021, the European Data Protection Board (EDPB) released the Guidelines on the Interplay between the application of Article 3 and the provisions on international transfer as per Chapter V of the GDPR (The Guidelines) for public consultation until 31 January 2022.
Following Art. 3(2) of the European General Data Protection Regulation (GDPR), the law still applies to a company outside the territory of the European Union (for instance located in China) if it offers goods or services or monitors the behavior of data subject (e.g., customers) in Europe.
In addition, by virtue of Art. 44, the transfer of personal information to a third country (including China) for the activity of processing (qualified as a “transfer”) must comply with Chapter V.
In this regard, the Guidelines specify three cumulative criteria that qualify processing as transfers:
-a controller or a processor (“exporter”) is subject to the GDPR for the given processing;
-this controller or processor transmits or makes personal data available to (a joint) controller or processor (“importer”);
-the importer is in a third country or is an international organization.
Example: An Italian company provides personal data of its customers to a cloud service provider established in China who is already subject to the GDPR by virtue of the Art. 3(2) due to its offering of hosting services to data subjects in the EU. The processing of such data will be considered as a transfer to a processor in a third country and therefore, subject to Chapter V of the GDPR although the processor in China is already subject to the GDPR via Art. 3(2).
At Wang Jing & GH Law Firm we are always ready to assist our clients regarding new trends and rules that may have a major impact on your business in China and abroad. If you believe you could be subject to the above rules, please don’t hesitate to reach us for a consultation.
