On 18 November 2021, the European Data Protection Board (EDPB) released the Guidelines on the Interplay between the application of Article 3 and the provisions on international transfer as per Chapter V of the GDPR (The Guidelines) for public consultation until 31 January 2022.
The EDPB clarified that the collection of personal information directly abroad shall not constitute international transfer but shall follow in any case Art. 3(2) of the GDPR if there is an offering of goods, services, or monitor of behavior. However, in case such foreigner receiver transfers the personal information to a processor established in the same country, this will constitute transfer and follow Chapter V rules.
Example: A Chinese e-commerce company receives personal data from its customers directly on its server in China and transfers the same data to its processor in China (e.g., for storage purposes). The collection of data will be subject to Art. 3(2) if there is an offering of goods, services, or monitor of the behavior of data subject in the EU, whereas the transfer to the Chinese processor shall follow Chapter V of the GDPR although the processor and controller are both in the same country.
If these Guidelines will be formally adopted by the EDPB as they are, they will have a huge impact on Chinese companies processing or collecting data from Europe. At Wang Jing & GH Law Firm we are always ready to assist our clients regarding new trends and rules that may have a major impact on your business in China and abroad. If you believe you could be subject to the above rules, please don’t hesitate to reach us for a consultation.
