The European Data Protection Board (EDPB)recently published the minutes of the 54th Plenary Meeting held in September2021, which shed light on how the EDPB may address the issue of data transfersfrom Europe to third countries (including China). In the past, directcollection of personal data from European consumers were not considered as data“transfer” under the General Data Protection Regulation (GDPR). However, theEDPB new minutes indicate that companies that have no physical presence inEurope (therefore including Chinese companies) but need to collect data fromEuropean consumers are indeed subject to the GDPR by virtue of Art.3(2)“Territorial Scope”, and therefore shall abide by Chapter V of datatransfer mechanisms and related requirements. The minutes suggest that the EDPBis likely to adopt guidelines requiring Chapter V data transfer mechanisms tobe put in place in this direct data collection scenario.
It remains to be seen how the soon-to-beissued guidelines will regulate direct data collection. However, Chinesecompanies offering products or services to European consumers shall bear inmind that, if the GDPR Chapter V becomes applicable to them, it raises higherdata compliance requirements. Administrative fines up to 20,000,000 EUR or upto 4% of the total worldwide annual turnover (whichever is higher) will beimposed on companies for infringement of Chapter V of the GDPR.
