The Long-Arm of the GDPR and its Inherent Weakness - The EDPB’s Guidelines 05/2021 on the Interplay of Article 3 and Chapter V of the GDPR

Abstract

The European Data Protection Board’s Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR continue the maximalist territorial approach the EU has taken, at least since Google Spain and its insistence on ‘effective and complete protection of data subjects.’ Yet, they speak particularly to the recognition in Schrems II that the simple extension of a protective law to another country does not necessarily translate into equivalent protection, if the wider legal landscape in that country distorts the law in its actual operation. This recognition almost necessarily entails that being subject to the GDPR (by virtue of Art 3) should not displace the transfers rules in Chapter V if the processing occurs in a third country, given that only the transfer rules are specifically directed towards the actual reception of GDPR duties and rights in the third country. Consistently but not easily reconcilable with the rules' inherent design, the Guidelines take a cumulative - rather than a complementary or compensatory - approach to the interplay of Art 3 and Chapter V of the GDPR. Implicitly, the approach acknowledges that giving the GDPR a wide territorial scope hardly delivers a panacea of effectiveness and control over data controllers or processors on far away shores in fundamentally different legal and political orders. Yet, whether this cumulative approach will deliver on the promise of increased protection is equally doubtful.

Keywords: GDPR, data protection, jurisdiction, territorial scope, transfer rules, state surveillance