{"id":1745,"date":"2019-01-16T09:24:10","date_gmt":"2019-01-16T14:24:10","guid":{"rendered":"https:\/\/www2.law.temple.edu\/10q\/?p=1745"},"modified":"2019-01-16T09:24:10","modified_gmt":"2019-01-16T14:24:10","slug":"does-gdpr-apply-to-your-brand","status":"publish","type":"post","link":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/","title":{"rendered":"Does GDPR Apply to Your Brand?"},"content":{"rendered":"<p>Does the EU General Data Protection Regulation (GDPR) apply to my brand? This is a question with which many U.S.-based franchisors have been grappling since the GDPR took effect on May 25<sup>th<\/sup>, 2018. Six months later, the European Data Protection Board (EDPB) has issued, for public comment, guidelines on the territorial scope of GDPR.<\/p>\n<p>Below is a breakdown of the major questions and takeaways for US-based franchisors:<\/p>\n<h2 class=\"h3\">Do you have an \u2018establishment in the Union\u2019?<\/h2>\n<ul>\n<li>You could be deemed to have an establishment in the Union (and subject to GDPR) even if you do not have a branch, subsidiary, or franchisee in an EU member state.<\/li>\n<li>Any real and effective activity, even a minimal one, could satisfy the notion of establishment for the purpose of Article 3(1) jurisdiction; even, in some cases, the presence of a single employee.<\/li>\n<li>However, just having a website accessible from Europe is not enough.<\/li>\n<\/ul>\n<h2 class=\"h3\">(If you have an EU establishment) Is your data processing carried out \u2018in the context of its activities\u2019?<\/h2>\n<ul>\n<li>GDPR will apply to your data processing if there is an inextricable link between the activities of an EU establishment and the processing of data carried out by you (a non-EU entity).<\/li>\n<li>As non-EU controller, you will not become subject to GDPR simply because you chose to use a processor (a service provider carrying out the data controller\u2019s instructions) in the Union.<\/li>\n<li>If you are a controller subject to GDPR and you choose to use a processor located outside the Union and not subject to the GDPR, you will need to ensure by contract that the processor processes your data in accordance with the GDPR.<\/li>\n<\/ul>\n<h2 class=\"h3\">If you do not have an establishment in the EU \u0336 do you offer products or services to individuals in the EU? (Article 3(2))?<\/h2>\n<ul>\n<li>\u201cIn the EU\u201d means physically located in the EU at the time of the offering of goods or services (or the monitoring of behavior; see below). It does not mean citizenship or residence.<\/li>\n<li>Does the processing relate to (1) the offering of goods or services or (2) to the monitoring of data subjects\u2019 behavior in the Union?<\/li>\n<\/ul>\n<h3 class=\"h4\">(1) Do you offer Goods or Services?<\/h3>\n<ul>\n<li>In order to fall in scope, you need to manifest your intention to establish commercial relations with consumers in the EU. For this, the EDPB uses the concept of \u201cdirecting an activity\u201d to the EU market, developed in case law by the Court of Justice of the EU (CJEU) with respect to jurisdictional matters. Payment for the services, however, is not required.<\/li>\n<li>Some non-exhaustive factors, taken possibly in combination with one another, include:\n<ul>\n<li>mentioning dedicated addresses or phone numbers to be reached from an EU country<\/li>\n<li>marketing and advertisement campaigns directed at an EU country audience<\/li>\n<li>using an EU or member state top-level domain name<\/li>\n<li>mentioning customers domiciled in various EU member states, including client testimonials<\/li>\n<li>using an EU language or an EU currency<\/li>\n<li>offering the delivery of goods in EU member states.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3 class=\"h4\">(2) Do you monitor behavior of individuals in the EU?<\/h3>\n<ul>\n<li>Monitoring can be done both on the internet and through other types of networks or technology involving personal data processing, for example through wearable and other smart devices.<\/li>\n<li>Monitoring activities include:\n<ul>\n<li>geo-localization activities, in particular for marketing purpose<\/li>\n<li>online tracking through the use of cookies or other tracking techniques such as fingerprinting<\/li>\n<li>personalized diet and health analytics services online<\/li>\n<li>CCTV<\/li>\n<li>market surveys and other behavioral studies based on individual profiles, including behavioral advertising<\/li>\n<li>monitoring or regular reporting on an individual\u2019s health status<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none\"><\/li>\n<\/ul>\n<h2 class=\"h3\">Do you need to appoint a representative in the Union?<\/h2>\n<p>If you are a non-EU controller or processor that is subject to GDPR, you are required to appoint a representative in the Union, unless an exception applies. Local representatives may be held liable for the non-EU entity\u2019s breaches and may be subject to administrative fines and penalties.<\/p>\n<p>If you are not a public authority, you are obligated to appoint a representative unless your processing is \u201coccasional\u201d and \u201cdoes not include, on a large scale, processing of special categories of data\u2026.or processing of personal data relating to criminal convictions and offences\u2026\u201d, and such processing \u201cis unlikely to result in a risk to the rights and freedoms of natural persons.\u201d The EDPB does not elaborate on these and refers to criteria listed in the WP29 guidance on DPOs for the definition of \u201clarge scale processing\u201d (<em>e.g<\/em>. factors like the number of data subjects concerned; the volume of data and\/or the range of different data items being processed; the duration, or permanence, of the data processing activity; the geographical extent of the processing activity.<\/p>\n<p>The appointed representative should be established in one of the member states where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behavior is monitored, are located.<\/p>\n<hr \/>\n<p><em>Odia Kagan is a Partner and Chair of GDPR Compliance and International Privacy at Fox Rothschild LLP, a full-service national law firm with 900+ attorneys in 27 offices coast-to-coast. Odia has assisted more than 80 companies, from U.S.-based multinationals to startups, on their path to compliance with the EU General Data Protection Regulation (GDPR). <\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>GDPR and you. Read the newest post on the Temple 10-Q to help decide if GDPR applies to your brand.<\/p>\n","protected":false},"author":5,"featured_media":1791,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,27],"tags":[106,923,136,924,925,926,202,927,928,889,929,746,930,931],"coauthors":[2,922],"class_list":["post-1745","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alumni-authored","category-international-business","tag-compliance","tag-cookies","tag-cyberlaw","tag-edpb","tag-eu","tag-european-data-protection-board","tag-european-union","tag-gdpr","tag-international-compliance","tag-international-law","tag-monitoring","tag-privacy","tag-public-guidelines","tag-tracking","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-33"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Does GDPR Apply to Your Brand? - The Temple 10-Q<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Does GDPR Apply to Your Brand? - The Temple 10-Q\" \/>\n<meta property=\"og:description\" content=\"GDPR and you. Read the newest post on the Temple 10-Q to help decide if GDPR applies to your brand.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\" \/>\n<meta property=\"og:site_name\" content=\"The Temple 10-Q\" \/>\n<meta property=\"article:published_time\" content=\"2019-01-16T14:24:10+00:00\" \/>\n<meta name=\"author\" content=\"Books Schatschneider, Odia Kagan (LLM &#039;09)\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Books Schatschneider, Odia Kagan (LLM &#039;09)\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\"},\"author\":{\"name\":\"Books Schatschneider\",\"@id\":\"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/23e7012f0cf133dbeb0e76693c9e0154\"},\"headline\":\"Does GDPR Apply to Your Brand?\",\"datePublished\":\"2019-01-16T14:24:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\"},\"wordCount\":864,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg\",\"keywords\":[\"Compliance\",\"Cookies\",\"cyberlaw\",\"EDPB\",\"EU\",\"European Data Protection Board\",\"European Union\",\"GDPR\",\"International Compliance\",\"International Law\",\"Monitoring\",\"Privacy\",\"Public Guidelines\",\"Tracking\"],\"articleSection\":[\"Alumni Authored\",\"International Business\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\",\"url\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\",\"name\":\"Does GDPR Apply to Your Brand? - The Temple 10-Q\",\"isPartOf\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg\",\"datePublished\":\"2019-01-16T14:24:10+00:00\",\"author\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/23e7012f0cf133dbeb0e76693c9e0154\"},\"breadcrumb\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage\",\"url\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg\",\"contentUrl\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg\",\"width\":2560,\"height\":1548},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/law.temple.edu\/10q\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Does GDPR Apply to Your Brand?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/law.temple.edu\/10q\/#website\",\"url\":\"https:\/\/law.temple.edu\/10q\/\",\"name\":\"The Temple 10-Q\",\"description\":\"Temple&#039;s Business Law Magazine\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/law.temple.edu\/10q\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/23e7012f0cf133dbeb0e76693c9e0154\",\"name\":\"Books Schatschneider\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/62b6c5fa1068c42262dab498d74cb3fc60fbba8344047dc13348bd3aacf7b70a?s=96&d=mm&r=g9dc77189f33a293d2c82a50cd24ebb9f\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/62b6c5fa1068c42262dab498d74cb3fc60fbba8344047dc13348bd3aacf7b70a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/62b6c5fa1068c42262dab498d74cb3fc60fbba8344047dc13348bd3aacf7b70a?s=96&d=mm&r=g\",\"caption\":\"Books Schatschneider\"},\"url\":\"https:\/\/law.temple.edu\/10q\/author\/rschatsc\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Does GDPR Apply to Your Brand? - The Temple 10-Q","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/","og_locale":"en_US","og_type":"article","og_title":"Does GDPR Apply to Your Brand? - The Temple 10-Q","og_description":"GDPR and you. Read the newest post on the Temple 10-Q to help decide if GDPR applies to your brand.","og_url":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/","og_site_name":"The Temple 10-Q","article_published_time":"2019-01-16T14:24:10+00:00","author":"Books Schatschneider, Odia Kagan (LLM '09)","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Books Schatschneider, Odia Kagan (LLM '09)","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#article","isPartOf":{"@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/"},"author":{"name":"Books Schatschneider","@id":"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/23e7012f0cf133dbeb0e76693c9e0154"},"headline":"Does GDPR Apply to Your Brand?","datePublished":"2019-01-16T14:24:10+00:00","mainEntityOfPage":{"@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/"},"wordCount":864,"commentCount":0,"image":{"@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage"},"thumbnailUrl":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg","keywords":["Compliance","Cookies","cyberlaw","EDPB","EU","European Data Protection Board","European Union","GDPR","International Compliance","International Law","Monitoring","Privacy","Public Guidelines","Tracking"],"articleSection":["Alumni Authored","International Business"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/","url":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/","name":"Does GDPR Apply to Your Brand? - The Temple 10-Q","isPartOf":{"@id":"https:\/\/law.temple.edu\/10q\/#website"},"primaryImageOfPage":{"@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage"},"image":{"@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage"},"thumbnailUrl":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg","datePublished":"2019-01-16T14:24:10+00:00","author":{"@id":"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/23e7012f0cf133dbeb0e76693c9e0154"},"breadcrumb":{"@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#primaryimage","url":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg","contentUrl":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg","width":2560,"height":1548},{"@type":"BreadcrumbList","@id":"https:\/\/law.temple.edu\/10q\/does-gdpr-apply-to-your-brand\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/law.temple.edu\/10q\/"},{"@type":"ListItem","position":2,"name":"Does GDPR Apply to Your Brand?"}]},{"@type":"WebSite","@id":"https:\/\/law.temple.edu\/10q\/#website","url":"https:\/\/law.temple.edu\/10q\/","name":"The Temple 10-Q","description":"Temple&#039;s Business Law Magazine","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/law.temple.edu\/10q\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/23e7012f0cf133dbeb0e76693c9e0154","name":"Books Schatschneider","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/62b6c5fa1068c42262dab498d74cb3fc60fbba8344047dc13348bd3aacf7b70a?s=96&d=mm&r=g9dc77189f33a293d2c82a50cd24ebb9f","url":"https:\/\/secure.gravatar.com\/avatar\/62b6c5fa1068c42262dab498d74cb3fc60fbba8344047dc13348bd3aacf7b70a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/62b6c5fa1068c42262dab498d74cb3fc60fbba8344047dc13348bd3aacf7b70a?s=96&d=mm&r=g","caption":"Books Schatschneider"},"url":"https:\/\/law.temple.edu\/10q\/author\/rschatsc\/"}]}},"jetpack_featured_media_url":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2019\/01\/Europe-for-GDPR-Article-scaled.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/posts\/1745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/comments?post=1745"}],"version-history":[{"count":0,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/posts\/1745\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/media\/1791"}],"wp:attachment":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/media?parent=1745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/categories?post=1745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/tags?post=1745"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/coauthors?post=1745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}